PKI & TPMGlossary

The discipline (and the software category) responsible for discovering, issuing, deploying, renewing, and revoking X.509 certificates across an organisation so that none silently expire and none are misused.

A TCG-standard TPM 2.0 protocol that cryptographically binds a device's Attestation Key to its manufacturer-certified Endorsement Key, proving the AK was generated inside the same TPM.

IEEE 802.1AR is the standard for cryptographically verifiable device identity, defining an Initial DevID (IDevID) burned in at manufacture and a Locally Significant DevID (LDevID) issued after deployment.

The TPM's permanent, manufacturer-certified identity key. Its private half never leaves the chip; its public half arrives with a certificate signed by the TPM vendor that anchors the device's hardware identity.

The cryptographic credential — typically an X.509 certificate, a key pair, or a signed token — that lets a machine (a server, a workload, a container, a device, an AI agent) authenticate to another machine.

A shielded register inside a TPM that accumulates cryptographic measurements of code and configuration during boot, producing a fingerprint a verifier can compare against a golden reference.

A family of cryptographic algorithms designed to remain secure against attacks by both classical and future quantum computers, standardised by NIST starting in 2024.

A protocol in which one party (the attester) produces cryptographic evidence about its hardware and software state that a remote party (the verifier) can evaluate against a policy before granting trust.

SPIFFE is an open standard for issuing cryptographically verifiable identities to software workloads; SPIRE is its reference implementation. Together they solve workload-to-workload authentication without shared secrets.

A hardware or firmware security chip specified by the Trusted Computing Group that stores cryptographic keys, measures boot state, and produces signed evidence a remote verifier can trust.