Trusted Platform Module (TPM)

A Trusted Platform Module is a dedicated cryptographic chip, usually soldered to the motherboard, that generates and stores keys inside tamper-resistant hardware so they never touch main memory or disk. At boot it measures each stage of firmware and loader code by hashing it into platform configuration registers, building an integrity record that supports secure boot and remote attestation. It can also seal secrets so they are released only when those measurements match a known-good state.

The classic use is protecting the symmetric encryption key for full-disk encryption: BitLocker keeps its volume key sealed by the TPM, so the disk decrypts only in its own machine with unmodified boot code, and a stolen drive is just ciphertext. The nuance is what a TPM is not: it is not a high-throughput crypto accelerator, and it is bound to one platform. A hardware security module (HSM) is the removable or network-attached appliance used for bulk key operations at a certificate authority or a payment processor.

Exam relevance: if a scenario asks how to protect disk encryption keys on a laptop, verify boot integrity, or bind secrets to a specific machine, the answer is TPM. If it involves an enterprise CA, code signing at scale, or dedicated key storage for servers, the answer is HSM. The confusable pair is exactly that: TPM is per-platform trust and measurement, HSM is dedicated key processing shared by many systems.