How to enable TPM2.0 in Windows 10 IoT Enterprise

Question

I'm using NXP i.mx8m plus EVK with the Windows 10 IoT Enterprise.

And in my system, there's an external TPM device connected to the i.mx8m plus via SPI bus.

Refer to the introduction

https://github.com/MicrosoftDocs/windows-iotcore-docs/blob/main/windows-iotcore/secure-your-device/SetupTPM.md

1. for my application, should apply the fTPM or dTPM scheme?
2. The i.mx8m starts the system via the uboot (no UEFI) , how could I set the configurations in UEFI?
3. I tied to use dTPM method without the UEFI configuration, then I can found a "security device" in device manager with error.

Could somebody guide how to do it?

Answer 1

Hello Sure, I can provide some guidance on your questions:   fTPM or dTPM scheme: The choice between firmware TPM (fTPM) and discrete TPM (dTPM) depends on your specific application and security requirements. Both provide a level of hardware-based security, but dTPM is a separate chip on your motherboard, while fTPM is a firmware-based solution. dTPM is generally considered more secure as it is physically isolated, but fTPM can be a good choice for systems where hardware space is at a premium.   Setting configurations in UEFI: The i.MX8M Plus EVK boots the system via the U-Boot, not UEFI. Therefore, setting configurations in UEFI might not be applicable in this case. However, you can set environment variables in U-Boot for specific use cases.   dTPM method without UEFI configuration: If the TPM is a TPM 2.0 and isn’t detected by Windows, verify that your computer hardware contains a Unified Extensible Firmware Interface (UEFI) that is Trusted Computing Group-compliant. Also, ensure that in the UEFI settings, the TPM hasn’t been disabled or hidden from the operating system. Since your system starts via U-Boot and not UEFI, this could be the reason for the “security device” error in the device manager.   To enable TPM 2.0 in Windows 10 IoT Enterprise, you can follow these steps:   Run Settings > Update & Security > Windows Security > Device Security   If you do not see a Security processor section on this screen your PC may have a TPM that is disabled.   To enable the TPM, check your PC manufacturer’s support information for instructions.   If you are able to enable a TPM, complete the next step to verify that it is a TPM 2.0. If you see an option for Security processor details under Security processor, select that and verify that your Specification version is 2.0. If it is less than 2.0, your device does not meet the Windows 11 requirements.   Best Regards, Wesley Li

If the Answer is helpful, please click "Accept Answer" and upvote it.