Industry-wide interoperability in platform security has been strengthened, thanks to a joint development effort between the Trusted Computing Group (TCG) and DMTF that improves how devices securely recognize and communicate with each other. DMTF’s libspdm is a key software component – and an implementation of the Security Protocol and Data Model (SPDM) specification – that helps devices check each other’s identity and communicate securely. By including Trusted Platform Module (TPM) support, the organization has taken a practical step forward to strengthen interoperability of devices, expand developer flexibility, and reinforce industry alignment around trusted platform security.
“We welcome DMTF’s decision to integrate TPM capabilities into libspdm,” said TCG President Joe Pennisi. “Not only does it highlight the importance of cooperation between standards organizations, but by bringing the two technologies together in accessible reference code, we can help implementers understand how perfectly they complement one another.”
The work builds upon the formal cooperation between TCG and DMTF. In 2021, the organizations established a work register identifying areas of technical collaboration intended to improve alignment between SPDM and TCG technologies and to support more secure and interoperable platform implementations.
Also Read: OGP Brings Optics at the Core, Certainty to Measure More to IMTS 2026
The SPDM specification, developed by DMTF, provides standardized mechanisms for component authentication, measurement reporting, attestation, key exchange, and the establishment of secured communications. The new libspdm TPM backend enables implementations to make use of TPM-protected key material and platform measurements during selected operations.
Because private-key operations can be performed without exporting the underlying private key from the TPM, the integration also provides developers with a reference pattern for combining SPDM’s protocol-level security functions with a hardware-backed Root-of-Trust.
Current libspdm documentation describes TPM integration for:
- Retrieving SPDM certificate chains from TPM NV storage
- Signing SPDM challenge responses using TPM-resident private keys
- Providing measurement data derived from TPM PCRs
- Performing signing operations used during SPDM key exchange
DMTF’s spdm-emu reference environment also demonstrates the integration using swtpm – a software TPM. This enables developers to build and test TPM-backed SPDM flows without requiring dedicated TPM hardware during initial development. The libspdm TPM integration layer is designed to connect to either TPM hardware or an appropriate software TPM environment.
“We’re pleased to introduce TPM support in libspdm, accompanied by implementation documentation and an emulator-based validation environment,” said DMTF President Jeff Hilland. “This open-source reference implementation helps developers explore and validate interoperable SPDM-based security solutions utilizing TPMs, serving as a demonstration of how industry standard development organizations can work closely together to improve solutions for our members and the industry.”
