Developers using TPM 2.0 find work easier
Open source meeting TCG TSS ESAPI specifications
Infineon Technologies announced on the 4th that it is providing a new open-source software stack. This makes it easier for developers to use Trusted Platform Module (TPM) 2.0. TPM is a standardized hardware-based security solution for securing various applications, including industrial, automotive, and network equipment.

This software stack is the first open-source TPM middleware to meet the Trusted Computing Group (TCG) Software Stack (TSS) Enhanced System API (ESAPI) specifications, providing useful tools for the open-source community.

“The demand for security in IoT, IIoT, Industry 4.0, and automotive applications is growing. The availability of the open-source TSS ESAPI layer has made TPM 2.0 integration easier for all types of applications,” said Michael Roeder, Director of Technology Engineering and Services at Avnet Silica.

By making the TSS ESAPI layer available to everyone, Infineon contributes to making security integration easier and promoting its widespread adoption. It also connects security specialists through the Infineon Security Partner Network (ISPN). ISPN provides a diverse range of software libraries to meet the needs of various applications and platforms.

Infineon funded the development of ESAPI by the Fraunhofer Institute for Security and Information Technology (SIT), a long-standing partner. The ESAPI layer developed with Infineon funding is based on the SAPI layer developed by Intel and includes a new API layer designed to facilitate the use and integration of TPMs. This enables applications to establish a connection with the TPM, create a secure connection between the host CPU and the TPM, and authenticate using Message Authentication Codes (HMAC).

This stack, based on the ESAPI layer, supports OpenSSL. By using Infineon's OPTIGA TPM, it can secure SSL/TLS-enabled device communications through a standardized interface. It utilizes TPM 2.0 as the secure key store for OpenSSL. This allows keys to be protected from vulnerabilities such as the Heartbleed bug.

The TSS stack and ESAPI layer are provided under a generous two-clause BSD license, offering high flexibility and accessibility for anyone. ESAPI is designed to achieve the high levels of quality and stability required for advanced embedded and IoT systems and has undergone extensive community validation. For industrial and automotive customers, the code was developed through iterative integration and testing based on industry standards, thorough two-person proofreading, and static code analyzers such as clang and Coverity. The stack was tested and verified using Infineon's OPTIGA TPM SLB 9670 and the latest TPM specifications. In the future, we plan to improve support for Cryptsetup/LUKS disk encryption and provide a TPM tool that supports ESAPI.

Andreas Fuchs, project leader at Fraunhofer SIT, said, “The launch of TSS marks a turning point in improving the security of embedded systems in industrial, automotive, and smart homes using TPM 2.0.”

For application developers, Infineon provides the OPTIGA TPM SLB 9670 Iridium board, and allows for rapid development by downloading TSS code from GitHub. Additionally, there are plans to provide source code packages for Infineon AURIX and Arduino microcontrollers in the near future.