Overview
ISO/IEC 11889-3:2015 - "Information technology - Trusted Platform Module Library - Part 3: Commands" defines the Trusted Platform Module (TPM) commands and their normative behavior. The standard specifies detailed command descriptions written in the C language (with extensive comments) and relies on the constants, flags, structures and unions defined in ISO/IEC 11889-2. While Part 3 provides normative C-language command logic, a complete description of TPM behavior requires reading this part together with ISO/IEC 11889-4.
Keywords: ISO/IEC 11889-3:2015, TPM commands, Trusted Platform Module, TPM library, TPM 2.0 commands.
Key Topics and Technical Requirements
- Command definitions and semantics: Formal descriptions of each TPM command (e.g., startup, self-test, session, object, duplication, asymmetric primitives) with command/response formats.
- C-language normative implementation: Command behaviors are specified as C-like code that implementers can follow to produce compliant firmware or software.
- Command processing model: Validation steps (header, handles, modes), session and authorization handling, parameter decryption, unmarshaling, and post-processing rules.
- Error handling and response codes: Standardized response code semantics and tagging for consistent interoperability.
- Implementation-dependent and testing guidance: Sections covering startup/shutdown sequences, self-test and test-result commands, and considerations for vendor-specific implementations.
- Practical allowances: Where a fully compliant implementation is impossible, vendors may provide alternative implementations that meet the general functional description in the standard.
Keywords: TPM command processing, authorization, parameter unmarshaling, response codes, TPM testing.
Practical Applications and Users
ISO/IEC 11889-3:2015 is essential for:
- TPM firmware and microcontroller developers implementing TPM command logic.
- Hardware vendors integrating TPM silicon into platforms.
- OS, BIOS, and hypervisor developers that issue TPM commands or implement middleware.
- Security engineers and integrators designing platform attestation, secure boot, key management, and credential protection.
- Certification labs and interoperability testers verifying TPM conformance.
Using this standard ensures consistent command semantics across implementations, improving interoperability for use cases such as secure boot, measured launch, remote attestation, key storage, and cryptographic operations.
Keywords: secure boot, remote attestation, key management, TPM implementation guide.
Related Standards
- ISO/IEC 11889-2 - data types, constants, structures and union definitions required by Part 3.
- ISO/IEC 11889-4 - complements Part 3 to fully specify the required behavior of a compliant TPM.
For implementers, consult Parts 2 and 4 alongside ISO/IEC 11889-3:2015 to achieve a complete, standards-compliant TPM solution.