The Trusted Computing Group (TCG) and the Distributed Management Task Force (DMTF) have expanded their technical collaboration to improve how devices authenticate one another and establish secure communications across modern computing environments.
The work adds Trusted Platform Module (TPM) support to DMTF’s libspdm, an open-source reference implementation of the Security Protocol and Data Model (SPDM). SPDM provides standardised mechanisms for component authentication, measurement reporting, attestation, key exchange and secured communications.
The integration enables developers to combine SPDM’s protocol-level security functions with hardware-backed platform trust. Private-key operations can be performed within a TPM without exporting the underlying key, while platform measurements can be used during selected security operations.
“We welcome DMTF’s decision to integrate TPM capabilities into libspdm,” said Joe Pennisi, president of TCG. “By bringing the two technologies together in accessible reference code, we can help implementers understand how perfectly they complement one another.”
The libspdm documentation covers retrieving SPDM certificate chains from TPM non-volatile storage, signing challenge responses with TPM-resident private keys, providing measurement data derived from TPM platform configuration registers, and performing signing operations used during SPDM key exchange.
DMTF’s spdm-emu reference environment demonstrates the integration using swtpm, a software TPM. This allows developers to build and test TPM-backed SPDM workflows without dedicated hardware during the early stages of development. The integration layer is designed to connect with either a physical TPM or a suitable software TPM environment.
DMTF president Jeff Hilland said the open-source reference implementation would help developers explore and validate interoperable SPDM-based security solutions using TPMs.
The latest work builds on a formal cooperation established in 2021, when TCG and DMTF created a work register to improve alignment between SPDM and TCG technologies.
The development is significant as enterprises, cloud providers and equipment manufacturers seek stronger assurance over hardware, firmware and peripheral devices. In increasingly distributed environments, devices must be able to prove their identity and report their security state before exchanging sensitive data or being granted access to critical services.
The collaboration also provides a practical foundation for trusted computing in edge and Internet of Things deployments, where devices may operate remotely, have limited resources or connect to systems that cannot rely solely on network-based security controls.
By combining hardware-backed keys and measurements with a standardised communication protocol, the TCG-DMTF work could help reduce implementation differences and make platform security easier to test. DMTF’s libspdm already supports requester and responder implementations and can be used with emulator and validation tools.
