Overview
ISO/IEC 11889-4:2009 - "Information technology - Trusted Platform Module - Part 4: Commands" is the ISO standard that specifies the command set for the Trusted Platform Module (TPM). As part of the ISO/IEC 11889 family, this part details the individual TPM commands, the actions they cause, and the parameters they accept and return. First published in 2009, the document is intended for implementers who need a formal, interoperable definition of TPM behavior for platform trust, attestation and cryptographic services.
Key Topics
This part organizes and defines TPM functionality by command families, including:
- Admin and startup commands (TPM_Init, TPM_Startup, TPM_SaveState)
- Testing and self-test operations (TPM_SelfTestFull, TPM_GetTestResult)
- Ownership and physical presence management (TPM_TakeOwnership, TPM_OwnerClear, TSC_PhysicalPresence)
- Capability and auditing commands (TPM_GetCapability, TPM_GetAuditDigest, TPM_SetOrdinalAuditStatus)
- Storage and key management (TPM_Seal, TPM_Unseal, TPM_CreateWrapKey, TPM_LoadKey2)
- Migration and endorsement key handling (TPM_CreateMigrationBlob, TPM_CreateEndorsementKeyPair)
- Cryptographic primitives and services (TPM_SHA1Start/Complete, TPM_Sign, TPM_GetRandom)
- Integrity reporting and PCR operations (TPM_Extend, TPM_PCRRead, TPM_Quote/Quote2)
- Authorization, delegation and session management (TPM_OIAP, TPM_OSAP, TPM_Delegate_* commands)
- Non-volatile storage, monotonic counters, transport and DAA (NV_Read/Write, TPM_CreateCounter, TPM_EstablishTransport, TPM_DAA_*)
The specification lists inputs/outputs, parameter sizes and expected behaviors for each command, providing the authoritative reference for conformant TPM firmware and host software.
Applications
ISO/IEC 11889-4:2009 is used by:
- TPM firmware and silicon vendors implementing the device command interface
- BIOS/UEFI and OS developers integrating TPM-based secure boot, measured boot and attestation
- Security architects and system integrators designing platform integrity, key management and hardware-backed authentication
- Enterprise and cloud providers deploying device attestation, disk encryption and trusted key storage
- Certification bodies and test labs validating conformance to TPM command behavior
Practical uses include secure key storage, platform integrity measurement, remote attestation, sealed data bound to platform state, and hardware-based cryptographic services.
Related Standards
- Other parts of the ISO/IEC 11889 TPM family (architecture and data structures)
- Trusted Computing Group (TCG) TPM specifications and conformance test suites
Keywords: ISO/IEC 11889-4:2009, Trusted Platform Module, TPM commands, TPM functionality, TPM specification, platform integrity, hardware security, TPM cryptographic functions, TPM auditing, TPM key management.