TPM classes
Every attested device gets exactly one class, derived from the endorsement-key certificate chain. Policies accept groups or pin classes; the class is a label, and the manufacturer signature is the defence.
{
"name": "secure-hardware",
"acceptedClassGroups": ["hardware", "firmware-tpm", "mobile-hardware"], // expands to new vendors automatically
"acceptedSpecificClasses": ["cloud-vtpm-aws-nitro"] // pin one class on top
}The classes
| Class | Group | Assurance | strict-hardware | Chain |
|---|---|---|---|---|
| hardware-discrete-infineon | hardware | High | accepted | Infineon OPTIGA; Infineon root. |
| hardware-discrete-st-micro | hardware | High | accepted | STMicro ST33 / ST73; STMicro Global TPM CA. |
| hardware-discrete-nuvoton | hardware | High | accepted | Nuvoton NPCT65x / 75x; Nuvoton root. |
| hardware-discrete-other | hardware | High | accepted | Any other discrete chip chaining to a TCG-listed root. Pin a subclass if you need to. |
| firmware-tpm-intel-ptt | firmware-tpm | High | accepted | Intel Platform Trust Technology, inside the ME. |
| firmware-tpm-amd-ftpm | firmware-tpm | High | accepted | AMD fTPM on the PSP; AMD root, intermediates fetched via AIA. |
| firmware-tpm-pluton | firmware-tpm | High | accepted | Microsoft Pluton, in the CPU. |
| cloud-vtpm-aws-nitro | cloud-vtpm | Medium | rejected | NitroTPM. Cross-validated with the Nitro document and EC2 instance identity. |
| cloud-vtpm-azure | cloud-vtpm | Medium | rejected | Trusted-launch vTPM. Cross-validated with IMDS attested data. |
| cloud-vtpm-gcp | cloud-vtpm | Medium | rejected | Shielded VM vTPM. Cross-validated with the instance-identity JWT. |
| cloud-vtpm-hyper-v | cloud-vtpm | Medium | rejected | Hyper-V vTPM, including Host Guardian deployments. |
| emulated-swtpm | emulated | None | rejected | swtpm or the Microsoft simulator. No external trust anchor. |
| mobile-android-strongbox | mobile-hardware | High | accepted | Android Key Attestation, StrongBox secure element. |
| mobile-android-tee | mobile-hardware | High | accepted | Android Key Attestation, TrustZone TEE. |
| mobile-apple-secure-enclave | mobile-hardware | High | accepted | Secure Enclave key attestation. |
| mobile-apple-app-attest | mobile-hardware | High | accepted | DCAppAttestService, iOS 14+. |
| mobile-android-software | mobile-software | Reduced | rejected | Software-backed Android key; no TEE present. |
hardware and firmware-tpm earn the real-device and oem-keyed claims and set the hardware tier of trustworthinessVector. A device whose chain does not terminate at a pinned root is rejected before its class matters.
How the classifier decides
Two fields on the EK certificate, read in order; the first that yields a class wins.
- TCG manufacturer code (SAN
2.23.133.2.1):IFX→ Infineon,INTC→ Intel PTT,STM→ STMicro, and so on. - Issuer DN substring, as the fallback:
Infineon,Nuvoton,Pluton,Azure,swtpm, …
MSFT is shared by Pluton and the Hyper-V vTPM, so it is disambiguated by the issuer: Pluton → firmware-tpm-pluton, Host Guardian or vTPM → cloud-vtpm-hyper-v, otherwise Pluton. swtpm ships asserting the IBM manufacturer code, which alone means nothing: a cert with the IBM code and a non-swtpm issuer is hardware-discrete-other. The emulator is caught by its issuer (swtpm, SW TPM, Software TPM) — and, before that, by having no chain to a pinned root.
Accepting cloud
A cloud-vtpm class under a policy with requireCloudCrossValidation must also present provider instance-identity evidence, and the verifier binds the vTPM to that instance:
- AWS — the Nitro attestation document (COSE_Sign1, pinned Nitro root) plus the EC2 instance identity document against the per-region signing certificates.
- Azure — the IMDS attested-data PKCS#7 envelope against the pinned DigiCert Global Root G2.
- GCP — the instance-identity JWT against Google's live JWKS, audience-as-nonce.
Evidence relayed from instance A cannot produce an identity document naming instance B.
Devices classified unknown that carry a legitimate vendor EK certificate: send a sample certificate to support and the vendor root is added. Policy against groups picks it up with no change on your side. Policy shapes are on the Policies page.