Businesses have been provided a clear benchmark for judging whether electronic device vendors’ claims of protection against quantum enabled attacks are valid, through new guidance released today from the Trusted Computing Group.

TCG’s requirements for Trusted Platform Modules (TPMs) enables companies to request clear evidence from vendors that their products genuinely meet essential Post Quantum Cryptography (PQC) requirements and avoid TPMs that advertise ‘compliance’ yet fail to provide full, end-to-end security capabilities.

“It’s important that organizations gain a full understanding of what a PQC-ready TPM is,” said TCG President Joe Pennisi. “As PQC capabilities emerge, businesses will need to look beyond individual algorithm support and understand the broader requirements for quantum-safe identities, attestation, and hardware-anchored trust.”

With cryptographic requirements continuing to evolve, TPMs play an important role in helping businesses maintain trusted identities, platform integrity, attestation, and hardware-anchored security over time. TCG’s work on PQC readiness helps provide a clear path for how these capabilities can continue to support long-term trust as industry standards and security expectations advance.

It is important to recognize the risks facing platforms and TPMs that are not yet PQC-ready, and to plan for that risk as part of a broader security lifecycle. Key security elements such as platform identities, attestation keys, and firmware measurements may need to remain secure for decades.

Consequently, organizations should understand where quantum-safe primitives are required, where transition planning is needed, and how TCG guidance can help them make informed decisions about a genuinely quantum-resilient RoT – a critical need given that 90% of businesses still lack a formal PQC roadmap.

Outlined by the TCG, the critical requirement for a PQC-ready TPM is one that implements the TCG PC Client Platform TPM Profile (PTP) 1.07. A foundational document for the industry’s transition toward PQC-capable TPMs, it defines TPM 2.0 implementations that support PQC algorithms to provide quantum-safe cryptographic protection.

PTP 1.07 is the baseline for a PQC-ready TPM, defining the required PQC-specific elements from the recently published TPM 2.0 Library Specification Version 1.85. TCG’s PTP 1.07 outlines the minimum requirements for PQC-ready TPMs, however, vendors developing TPMs may choose to implement additional optional PQC algorithms in their designs.

As part of the organization’s efforts to bring structure to the ongoing transition to PQC, TCG has defined two TPM transition designations describing a platform’s ability to adopt the PQC capabilities specified by PTP 1.07:

• ‘TCG PQC-ready TPM’
• ‘TCG PQC-upgradable TPM’

At a high level, a TPM that implements PTP 1.07 is defined as a ‘TCG PQC-ready TPM’. A ‘TCG PQC-upgradable TPM’ is one that does not presently support PTP 1.07, but has the capability to be upgraded to this support. A more comprehensive overview can be found on the TCG website.

TCG has also announced plans to enhance its certification programs to certify TPMs that meet the requirements of PTP 1.07. Once completed, the organization will define and provide the requirements for a TCG-certified ‘TCG PQC-ready TPM’.

More information on this certification program will be made available in due course.

– ENDS –

About TCG
TCG is a not-for-profit organization formed to develop, define and promote open, vendor-neutral, global industry specifications and standards, supportive of a hardware-based root of trust, for interoperable trusted computing platforms.

TCG enables secure computing through open standards and specifications. Benefits of TCG include protection of business-critical data and systems, secure authentication and strong protection of user identities, and the establishment of strong machine identity and network integrity. More than a billion devices include TCG technologies.

X: @TrustedComputin
LinkedIn: https://www.linkedin.com/company/trusted-computing-group