Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
BS ISO IEC 11889 โ Information Technology โ Trusted Platform Module Library Series
Information Technology โ Trusted Platform Module Library (2015 Edition, 4 Parts)
๐ BS ISO/IEC 11889 is the British Standard implementation, adopted by BSI, of the ISO/IEC 11889 international series prepared by Technical Committee IST/33 (IT โ Security techniques), classified under ICS 35.040. The series provides a complete international standard specification for the Trusted Platform Module (TPM), covering architecture, structures, commands, and routines. It is the core hardware-security standard for building the trust root of trusted computing, enabling secure boot, key escrow, and platform integrity measurement.
๐ก The TPM is the “root of trust” embedded in a platform: at the hardware level it provides protected key generation, encryption/decryption, signing, and integrity measurement. Even if the operating system is compromised, sensitive keys and measurement values in the TPM are difficult to steal or tamper with.
1. Series Overview ๐
The BS ISO/IEC 11889 series was published in its second edition in 2015 in four parts. Part 1 (architecture) describes the overall TPM architecture, terminology, symbols, and conventions; Part 2 (structures) defines the data structures, types, and constants used by the TPM; Part 3 (commands) specifies the command set and its semantics; Part 4 (routines) specifies the interface routines related to commands. The series supersedes the 2009 first edition; given extensive existing product deployment, the old edition remains valid until 1 January 2026.
The series primarily serves trusted-computing chip and firmware manufacturers, secure-boot and key-management solution designers, security component developers for operating systems and virtualization platforms, enterprise IT security architects, and third-party testing and certification bodies for platform security evaluation.
2. Structure and Technical Highlights ๐
| Standard | Title | Core Content |
|---|---|---|
| BS ISO/IEC 11889-1:2015 | Architecture | Overall TPM architecture, terminology, symbols, bit/octet numbering, and sized-buffer conventions |
| BS ISO/IEC 11889-2:2015 | Structures | Data structures, named constants, data type aliases (typedefs), and notation used by the TPM |
| BS ISO/IEC 11889-3:2015 | Commands | TPM command set, command semantics, handle and parameter demarcation, authorization size and parameter size |
| BS ISO/IEC 11889-4:2015 | Routines | Interface routines related to command execution (scanned version, written from public-domain knowledge) |
โ ๏ธ BS ISO/IEC 11889-4 in this material is a scanned version; its description is written from public-domain knowledge of the standard. Please refer to the official BSI publication for the authoritative text.
3. Key Technical Requirements ๐ง
The key technical requirements of the BS ISO/IEC 11889 series are reflected at the architecture, data, and command levels:
- Architecture (Part 1): defines the TPM component model, root of trust, and measurement chain; specifies bit/octet numbering, sized-buffer, and other coding conventions for interoperability across implementations.
- Structures (Part 2): specifies named constants, data type aliases (typedefs), and notation, providing unified type definitions for command parameters and return values.
- Command set (Part 3): specifies supported TPM commands, including key management, signing, encryption/decryption, integrity measurement, random number generation, PCR (Platform Configuration Register) operations, and authorization protocols; defines handle and parameter demarcation, authorization size and parameter size conventions.
- Security properties: TPM protects key generation and storage, resists offline attacks, and supports multiple authorization and policy-session mechanisms to ensure controlled platform operations.
- Routines (Part 4): specifies interface routines on which command execution depends, ensuring correct interaction between higher-level software and TPM firmware.
๐จ The security value of the TPM depends on correct firmware and key-management implementation: if a manufacturer leaves backdoors in firmware, entropy for key generation is insufficient, or the PCR measurement chain is poorly designed, the TPM’s “root of trust” role is weakened. During procurement and evaluation, check that the chip conforms to the standard and has passed independent security certification.
4. Engineering Practice Applications ๐ ๏ธ
In engineering practice, the BS ISO/IEC 11889 series is mainly applied to:
- ๐ Secure Boot: use TPM PCR measurements to verify the integrity of bootloaders, kernels, and boot components, ensuring the system loads only trusted software.
- ๐ง Key escrow and encryption: delegate disk-encryption keys, certificate private keys, and other sensitive keys to the TPM for protection, preventing keys from being stored in plaintext on volatile or non-volatile media.
- ๐ Remote platform integrity attestation: report platform configuration state (measurement values) to a remote verifier via the TPM for zero-trust network access and device compliance decisions.
- ๐ Identity and access control: generate platform-unique identity keys via the TPM for device identity authentication and anti-counterfeiting, securing supply chains and IoT devices.
โ
It is recommended that platform security designers select standard-conforming TPMs per the BS ISO/IEC 11889 series, and combine them with TCG specifications (e.g., PC Client) and OS security mechanisms to build a complete trust chain from the hardware root of trust to the application layer.
5. Frequently Asked Questions โ
โ Q: What is the relationship between TPM and the Trusted Computing Group (TCG)?
A: TCG defines the architecture and specifications of the TPM; ISO/IEC 11889 internationalizes the TPM specification as an ISO standard, and BS ISO/IEC 11889 is its UK national implementation. They correspond in substance; the ISO version gives the TPM specification international standard status.
A: TCG defines the architecture and specifications of the TPM; ISO/IEC 11889 internationalizes the TPM specification as an ISO standard, and BS ISO/IEC 11889 is its UK national implementation. They correspond in substance; the ISO version gives the TPM specification international standard status.
โ Q: Why does the TPM need Platform Configuration Registers (PCRs)?
A: PCRs record measurement values (hashes) of components during boot and operation, and can only be extended, not directly overwritten. PCR values allow tracing which components the system loaded, enabling secure boot and remote integrity attestation.
A: PCRs record measurement values (hashes) of components during boot and operation, and can only be extended, not directly overwritten. PCR values allow tracing which components the system loaded, enabling secure boot and remote integrity attestation.
โ Q: What is the principle behind TPM-protected keys?
A: The TPM generates and stores keys within a protected hardware boundary; private keys never leave the TPM in plaintext. External software can only use keys through TPM commands for signing, decryption, etc., preventing key theft or copying.
A: The TPM generates and stores keys within a protected hardware boundary; private keys never leave the TPM in plaintext. External software can only use keys through TPM commands for signing, decryption, etc., preventing key theft or copying.
โ Q: Why does the 2009 edition remain valid until 2026?
A: Because a large number of products are already deployed based on the 2009 edition, several national bodies requested the old edition remain available to support existing products and deployments. Thus, after the new edition, the old one remains valid in parallel until 1 January 2026 for a smooth transition.
A: Because a large number of products are already deployed based on the 2009 edition, several national bodies requested the old edition remain available to support existing products and deployments. Thus, after the new edition, the old one remains valid in parallel until 1 January 2026 for a smooth transition.
โ Q: Does BS ISO/IEC 11889 apply to mobile devices such as phones?
A: The TPM concept can extend to mobile devices (e.g., embedded secure elements or trusted applications in a TEE), but mobile devices usually adopt other security specifications (TEE, secure chips). BS ISO/IEC 11889 mainly targets PCs and servers; mobile scenarios require the corresponding specifications.
A: The TPM concept can extend to mobile devices (e.g., embedded secure elements or trusted applications in a TEE), but mobile devices usually adopt other security specifications (TEE, secure chips). BS ISO/IEC 11889 mainly targets PCs and servers; mobile scenarios require the corresponding specifications.