Usability and Security of Trusted Platform Module (TPM) Library APIs
summary
A qualitative study (n=9 interviewed, 13 completed) analyzes developers using tpm2-tools and finds 18 thematic usability and security pitfalls: unhelpful error messages, inconsistent naming, insecure example snippets, and heavy reliance on unsafe defaults. The work builds an open-source browser study platform to run tasks combining encryption, sealing, PCR measurements and attestation and shows APIs mirror TPM specs that cause the issues. Recommendations: secure-by-default libraries, concrete secure code examples, clearer docs, and higher-level abstractions.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 1:30Why this study
- 3:06About TPM
- 6:45Themes
- 7:34Error Handling
- 8:13Recommendations
- 10:36Summary
related talks
37mtpm2-software.github.io - Enabling the TPM2.0 Ecosystem in Linux
29mThe Trusted Platform Module
36mTPM Software Stack - Enabling the TPM2.0 Ecosystem in Linux
28mThe TPM as an everyday security tool
51mApplications of TPM 2.0
25mOverview and Recent Developments: TPM
51mSecuring Embedded Linux Systems with TPM 2.0
39mTPM Is No Silver Bullet: Pitfalls in Embedded Device Security