TCG Algorithm Registry
Family “2.0"Level 00 Revision 01.34
April 13, 2023

Contact: admin@trustedcomputinggroup.org

Work in ProgressThis document is an intermediate draft forcomment only and is subject to change without
notice. Readers should not design products basedon this document.

TCG

TCG Algorithm Registry Error! No text of specified style in document.

TCG PUBLIC REVIEW
Copyright © TCG 2023

Page ii
April 13, 2023

Family “2.0"Level 00 Revision 01.34

TCG Algorithm Registry
Disclaimers, Notices, and License Terms
THIS SPECIFICATION IS PROVIDED "AS IS" WITH NO WARRANTIESWHATSOEVER,
INCLUDINGANYWARRANTYOF
MERCHANTABILITY,NONINFRINGEMENT, FITNESS FOR ANY PARTICULAR PURPOSE, OR ANY
WARRANTY OTHERWISE ARISING OUT OF ANY PROPOSAL, SPECIFICATION ORSAMPLE.
Without limitation, TCG disclaims all liability, including liability for infringementof any proprietary rights, relating to use of information in this specification andto the implementation of this specification, and TCG disclaims all liability for costof procurement of substitute goods or services, lost profits, loss of use, loss ofdata or any incidental, consequential, direct, indirect, or special damages,
whether under contract, tort, warranty or otherwise, arising in any way out of use
or reliance upon this specification or any information herein.
This document is copyrighted by Trusted Computing Group (TCG), and no license,
express or implied, is granted herein other than as follows: You may not copy or
reproduce the document or distribute it to others without written permission from
TCG, except that you may freely do so for the purposes of (a) examining or
implementing TCG specifications or (b) developing, testing, or promoting information
technology standards and best practices, so long as you distribute the document withthese disclaimers, notices, and license terms.
Contact the Trusted Computing Group at www.trustedcomputinggroup.org for
information on specification licensing through membership agreements.
Any marks and brands contained herein are the property of their respective
owners.

Family “2.0"

TCG PUBLIC REVIEW

Page iii

Level 00 Revision 01.34

Copyright © TCG 2023

April 13, 2023

TCG Algorithm Registry

Change History

Page iv

TCG PUBLIC REVIEWFamily “2.0"April 13, 2023

Copyright © TCG 2023

Level 00 Revision 01.34

TCG Algorithm Registry
VersionDate

Description

1.27

09.26.2017

Added change history.
CMAC algorithm assigned as 0x003F in Table 3.
Removed extra whitespace above the title of clause 6.10.
Assigned bitfields in Table 26 for SHA3_256, SHA3_384 and SHA3_512.
Replaced references of deprecated IETF 3447 with IETF 8017.
Removed Annex A (Applicability of this Registry for Other TCG Specifications)

1.28

01.28.2020

Removed Type “H” for TPM_ALG_OAEP in Table 3
Added Types “E” and “M” and comments for TPM_ALG_SM2 in Table 3
Changed references for SM2 to GB/T 32918 Parts 1 through 5
Changed reference for SM3 to ISO/IEC 10118-3:2018
Changed reference for SM4 to GB/T 32907-2016

1.29

02.19.2020

Added algorithms CCM, GCM, KW, KWP, EAX, EdDSA in Table 3
Added Brainpool P256/384/512 R1 curves in Table 4
Added curve parameters for Brainpool P256/384/512 R1 to clause 5.2
Added curve parameters for Curve 25519 to clause 5.2

1.30

02.27.2020

Added 2nd reference to TPM_ALG_ECDH in Table 3 to include X25519
Added note to TPM_ALG_EDDSA in Table 3

1.31

03.09.2020

Updated EDDSA to EdDSA in Table 4
Fixed formatting in Table 5, NIST_P192, parameter value of gY
Fixed formatting in Table 10, BN_P256, parameter value of p and n
Fixed formatting in Table 18, 19, 20

1.32

03.20.2020

Added new references to bibliography

1.33

03.01.2023

Added LMS, XMSS
Added SHAKE128, SHAKE256 and fixed-length variants of SHAKE256
Added SHA256_192
Added EDDSA_PH for HashEdDSA
Added CURVE_448
Fixed usage of 'H' in some ECC curve parameters (should be 'h')Removed mandatory signing scheme from Edwards curve parameter tables
Updated references to ISO 10118-3

Family “2.0"

TCG PUBLIC REVIEW

Page vLevel 00 Revision 01.34

Copyright © TCG 2023

April 13, 2023

TCG Algorithm Registry
1.34

04.13.2023

Clarified that 'S' applies only to symmetric block ciphers
Introduce type 'K' for non-block cipher symmetric functions, adding it to
TPM_ALG_HMAC but not the KDFs (to avoid breaking the TPM Library Specification's
usage of !ALG.HM)
Added KEYEDXOF, KMACXOF128, KMACXOF256, KMAC128, KMAC256
Added type 'H' back to TPM_ALG_OAEP
Add note that TPM_ALG_ECDSA is nondeterministic ECDSA

Page vi

TCG PUBLIC REVIEWFamily “2.0"April 13, 2023

Copyright © TCG 2023

Level 00 Revision 01.34

TCG Algorithm Registry

CONTENTS
1Introduction .......................................................................................................................... 1

2

Conventions ......................................................................................................................... 2
2.1
Bit and Octet Numbering and Order ........................................................................... 2
2.2
Sized Buffer References ............................................................................................ 2
2.3
Numbers .................................................................................................................... 3

3

Notation ................................................................................................................................ 4
3.1
Named Constants ....................................................................................................... 4
3.2
Enumerations ............................................................................................................. 4
3.3
Bit Field Definitions .................................................................................................... 5
3.4
Name Prefix Convention ............................................................................................. 54

TPM_ALG_ID ....................................................................................................................... 65

ECC Values ........................................................................................................................ 12
5.1
Curve ID Values ....................................................................................................... 12
5.2
Curve Parameters .................................................................................................... 13
5.2.1
Introduction ..................................................................................................... 13
5.2.2
NIST P192 ...................................................................................................... 13
5.2.3
NIST P224 ...................................................................................................... 14
5.2.4
NIST P256 ...................................................................................................... 15
5.2.5
NIST P384 ...................................................................................................... 16
5.2.6
NIST P521 ...................................................................................................... 17
5.2.7
BN P256 ......................................................................................................... 18
5.2.8
BN P638 ......................................................................................................... 19
5.2.9
SM2_P256 ...................................................................................................... 20
5.2.10
BP_P256_R1 .................................................................................................. 21
5.2.11
BP_P384_R1 .................................................................................................. 22
5.2.12
BP_P512_R1 .................................................................................................. 23
5.2.13CURVE_25519 ................................................................................................ 24
5.2.14CURVE_448 ................................................................................................... 25

6

Hash Parameters ................................................................................................................ 26
6.1
Introduction .............................................................................................................. 26
6.2
SHA1 ....................................................................................................................... 26
6.3
SHA256 ................................................................................................................... 26
6.4
SHA384 ................................................................................................................... 26
6.5
SHA512 ................................................................................................................... 27
6.6
SM3_256.................................................................................................................. 27
6.7
SHA3_256 ................................................................................................................ 27
6.8
SHA3_384 ................................................................................................................ 27
6.9
SHA3_512 ................................................................................................................ 28
6.10 Hash Algorithms Bit Field ......................................................................................... 28

7

Symmetric Block Cipher Parameters ................................................................................... 29
7.1
Introduction .............................................................................................................. 29
7.2
AES ......................................................................................................................... 29
7.3
SM4 ......................................................................................................................... 29
7.4
Camellia ................................................................................................................... 29
7.5
TDES ....................................................................................................................... 30

8Hash-Based Signature Parameters and Considerations ........................................................ 0
8.1
Introduction ................................................................................................................ 0
8.2
NIST Parameter Sets ................................................................................................. 0

Annex A — Bibliography .............................................................................................................. 2

Family “2.0"Level 00 Revision 01.34

Page vii
Copyright © TCG 2023

April 13, 2023

TCG Algorithm Registry1

Introduction

The Algorithm Registry lists each algorithm assigned an identifier, allowing it to be unambiguously
defined and referenced by other TCG specifications. This document is a compendium of data
related to the various algorithms used in specifications created by the Trusted Computing Group(TCG). The compendium of algorithm data is intended to ensure interoperability between devices
built to be compliant with TCG specifications.
Many TCG specifications use a layered architecture where a single “library” specification on abottom layer may be used by numerous platform specific middle layers (e.g. PC Client or Mobile
Platform) to enable a variety of top level use cases. TCG specifications support products andsolutions for numerous markets with varied requirements for commercial usefulness including
features, security, interoperability, globalization, performance, regulatory requirements,
compatibility, compliance, intellectual property rights, certification, etc. TCG as an organization
does not perform cryptographic analysis of algorithms. The presence of an algorithm in the registry
does not endorse its use by TCG for any specific use case or indicate an algorithm’s acceptability
for meeting any particular requirement set. The TCG endeavors to provide a variety of algorithms
of varying strength for various commercial purposes. Ultimately, the TCG adds algorithms to its
registry based on the needs of its membership.
Security is built into an increasing number of general purpose Information and Communications
Technology (ICT) products, and security standards are fundamental to the integrity andsustainability of the global ICT infrastructure. The Trusted Computing Group (TCG) believes that
open, interoperable, and internationally vetted standards are critical for the success of trusted
computing, and that the multilateral approach to creating such standards is most effective.
TCG recognizes international standards in the field of IT security as the most appropriate method
to ensure efficacy, interoperability, adoption and user acceptance. TCG takes into considerationinternational market requirements through international membership and welcomes participationfrom industry, academia, and governments in a unified, worldwide Trusted Computing standards
development process.
Commercial implementation of TCG standards is managed by individual product and service
providers. Implementers or adopters of any solution using TCG specifications must carefully
assess the appropriateness of any algorithms or TCG specification for satisfying their goals. In
assessing algorithms, TCG recommends implementers and adopters diligently evaluate available
information such as governmental, industrial, and academic research. Solutions involving
cryptography are dependent on the solution architecture and on the properties of cryptographic
algorithms supported. Over time, cryptographic algorithms can develop deficiencies for reasons
like advances in cryptographic techniques or increased computing power. Solutions that support
a diversity of algorithms can remain durable when subsets of supported algorithms wane in
usefulness. Therefore, implementers intent on providing robust solutions are responsible for
evaluating both algorithm appropriateness and diversity.
The TCG classifies algorithms listed in this registry according to the following labels:•

TCG Standard - The algorithm is mandatory in one or more TCG specifications thatreference this registry. The TCG designates algorithms with this classification inaccordance with its goals of promoting international standards and interoperability.

•

TCG Legacy – The algorithm is assigned an identifier for compatibility or historical reasonsand is unlikely to be referenced by future TCG specifications. The TCG designates analgorithm with this classification based on the goals of the organization to discontinue
support for the algorithm and transition solutions to alternative algorithms. Stakeholders
using solutions relying on algorithms classified as TCG Legacy are strongly recommended
to reevaluate the algorithm’s appropriateness based on the current state of the art.

Family “2.0"

TCG PUBLIC REVIEW

Page 1

Level 00 Revision 01.34

Copyright © TCG 2023

April 13, 2023

•Assigned – The algorithm is assigned an identifier, allowing it to be unambiguously definedand referenced by other TCG specifications, but is not designated as TCG Standard or
TCG Legacy.

In terms of algorithm lifecycle in the registry, the TCG will initially assign algorithms to the Assigned
classification. Some algorithms will be reclassified as TCG Standard if they become mandatory
algorithms in TCG specifications. Eventually, algorithms are expected to transition to the TCG
Legacy categorization.
2

Conventions

2.1

Bit and Octet Numbering and Order

An integer value is considered to be an array of one or more octets. The octet at offset zero within
the array is the most significant octet (MSO) of the integer. Bit number 0 of that integer is its leastsignificant bit and is the least significant bit in the last octet in the array.
EXAMPLEA 32-bit integer is an array of four octets; the MSO is at offset [0], and the most significant bit is bit number
31. Bit zero of this 32-bit integer is the least significant bit in the octet at offset [3] in the array.

NOTE

Array indexing is zero-based.

The first listed member of a structure is at the lowest offset within the structure and the last listed
member is at the highest offset within the structure.
For a character string (letters delimited by “”), the first character of the string contains the MSO.
2.2

Sized Buffer References

The specification makes extensive use of a data structure called a sized buffer. A sized buffer hasa size field followed by an array of octets equal in number to the value in the size field.
The structure will have an identifying name. When the specification references the size field of thestructure, the structure name is followed by “.size” (a period followed by the word “size”). Whenthe specification references the octet array of the structure, the structure name is followed by“.buffer” (a period followed by the word “buffer”).

Page 2

TCG PUBLIC REVIEWFamily “2.0"April 13, 2023

Copyright © TCG 2023

Level 00 Revision 01.34

2.3

Numbers

Numbers are decimal unless a different radix is indicated.
Unless the number appears in a table intended to be machine readable, the radix is a subscript
following the digits of the number. Only radix values of 2 and 16 are used in this specification.
Radix 16 (hexadecimal) numbers have a space separator between groups of two hexadecimal
digits.
EXAMPLE 1

40 FF 12 3416

Radix 2 (binary) numbers use a space separator between groups of four binary digits.
EXAMPLE 20100 1110 00012

For numbers using a binary radix, the number of digits indicates the number of bits in the
representation.
EXAMPLE 32016 is a hexadecimal number that contains exactly 8 bits and has a decimal value of 32.

EXAMPLE 4

10 00002 is a binary number that contains exactly 6 bits and has a decimal value of 32.

EXAMPLE 5

0 2016 is a hexadecimal number that contains exactly 12 bits and has a decimal value of 32.

A number in a machine-readable table may use the “0x” prefix to denote a base 16 number. In thisformat, the number of digits is not always indicative of the number of bits in the representation.
EXAMPLE 6

0x20 is a hexadecimal number with a value of 32, and the number of bits is determined by the context.

Family “2.0"

TCG PUBLIC REVIEW

Page 3

Level 00 Revision 01.34

Copyright © TCG 2023

April 13, 2023

3

Notation

The notations in this clause describe the representation of various data so that it is both humanreadable and amenable to automated processing.
3.1

Named Constants

A named constant is a numeric value to which a name has been assigned. In the C language, thisis done with a #define statement. In this specification, a named constant is defined in a tablethat has a title that starts with “Definition” and ends with “Constants.”
The table title will indicate the name of the class of constants that are being defined in the table.
The title will include the data type of the constants in parentheses.
The table in Example 1 names a collection of 16-bit constants.
EXAMPLE 1

Table xx — Definition of (UINT16) COUNTING Constants

3.2

Parameter

Value

Description

first

1

decimal value is implicitly the size of thesecond0x0002hex value will match the number of bits in the constant

third

3

fourth0x0004

Enumerations

A table that defines an enumerated data type will start with the word “Definition” and end with
“Values.”A value in parenthesis will denote the intrinsic data size of the value and may have the values"INT8", "UINT8", "INT16", “UINT16”, "INT32", and “UINT32.” If this value is not present, “UINT16”
is assumed.
The table in Example 1 shows how an enumeration would be defined in this specification.
EXAMPLE 1

Table xx — Definition of (UINT16) CARD_SUIT Values
Suit Names

Value

CLUBS

0x0000DIAMONDS

0x000DHEARTS

0x001ASPADES

0x0027

Description

Page 4

TCG PUBLIC REVIEWFamily “2.0"April 13, 2023

Copyright © TCG 2023

Level 00 Revision 01.34

3.3

Bit Field Definitions

A table that defines a structure containing bit fields has a title that starts with “Definition” and ends
with “Bits.” A type identifier in parentheses in the title indicates the size of the datum that contains
the bit fields.
When the bit fields do not occupy consecutive locations, a spacer field is defined with a name of“Reserved.” Bits in these spaces are reserved and shall be zero.
The table in Example 1 shows how a structure containing bit fields would be defined in thisspecification.
When a field has more than one bit, the range is indicated by a pair of numbers separated by acolon (“:”). The numbers will be in high:low order.
EXAMPLE1

Table xx — Definition of (UINT32) SOME_ATTRIBUTE Bits

3.4

Bit

Name

Action0

zeroth_bit

SET (1): what to do if bit is 1
CLEAR (0): what to do if bit is 0

1

first_bit

SET (1): what to do if bit is 1
CLEAR (0): what to do if bit is 0

6:2

Reserved

A placeholder that spans 5 bits

7

third_bit

SET (1): what to do if bit is 1
CLEAR (0): what to do if bit is 0

31:8

Reserved

Placeholder to fill 32 bits

Name Prefix Convention

Parameters are constants, variables, structures, unions, and structure members. Structure
members are given a name that is indicative of its use, with no special prefix. The other parametertypes are named according to their type with their name starting with “TPMx_”, where “x” is an
optional character to indicate the data type.
In some cases, additional qualifying characters will follow the underscore. These are generally
used when dealing with an enumerated data type.
Table 1 — Name Prefix Convention
PrefixDescription

TPM_

a constant or an enumerated type

TPM_ALG_an enumerated type that indicates an algorithm
A TPM_ALG_ is often used as a selector for a union.

TPM_xx_an enumeration value of a particular typeThe value of “xx” will be indicative of the use of the enumerated type. A table of “TPM_xx” constantdefinitions will exist to define each of the TPM_xx_ values.
EXAMPLE 1

TPM_RC_ indicates that the type is used for a responseCode.

Family “2.0"

TCG PUBLIC REVIEW

Page 5

Level 00 Revision 01.34

Copyright © TCG 2023

April 13, 2023

4

TPM_ALG_ID

Table 3 is the list of algorithms to which the TCG has assigned an algorithm identifier along with
its numeric identifier.
An algorithm ID is often used like a tag to determine the type of a structure in a context-sensitive
way. The values for TPM_ALG_ID shall be in the range of 00 00 16 – 7F FF 16 . Other structure tags
will be in the range 80 00 16 – FF FF 16 .
An algorithm shall not be assigned a value in the range 00 C1 16 – 00 C6 16 in order to prevent any
overlap with the command structure tags used in TPM 1.2.
The implementation of some algorithms is dependent on the presence of other algorithms. When
there is a dependency, the algorithm that is required is listed in column labeled "Dep" (Dependent)
in Table 4.
EXAMPLE

Implementation of TPM_ALG_RSASSA requires that the RSA algorithm be implemented.

TPM_ALG_KEYEDHASH and TPM_ALG_NULL are required of all TPM implementations.

Page 6

TCG PUBLIC REVIEWFamily “2.0"April 13, 2023

Copyright © TCG 2023

Level 00 Revision 01.34

Table 2 — Legend for TPM_ALG_ID Table
Column Title

Comments

Algorithm Name

the mnemonic name assigned to the algorithm

Value

the numeric value assigned to the algorithm

Type

The allowed values are:A – asymmetric algorithm with a public and private key
S – a symmetric block cipher or a mode of operation of a block cipher
H – hash algorithm that compresses input data to a digest value or indicates amethod that uses a hashX – signing algorithm
N – an anonymous signing algorithm
E – an encryption mode
M – a method such as a mask generation function
O – an object typeC – an algorithm in which the key is associated with a counter value that
increments upon use, and may be used only a limited number of times; thekey holder must never re-use a counter value
Z – an extendable-output function (XOF) which compresses input data to a digest
value of any desired length
NOTE

The requested length is not input to the compression function of a XOF.
Requesting two different lengths of output from the same XOF results in
two outputs where one is a prefix of the other.

K – a keyed function, i.e., a symmetric function that is not a block cipher

C(Classification) The allowed values are:
A – Assigned
S – TCG Standard
L – TCG Legacy

Dep(Dependent) Indicates which other algorithm is required to be implemented if thisalgorithm is implemented

Reference

the reference document that defines the algorithm

Comments

clarifying information

Family “2.0"

TCG PUBLIC REVIEW

Page 7

Level 00 Revision 01.34

Copyright © TCG 2023

April 13, 2023

Table 3 — Definition of (UINT16) TPM_ALG_ID Constants
Algorithm Name

Value

Type

Dep

C

Reference

Comments

TPM_ALG_ERROR

0x0000

TPM_ALG_RSA

0x0001 A OSIETF RFC 8017

the RSA algorithm

TPM_ALG_TDES

0x0003 S

A

ISO/IEC 18033-3

block cipher with various key
sizes (Triple Data Encryption
Algorithm, commonly called
Triple Data Encryption
Standard)

TPM_ALG_SHA

0x0004 H

S

ISO/IEC 10118-3

the SHA1 algorithm

TPM_ALG_SHA1

0x0004 H

S

ISO/IEC 10118-3

redefinition for
documentation consistency

TPM_ALG_HMAC

0x0005 H K X

SISO/IEC 9797-2

Hash Message
Authentication Code (HMAC)
algorithm

TPM_ALG_AES

0x0006 S

S

ISO/IEC 18033-3

the AES algorithm withvarious key sizes

TPM_ALG_MGF1

0x0007 H M

SIEEE Std 1363TM2000
IEEE Std 1363a™2004

hash-based mask-generation
function

TPM_ALG_KEYEDHASH

0x0008 H O

STCG TPM 2.0 libraryspecification

an object type that may use
XOR for encryption or an
HMAC for signing and may
also refer to a data object
that is neither signing nor
encrypting

TPM_ALG_XOR

0x000A H S

STCG TPM 2.0 libraryspecification

the XOR encryption
algorithm

TPM_ALG_SHA256

0x000B H

S

ISO/IEC 10118-3

the SHA 256 algorithm

TPM_ALG_SHA384

0x000C HS

ISO/IEC 10118-3

the SHA 384 algorithm

TPM_ALG_SHA512

0x000D H

A

ISO/IEC 10118-3

the SHA 512 algorithm

TPM_ALG_SHA256_192

0x000E HANIST SP800-208

the most significant (i.e.,
leftmost) 192 bits of the
SHA-256 hash

TPM_ALG_NULL

0x0010S

TCG TPM 2.0 libraryspecification

Null algorithm

TPM_ALG_SM3_256

0x0012 H

A

ISO/IEC 101183:2018

SM3 hash algorithm

TPM_ALG_SM4

0x0013 S

A

GB/T 32907-2016

SM4 symmetric block cipher

TPM_ALG_RSASSA

0x0014 A X

RSASIETF RFC 8017

a signature algorithm definedin section 8.2 (RSASSAPKCS1-v1_5)

TPM_ALG_RSAES

0x0015 A E

RSASIETF RFC 8017

a padding algorithm definedin section 7.2 (RSAESPKCS1-v1_5)

TPM_ALG_RSAPSS

0x0016 A X

RSASIETF RFC 8017

a signature algorithm definedin section 8.1 (RSASSAPSS)

should not occur

Page 8

TCG PUBLIC REVIEWFamily “2.0"April 13, 2023

Copyright © TCG 2023

Level 00 Revision 01.34

Algorithm Name

Value

Type

Dep

C

Reference

Comments

TPM_ALG_OAEP

0x0017 A E H RSASIETF RFC 8017

a padding algorithm definedin section 7.1(RSAES_OAEP)

TPM_ALG_ECDSA

0x0018 A X

ECCS

ISO/IEC 14888-3

signature algorithm using
elliptic curve cryptography(ECC)(Non-deterministic ECDSA)

TPM_ALG_ECDH

0x0019 A M

ECCSNIST SP800-56A
IETF RFC 7748

secret sharing using ECC
Based on context, this canbe either One-Pass DiffieHellman, C(1, 1, ECC CDH)
defined in 6.2.2.2, Full
Unified Model C(2, 2, ECC
CDH) defined in 6.1.1.2 of
SP 800-56A, or X25519
defined in 5. of RFC 7748

TPM_ALG_ECDAA

0x001A A X N ECCSTCG TPM 2.0 libraryspecification

elliptic-curve based,
anonymous signing scheme

TPM_ALG_SM2

0x001B A X E ECC
M

A

GB/T 32918.1-2016
GB/T 32918.2-2016
GB/T 32918.3-2016
GB/T 32918.4-2016
GB/T 32918.5-2017

SM2 – depending on context,
either an elliptic-curve based,signature algorithm, an
encryption scheme, or a key
exchange protocol

TPM_ALG_ECSCHNORR

0x001C A X

ECCS

TCG TPM 2.0 libraryspecification

elliptic-curve based Schnorr
signature

TPM_ALG_ECMQV

0x001D A M

ECCANIST SP800-56A

two-phase elliptic-curve key
exchange – C(2, 2, ECC
MQV) section 6.1.1.4

TPM_ALG_KDF1_SP800_56A

0x0020 H M

ECCSNIST SP800-56A

concatenation key derivation
function (approved
alternative 1) section 5.8.1

TPM_ALG_KDF2

0x0021 H M

AIEEE Std 1363a2004

key derivation function KDF2
section 13.2

TPM_ALG_KDF1_SP800_108

0x0022 H M

SNIST SP800-108

a key derivation method
Section 5.1 KDF in CounterMode

TPM_ALG_ECC

0x0023 A O

SISO/IEC 15946-1

prime field ECC

TPM_ALG_SYMCIPHER

0x0025 O SSTCG TPM 2.0 libraryspecification

the object type for asymmetric block cipher

TPM_ALG_CAMELLIA

0x0026 S

A

ISO/IEC 18033-3

Camellia is symmetric blockcipher. The Camellia
algorithm with various key
sizes

Family “2.0"

TCG PUBLIC REVIEW

Page 9Level 00 Revision 01.34

Copyright © TCG 2023

April 13, 2023

Algorithm NameValue

TPM_ALG_SHA3_256

Type

Dep

C

Reference

Comments

0x0027 H

A

ISO/IEC 10118-3

Hash algorithm producing a
256-bit digest

TPM_ALG_SHA3_384

0x0028 H

A

ISO/IEC 10118-3

Hash algorithm producing a
384-bit digest

TPM_ALG_SHA3_512

0x0029 H

A

ISO/IEC 10118-3

Hash algorithm producing a
512-bit digest

TPM_ALG_SHAKE128

0x002A Z

AISO/IEC 10118-3

Extendable-output function
providing up to 128 bits ofcollision and preimage
resistance

TPM_ALG_SHAKE256

0x002B Z

AISO/IEC 10118-3

Extendable-output function
providing up to 256 bits ofcollision and preimage
resistance

TPM_ALG_SHAKE256_192

0x002C HANIST SP800-208

the first 192 bits of
SHAKE256 output

TPM_ALG_SHAKE256_256

0x002D H

ANIST SP800-208

the first 256 bits of
SHAKE256 output

TPM_ALG_SHAKE256_512

0x002E H

A

IETF RFC 8032

the first 512 bits of
SHAKE256 output

TPM_ALG_CMAC

0x003F S X

AISO/IEC 97971:2011

block Cipher-based Message
Authentication Code (CMAC)"Algorithm 5" in ISO/IEC
9797-1:2011

TPM_ALG_CTR

0x0040 S E

AISO/IEC 10116

Counter mode – if
implemented, all symmetricblock ciphers (S type)
implemented shall becapable of using this mode.

TPM_ALG_OFB

0x0041 S E

AISO/IEC 10116

Output Feedback mode – if
implemented, all symmetricblock ciphers (S type)
implemented shall becapable of using this mode.

TPM_ALG_CBC

0x0042 S E

AISO/IEC 10116

Cipher Block Chaining mode
– if implemented, allsymmetric block ciphers (Stype) implemented shall becapable of using this mode.

TPM_ALG_CFB

0x0043 S E

SISO/IEC 10116

Cipher Feedback mode – if
implemented, all symmetricblock ciphers (S type)
implemented shall becapable of using this mode.

TPM_ALG_ECB

0x0044 S E

AISO/IEC 10116

Electronic Codebook mode –if implemented, all symmetricblock ciphers (S type)
implemented shall becapable of using this mode.
NOTE 1 This mode is notrecommended for uses unlessthe key is frequently rotatedsuch as in video codecs

Page 10

TCG PUBLIC REVIEWFamily “2.0"April 13, 2023

Copyright © TCG 2023

Level 00 Revision 01.34

Algorithm NameValue

TPM_ALG_CCM

Type

Dep

C

Reference

Comments

0x0050 S X E

ANIST SP800-38C

Counter with Cipher Block
Chaining-Message
Authentication Code (CCM)

TPM_ALG_GCM

0x0051 S X E

ANIST SP800-38D

Galois/Counter Mode (GCM)

TPM_ALG_KW

0x0052 S X E AESANIST SP800-38F

AES Key Wrap (KW)

TPM_ALG_KWP

0x0053 S X E AESANIST SP800-38F

AES Key Wrap with Padding(KWP)

TPM_ALG_EAX

0x0054 S X E

AISO/IEC 19772

Authenticated-Encryption
Mode

TPM_ALG_EDDSA

0x0060 A X

AIETF RFC 8032

Edwards-curve Digital
Signature Algorithm(PureEdDSA)

ECCNOTE 2 EdDSA requires
Twisted Edwards curves

TPM_ALG_EDDSA_PH

0x0061 A X

ECCAIETF RFC 8032

Edwards-curve Digital
Signature Algorithm(HashEdDSA)NOTE 2 EdDSA requires
Twisted Edwards curves

TPM_ALG_LMS

0x0070 A X CANIST SP800-208

Leighton-Micali Signatures(LMS)

TPM_ALG_XMSS

0x0071 A X CANIST SP800-208

eXtended Merkle Signature
Scheme (XMSS) (single tree)

TPM_ALG_KEYEDXOF

0x0080A

TPM_ALG_KMACXOF128

0x0081 K Z

ANIST SP800-185

a keyed XOF providing 128bit security strength

TPM_ALG_KMACXOF256

0x0082 K Z

ANIST SP800-185

a keyed XOF providing 256bit security strength

TPM_ALG_KMAC128

0x0090 K X

ANIST SP800-185

a variable-length MAC
providing 128-bit security
strength

TPM_ALG_KMAC256

0x0091 K X

ANIST SP800-185

a variable-length MAC
providing 256-bit security
strengthreserved

0x00C1through
0x00C60x00C1 – 0x00C6 arereserved to prevent any
overlap with the command
structure tags used in TPM
1.2

reserved

0x8000through
0xFFFF

reserved for other structuretags

any keyed XOF

Family “2.0"

TCG PUBLIC REVIEW

Page 11

Level 00 Revision 01.34

Copyright © TCG 2023

April 13, 2023

5

ECC Values

5.1

Curve ID Values

Table 4 is the list of identifiers for TCG-registered curve ID values for elliptic curve cryptography.
Table 4 — Definition of (UINT16) TPM_ECC_CURVE Constants
Name

Value

Classification Comments

TPM_ECC_NONE

0x0000Assigned

TPM_ECC_NIST_P192

0x0001

Assigned

TPM_ECC_NIST_P224

0x0002

Assigned

TPM_ECC_NIST_P256

0x0003

TCG Standard

TPM_ECC_NIST_P384

0x0004

TCG Standard

TPM_ECC_NIST_P521

0x0005Assigned

TPM_ECC_BN_P256

0x0010TCG Standard

curve to support ECDAA

TPM_ECC_BN_P638

0x0011

Assigned

curve to support ECDAA

TPM_ECC_SM2_P256

0x0020Assigned

TPM_ECC_BP_P256_R1

0x0030Assigned

Brainpool

TPM_ECC_BP_P384_R1

0x0031

Assigned

Brainpool

TPM_ECC_BP_P512_R1

0x0032

Assigned

Brainpool

TPM_ECC_CURVE_25519

0x0040Assigned

curve to support EdDSA

TPM_ECC_CURVE_448

0x0041

Assigned

curve to support EdDSA#TPM_RC_CURVENOTE This row has meaning for other TCG specifications
that use automated processing and should be ignored for the
TCG Algorithm Registry.

Page 12

TCG PUBLIC REVIEWFamily “2.0"April 13, 2023

Copyright © TCG 2023

Level 00 Revision 01.34

5.2

Curve Parameters

5.2.1

Introduction

The tables in this section contain the curve parameter data associated with the curves listed inTable 4.
5.2.2

NIST P192
Table 5 — Defines for NIST_P192 ECC Values

Parameter Value

Description

curveID

TPM_ECC_NIST_P192

identifier for the
curve

keySize

192

size in bits of the
key

kdf

{TPM_ALG_KDF1_SP800_56A, TPM_ALG_SHA256}

the default KDF
and hashsign{TPM_ALG_NULL, TPM_ALG_NULL}

no mandatory
signing schemep{24, {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF ,0xFF, 0xFF}}

Fp (the modulus)a{24, {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFC}}

coefficient of thelinear term in the
curve equationb{24, {0x64, 0x21, 0x05, 0x19, 0xE5, 0x9C, 0x80, 0xE7, 0x0F,
0xA7, 0xE9, 0xAB, 0x72, 0x24, 0x30, 0x49, 0xFE, 0xB8, 0xDE,
0xEC, 0xC1, 0x46, 0xB9, 0xB1}}

constant term forcurve equationgX{24, {0x18, 0x8D, 0xA8, 0x0E, 0xB0, 0x30, 0x90, 0xF6, 0x7C,
0xBF, 0x20, 0xEB, 0x43, 0xA1, 0x88, 0x00, 0xF4, 0xFF, 0x0A,
0xFD, 0x82, 0xFF, 0x10, 0x12}}

x coordinate ofbase point G

gY{24, {0x07, 0x19, 0x2B, 0x95, 0xFF, 0xC8, 0xDA, 0x78, 0x63,
0x10, 0x11, 0xED, 0x6B, 0x24, 0xCD, 0xD5, 0x73, 0xF9, 0x77,
0xA1, 0x1E, 0x79, 0x48, 0x11}}

y coordinate ofbase point Gn{24, {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0x99, 0xDE, 0xF8, 0x36, 0x14, 0x6B, 0xC9,
0xB1, 0xB4, 0xD2, 0x28, 0x31}}

order of Gh{1,{1}}

cofactor (a size ofzero indicates a
cofactor of 1)

Family “2.0"

TCG PUBLIC REVIEW

Page 13

Level 00 Revision 01.34

Copyright © TCG 2023

April 13, 2023

5.2.3NIST P224
Table 6 — Defines for NIST_P224 ECC Values

Parameter Value

Description

curveID

TPM_ECC_NIST_P224

identifier for the
curve

keySize

224

Size in bits of the
key

kdf

{TPM_ALG_KDF1_SP800_56A, TPM_ALG_SHA256}

the default KDF
and hashsign{TPM_ALG_NULL, TPM_ALG_NULL}

no mandatory
signing schemep{28, {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }}Fp (the modulus)a{28, {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE }}coefficient of thelinear term in the
curve equationb{28, {0xB4, 0x05, 0x0A, 0x85, 0x0C, 0x04, 0xB3, 0xAB, 0xF5,
0x41, 0x32, 0x56, 0x50, 0x44, 0xB0, 0xB7, 0xD7, 0xBF, 0xD8,
0xBA, 0x27, 0x0B, 0x39, 0x43, 0x23, 0x55, 0xFF, 0xB4 }}constant term forcurve equationgX{28, {0xB7, 0x0E, 0x0C, 0xBD, 0x6B, 0xB4, 0xBF, 0x7F, 0x32,
0x13, 0x90, 0xB9, 0x4A, 0x03, 0xC1, 0xD3, 0x56, 0xC2, 0x11,
0x22, 0x34, 0x32, 0x80, 0xD6, 0x11, 0x5C, 0x1D, 0x21 }}x coordinate ofbase point G

gY{28, {0xBD, 0x37, 0x63, 0x88, 0xB5, 0xF7, 0x23, 0xFB, 0x4C,
0x22, 0xDF, 0xE6, 0xCD, 0x43, 0x75, 0xA0, 0x5A, 0x07, 0x47,
0x64, 0x44, 0xD5, 0x81, 0x99, 0x85, 0x00, 0x7E, 0x34 }}y coordinate ofbase point Gn{28, {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x16, 0xA2, 0xE0, 0xB8, 0xF0,
0x3E, 0x13, 0xDD, 0x29, 0x45, 0x5C, 0x5C, 0x2A, 0x3D }}order of Gh{1,{1}}

cofactor

Page 14

TCG PUBLIC REVIEWFamily “2.0"April 13, 2023

Copyright © TCG 2023

Level 00 Revision 01.34

5.2.4NIST P256
Table 7 — Defines for NIST_P256 ECC Values

Parameter Value

Description

curveID

TPM_ECC_NIST_P256

identifier for the
curve

keySize

256

Size in bits of the
key

kdf

{TPM_ALG_KDF1_SP800_56A, TPM_ALG_SHA256}

the default KDF
and hashsign{TPM_ALG_NULL, TPM_ALG_NULL}

no mandatory
signing schemep{32, {0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF }}Fp (the modulus)a{32, {0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x01, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFC }}coefficient of thelinear term in the
curve equationb{32, {0x5A, 0xC6, 0x35, 0xD8, 0xAA, 0x3A, 0x93, 0xE7, 0xB3,
0xEB, 0xBD, 0x55, 0x76, 0x98, 0x86, 0xBC, 0x65, 0x1D, 0x06,
0xB0, 0xCC, 0x53, 0xB0, 0xF6, 0x3B, 0xCE, 0x3C, 0x3E, 0x27,
0xD2, 0x60, 0x4B }}constant term forcurve equation

gX{32, {0x6B, 0x17, 0xD1, 0xF2, 0xE1, 0x2C, 0x42, 0x47, 0xF8,
0xBC, 0xE6, 0xE5, 0x63, 0xA4, 0x40, 0xF2, 0x77, 0x03, 0x7D,
0x81, 0x2D, 0xEB, 0x33, 0xA0, 0xF4, 0xA1, 0x39, 0x45, 0xD8,
0x98, 0xC2, 0x96 }}x coordinate ofbase point G

gY{32, {0x4F, 0xE3, 0x42, 0xE2, 0xFE, 0x1A, 0x7F, 0x9B, 0x8E,
0xE7, 0xEB, 0x4A, 0x7C, 0x0F, 0x9E, 0x16, 0x2B, 0xCE, 0x33,
0x57, 0x6B, 0x31, 0x5E, 0xCE, 0xCB, 0xB6, 0x40, 0x68, 0x37,
0xBF, 0x51, 0xF5 }}y coordinate ofbase point Gn{32, {0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xBC, 0xE6, 0xFA,
0xAD, 0xA7, 0x17, 0x9E, 0x84, 0xF3, 0xB9, 0xCA, 0xC2, 0xFC,
0x63, 0x25, 0x51 }}order of Gh{1,{1}}

cofactor

Family “2.0"

TCG PUBLIC REVIEW

Page 15

Level 00 Revision 01.34

Copyright © TCG 2023

April 13, 2023

5.2.5NIST P384
Table 8 — Defines for NIST_P384 ECC Values

Parameter Value

Description

curveID

TPM_ECC_NIST_P384

identifier for the
curve

keySize384

size in bits of the
key

kdf

{TPM_ALG_KDF1_SP800_56A, TPM_ALG_SHA384}

the default KDF
and hashsign{TPM_ALG_NULL, TPM_ALG_NULL}

no mandatory
signing schemep{48, {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF }}Fp (the modulus)a{48, {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFC }}coefficient of thelinear term in the
curve equationb{48, {0xB3, 0x31, 0x2F, 0xA7, 0xE2, 0x3E, 0xE7, 0xE4, 0x98,
0x8E, 0x05, 0x6B, 0xE3, 0xF8, 0x2D, 0x19, 0x18, 0x1D, 0x9C,
0x6E, 0xFE, 0x81, 0x41, 0x12, 0x03, 0x14, 0x08, 0x8F, 0x50,
0x13, 0x87, 0x5A, 0xC6, 0x56, 0x39, 0x8D, 0x8A, 0x2E, 0xD1,
0x9D, 0x2A, 0x85, 0xC8, 0xED, 0xD3, 0xEC, 0x2A, 0xEF }}constant term forcurve equationgX{48, {0xAA, 0x87, 0xCA, 0x22, 0xBE, 0x8B, 0x05, 0x37, 0x8E,
0xB1, 0xC7, 0x1E, 0xF3, 0x20, 0xAD, 0x74, 0x6E, 0x1D, 0x3B,
0x62, 0x8B, 0xA7, 0x9B, 0x98, 0x59, 0xF7, 0x41, 0xE0, 0x82,
0x54, 0x2A, 0x38, 0x55, 0x02, 0xF2, 0x5D, 0xBF, 0x55, 0x29,
0x6C, 0x3A, 0x54, 0x5E, 0x38, 0x72, 0x76, 0x0A, 0xB7 }}x coordinate ofbase point G

gY{48, {0x36, 0x17, 0xDE, 0x4A, 0x96, 0x26, 0x2C, 0x6F, 0x5D,
0x9E, 0x98, 0xBF, 0x92, 0x92, 0xDC, 0x29, 0xF8, 0xF4, 0x1D,
0xBD, 0x28, 0x9A, 0x14, 0x7C, 0xE9, 0xDA, 0x31, 0x13, 0xB5,
0xF0, 0xB8, 0xC0, 0x0A, 0x60, 0xB1, 0xCE, 0x1D, 0x7E, 0x81,
0x9D, 0x7A, 0x43, 0x1D, 0x7C, 0x90, 0xEA, 0x0E, 0x5F }}y coordinate ofbase point Gn{48, {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xC7, 0x63, 0x4D, 0x81, 0xF4,
0x37, 0x2D, 0xDF, 0x58, 0x1A, 0x0D, 0xB2, 0x48, 0xB0, 0xA7,
0x7A, 0xEC, 0xEC, 0x19, 0x6A, 0xCC, 0xC5, 0x29, 0x73 }}order of Gh{1,{1}}

cofactor

Page 16

TCG PUBLIC REVIEWFamily “2.0"April 13, 2023

Copyright © TCG 2023

Level 00 Revision 01.34

5.2.6NIST P521
Table 9 — Defines for NIST_P521 ECC Values

Parameter Value

Description

curveID

TPM_ECC_NIST_P521

identifier for the
curve

keySize

521

size in bits of the
key

kdf

{TPM_ALG_KDF1_SP800_56A, TPM_ALG_SHA512}

the default KDF
and hashsign{TPM_ALG_NULL, TPM_ALG_NULL}

no mandatory
signing schemep{66, {0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF }}Fp (the modulus)a{66, {0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC }}coefficient of thelinear term in the
curve equationb{66, {0x00, 0x51, 0x95, 0x3E, 0xB9, 0x61, 0x8E, 0x1C, 0x9A,
0x1F, 0x92, 0x9A, 0x21, 0xA0, 0xB6, 0x85, 0x40, 0xEE, 0xA2,
0xDA, 0x72, 0x5B, 0x99, 0xB3, 0x15, 0xF3, 0xB8, 0xB4, 0x89,
0x91, 0x8E, 0xF1, 0x09, 0xE1, 0x56, 0x19, 0x39, 0x51, 0xEC,
0x7E, 0x93, 0x7B, 0x16, 0x52, 0xC0, 0xBD, 0x3B, 0xB1, 0xBF,
0x07, 0x35, 0x73, 0xDF, 0x88, 0x3D, 0x2C, 0x34, 0xF1, 0xEF,
0x45, 0x1F, 0xD4, 0x6B, 0x50, 0x3F, 0x00 }}constant term forcurve equationgX{66, {0x00, 0xC6, 0x85, 0x8E, 0x06, 0xB7, 0x04, 0x04, 0xE9,
0xCD, 0x9E, 0x3E, 0xCB, 0x66, 0x23, 0x95, 0xB4, 0x42, 0x9C,
0x64, 0x81, 0x39, 0x05, 0x3F, 0xB5, 0x21, 0xF8, 0x28, 0xAF,
0x60, 0x6B, 0x4D, 0x3D, 0xBA, 0xA1, 0x4B, 0x5E, 0x77, 0xEF,
0xE7, 0x59, 0x28, 0xFE, 0x1D, 0xC1, 0x27, 0xA2, 0xFF, 0xA8,
0xDE, 0x33, 0x48, 0xB3, 0xC1, 0x85, 0x6A, 0x42, 0x9B, 0xF9,
0x7E, 0x7E, 0x31, 0xC2, 0xE5, 0xBD, 0x66 }}x coordinate ofbase point G

gY{66, {0x01, 0x18, 0x39, 0x29, 0x6A, 0x78, 0x9A, 0x3B, 0xC0,
0x04, 0x5C, 0x8A, 0x5F, 0xB4, 0x2C, 0x7D, 0x1B, 0xD9, 0x98,
0xF5, 0x44, 0x49, 0x57, 0x9B, 0x44, 0x68, 0x17, 0xAF, 0xBD,
0x17, 0x27, 0x3E, 0x66, 0x2C, 0x97, 0xEE, 0x72, 0x99, 0x5E,
0xF4, 0x26, 0x40, 0xC5, 0x50, 0xB9, 0x01, 0x3F, 0xAD, 0x07,
0x61, 0x35, 0x3C, 0x70, 0x86, 0xA2, 0x72, 0xC2, 0x40, 0x88,
0xBE, 0x94, 0x76, 0x9F, 0xD1, 0x66, 0x50 }}y coordinate ofbase point Gn{66, {0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFA, 0x51, 0x86, 0x87, 0x83, 0xBF,
0x2F, 0x96, 0x6B, 0x7F, 0xCC, 0x01, 0x48, 0xF7, 0x09, 0xA5,
0xD0, 0x3B, 0xB5, 0xC9, 0xB8, 0x89, 0x9C, 0x47, 0xAE, 0xBB,
0x6F, 0xB7, 0x1E, 0x91, 0x38, 0x64, 0x09 }}order of Gh{1,{1}}

cofactor

Family “2.0"

TCG PUBLIC REVIEW

Page 17

Level 00 Revision 01.34

Copyright © TCG 2023

April 13, 2023

5.2.7

BN P256
Table 10 — Defines for BN_P256 ECC Values

Parameter Value

Description

curveID

TPM_ECC_BN_P256

identifier for the
curve

keySize

256

size in bits of the
key

kdf

{TPM_ALG_NULL, TPM_ALG_NULL}

the default KDF
and hashsign{TPM_ALG_NULL, TPM_ALG_NULL}

no mandatory
signing schemep{32, {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC, 0xF0, 0xCD, 0x46,
0xE5, 0xF2, 0x5E, 0xEE, 0x71, 0xA4, 0x9F, 0x0C, 0xDC, 0x65,
0xFB, 0x12, 0x98, 0x0A, 0x82, 0xD3, 0x29, 0x2D, 0xDB, 0xAE,
0xD3, 0x30, 0x13 }}Fp (the modulus)a{1,{0}}

coefficient of thelinear term in the
curve equationb{1,{3}}

constant term forcurve equationgX{1,{1}}

x coordinate ofbase point G

gY{1,{2}};

y coordinate ofbase point Gn{32, {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC, 0xF0, 0xCD, 0x46,
0xE5, 0xF2, 0x5E, 0xEE, 0x71, 0xA4, 0x9E, 0x0C, 0xDC, 0x65,
0xFB, 0x12, 0x99, 0x92, 0x1A, 0xF6, 0x2D, 0x53, 0x6C, 0xD1,
0x0B, 0x50, 0x0D }}order of Gh{1,{1}}

cofactor

Page 18

TCG PUBLIC REVIEWFamily “2.0"April 13, 2023

Copyright © TCG 2023

Level 00 Revision 01.34

5.2.8

BN P638
Table 11 — Defines for BN_P638 ECC Values

Parameter Value

Description

curveID

TPM_ECC_BN_P638

identifier for the
curve

keySize

638

size in bits of the
key

kdf

{TPM_ALG_NULL, TPM_ALG_NULL}

the default KDF
and hashsign{TPM_ALG_NULL, TPM_ALG_NULL}

no mandatory
signing schemep{80, {0x23, 0xFF, 0xFF, 0xFD, 0xC0, 0x00, 0x00, 0x0D, 0x7F,
0xFF, 0xFF, 0xB8, 0x00, 0x00, 0x01, 0xD3, 0xFF, 0xFF, 0xF9,
0x42, 0xD0, 0x00, 0x16, 0x5E, 0x3F, 0xFF, 0x94, 0x87, 0x00,
0x00, 0xD5, 0x2F, 0xFF, 0xFD, 0xD0, 0xE0, 0x00, 0x08, 0xDE,
0x55, 0xC0, 0x00, 0x86, 0x52, 0x00, 0x21, 0xE5, 0x5B, 0xFF,
0xFF, 0xF5, 0x1F, 0xFF, 0xF4, 0xEB, 0x80, 0x00, 0x00, 0x00,
0x4C, 0x80, 0x01, 0x5A, 0xCD, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xEC, 0xE0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x67 }}Fp (the modulus)a{1,{0}}

coefficient of thelinear term in the
curve equationb{2,{0x01, 0x01}}

constant term forcurve equationgX{80, {0x23, 0xFF, 0xFF, 0xFD, 0xC0, 0x00, 0x00, 0x0D, 0x7F,
0xFF, 0xFF, 0xB8, 0x00, 0x00, 0x01, 0xD3, 0xFF, 0xFF, 0xF9,
0x42, 0xD0, 0x00, 0x16, 0x5E, 0x3F, 0xFF, 0x94, 0x87, 0x00,
0x00, 0xD5, 0x2F, 0xFF, 0xFD, 0xD0, 0xE0, 0x00, 0x08, 0xDE,
0x55, 0xC0, 0x00, 0x86, 0x52, 0x00, 0x21, 0xE5, 0x5B, 0xFF,
0xFF, 0xF5, 0x1F, 0xFF, 0xF4, 0xEB, 0x80, 0x00, 0x00, 0x00,
0x4C, 0x80, 0x01, 0x5A, 0xCD, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xEC, 0xE0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x66 }}

x coordinate ofbase point G

gY{1,{0x10}}

y coordinate ofbase point Gn{80, {0x23, 0xFF, 0xFF, 0xFD, 0xC0, 0x00, 0x00, 0x0D, 0x7F,
0xFF, 0xFF, 0xB8, 0x00, 0x00, 0x01, 0xD3, 0xFF, 0xFF, 0xF9,
0x42, 0xD0, 0x00, 0x16, 0x5E, 0x3F, 0xFF, 0x94, 0x87, 0x00,
0x00, 0xD5, 0x2F, 0xFF, 0xFD, 0xD0, 0xE0, 0x00, 0x08, 0xDE,
0x55, 0x60, 0x00, 0x86, 0x55, 0x00, 0x21, 0xE5, 0x55, 0xFF,
0xFF, 0xF5, 0x4F, 0xFF, 0xF4, 0xEA, 0xC0, 0x00, 0x00, 0x00,
0x49, 0x80, 0x01, 0x54, 0xD9, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xED, 0xA0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x61 }}

order of Gh{1,{1}}

cofactor

Family “2.0"

TCG PUBLIC REVIEW

Page 19

Level 00 Revision 01.34

Copyright © TCG 2023

April 13, 2023

5.2.9

SM2_P256
Table 12 — Defines for SM2_P256 ECC Values

Parameter Value

Description

curveID

TPM_ECC_SM2_P256

identifier for the
curve

keySize

256

size in bits of the
key

kdf

{TPM_ALG_KDF1_SP800_56A, TPM_ALG_SM3_256}

the default KDF
and hashsign{TPM_ALG_NULL, TPM_ALG_NULL}

no mandatory
signing schemep{32, {0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF }}Fp (the modulus)a{32, {0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFC }}coefficient of thelinear term in the
curve equationb{32, {0x28, 0xE9, 0xFA, 0x9E, 0x9D, 0x9F, 0x5E, 0x34, 0x4D,
0x5A, 0x9E, 0x4B, 0xCF, 0x65, 0x09, 0xA7, 0xF3, 0x97, 0x89,
0xF5, 0x15, 0xAB, 0x8F, 0x92, 0xDD, 0xBC, 0xBD, 0x41, 0x4D,
0x94, 0x0E, 0x93 }}constant term forcurve equation

gX{32, {0x32, 0xC4, 0xAE, 0x2C, 0x1F, 0x19, 0x81, 0x19, 0x5F,
0x99, 0x04, 0x46, 0x6A, 0x39, 0xC9, 0x94, 0x8F, 0xE3, 0x0B,
0xBF, 0xF2, 0x66, 0x0B, 0xE1, 0x71, 0x5A, 0x45, 0x89, 0x33,
0x4C, 0x74, 0xC7 }}x coordinate ofbase point G

gY{32, {0xBC, 0x37, 0x36, 0xA2, 0xF4, 0xF6, 0x77, 0x9C, 0x59,
0xBD, 0xCE, 0xE3, 0x6B, 0x69, 0x21, 0x53, 0xD0, 0xA9, 0x87,
0x7C, 0xC6, 0x2A, 0x47, 0x40, 0x02, 0xDF, 0x32, 0xE5, 0x21,
0x39, 0xF0, 0xA0 }}y coordinate ofbase point Gn{32, {0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x72, 0x03, 0xDF,
0x6B, 0x21, 0xC6, 0x05, 0x2B, 0x53, 0xBB, 0xF4, 0x09, 0x39,
0xD5, 0x41, 0x23 }}order of Gh{1,{1}}

cofactor

Page 20

TCG PUBLIC REVIEWFamily “2.0"April 13, 2023

Copyright © TCG 2023

Level 00 Revision 01.34

5.2.10 BP_P256_R1
Table 13 — Defines for BP_P256_R1 ECC Values
Parameter Value

Description

curveID

TPM_ECC_BP_P256_R1

identifier for the
curve

keySize

256

size in bits of the
key

kdf

{TPM_ALG_KDF1_SP800_56A, TPM_ALG_SHA256}

the default KDF
and hashsign{TPM_ALG_NULL, TPM_ALG_NULL}

no mandatory
signing schemep{32, {0xA9, 0xFB, 0x57, 0xDB, 0xA1, 0xEE, 0xA9, 0xBC, 0x3E,
0x66, 0x0A, 0x90, 0x9D, 0x83, 0x8D, 0x72, 0x6E, 0x3B, 0xF6,
0x23, 0xD5, 0x26, 0x20, 0x28, 0x20, 0x13, 0x48, 0x1D, 0x1F,
0x6E, 0x53, 0x77 }}Fp (the modulus)a{32, {0x7D, 0x5A, 0x09, 0x75, 0xFC, 0x2C, 0x30, 0x57, 0xEE,
0xF6, 0x75, 0x30, 0x41, 0x7A, 0xFF, 0xE7, 0xFB, 0x80, 0x55,
0xC1, 0x26, 0xDC, 0x5C, 0x6C, 0xE9, 0x4A, 0x4B, 0x44, 0xF3,
0x30, 0xB5, 0xD9 }}coefficient of thelinear term in the
curve equationb{32, {0x26, 0xDC, 0x5C, 0x6C, 0xE9, 0x4A, 0x4B, 0x44, 0xF3,
0x30, 0xB5, 0xD9, 0xBB, 0xD7, 0x7C, 0xBF, 0x95, 0x84, 0x16,
0x29, 0x5C, 0xF7, 0xE1, 0xCE, 0x6B, 0xCC, 0xDC, 0x18, 0xFF,
0x8C, 0x07, 0xB6 }}constant term forcurve equation

gX{32, {0x8B, 0xD2, 0xAE, 0xB9, 0xCB, 0x7E, 0x57, 0xCB, 0x2C,
0x4B, 0x48, 0x2F, 0xFC, 0x81, 0xB7, 0xAF, 0xB9, 0xDE, 0x27,
0xE1, 0xE3, 0xBD, 0x23, 0xC2, 0x3A, 0x44, 0x53, 0xBD, 0x9A,
0xCE, 0x32, 0x62 }}x coordinate ofbase point G

gY{32, {0x54, 0x7E, 0xF8, 0x35, 0xC3, 0xDA, 0xC4, 0xFD, 0x97,
0xF8, 0x46, 0x1A, 0x14, 0x61, 0x1D, 0xC9, 0xC2, 0x77, 0x45,
0x13, 0x2D, 0xED, 0x8E, 0x54, 0x5C, 0x1D, 0x54, 0xC7, 0x2F,
0x04, 0x69, 0x97 }}y coordinate ofbase point Gn{32, {0xA9, 0xFB, 0x57, 0xDB, 0xA1, 0xEE, 0xA9, 0xBC, 0x3E,
0x66, 0x0A, 0x90, 0x9D, 0x83, 0x8D, 0x71, 0x8C, 0x39, 0x7A,
0xA3, 0xB5, 0x61, 0xA6, 0xF7, 0x90, 0x1E, 0x0E, 0x82, 0x97,
0x48, 0x56, 0xA7 }}order of Gh{1,{1}}

cofactor

Family “2.0"

TCG PUBLIC REVIEW

Page 21

Level 00 Revision 01.34

Copyright © TCG 2023

April 13, 2023

5.2.11 BP_P384_R1
Table 14 — Defines for BP_P384_R1 ECC Values
Parameter Value

Description

curveID

TPM_ECC_BP_P384_R1

identifier for the
curve

keySize384

size in bits of the
key

kdf

{TPM_ALG_KDF1_SP800_56A, TPM_ALG_SHA384}

the default KDF
and hashsign{TPM_ALG_NULL, TPM_ALG_NULL}

no mandatory
signing schemep{48, {0x8C, 0xB9, 0x1E, 0x82, 0xA3, 0x38, 0x6D, 0x28, 0x0F,
0x5D, 0x6F, 0x7E, 0x50, 0xE6, 0x41, 0xDF, 0x15, 0x2F, 0x71,
0x09, 0xED, 0x54, 0x56, 0xB4, 0x12, 0xB1, 0xDA, 0x19, 0x7F,
0xB7, 0x11, 0x23, 0xAC, 0xD3, 0xA7, 0x29, 0x90, 0x1D, 0x1A,
0x71, 0x87, 0x47, 0x00, 0x13, 0x31, 0x07, 0xEC, 0x53 }}Fp (the modulus)a{48, {0x7B, 0xC3, 0x82, 0xC6, 0x3D, 0x8C, 0x15, 0x0C, 0x3C,
0x72, 0x08, 0x0A, 0xCE, 0x05, 0xAF, 0xA0, 0xC2, 0xBE, 0xA2,
0x8E, 0x4F, 0xB2, 0x27, 0x87, 0x13, 0x91, 0x65, 0xEF, 0xBA,
0x91, 0xF9, 0x0F, 0x8A, 0xA5, 0x81, 0x4A, 0x50, 0x3A, 0xD4,
0xEB, 0x04, 0xA8, 0xC7, 0xDD, 0x22, 0xCE, 0x28, 0x26 }}coefficient of thelinear term in the
curve equationb{48, {0x04, 0xA8, 0xC7, 0xDD, 0x22, 0xCE, 0x28, 0x26, 0x8B,
0x39, 0xB5, 0x54, 0x16, 0xF0, 0x44, 0x7C, 0x2F, 0xB7, 0x7D,
0xE1, 0x07, 0xDC, 0xD2, 0xA6, 0x2E, 0x88, 0x0E, 0xA5, 0x3E,
0xEB, 0x62, 0xD5, 0x7C, 0xB4, 0x39, 0x02, 0x95, 0xDB, 0xC9,
0x94, 0x3A, 0xB7, 0x86, 0x96, 0xFA, 0x50, 0x4C, 0x11 }}constant term forcurve equationgX{48, {0x1D, 0x1C, 0x64, 0xF0, 0x68, 0xCF, 0x45, 0xFF, 0xA2,
0xA6, 0x3A, 0x81, 0xB7, 0xC1, 0x3F, 0x6B, 0x88, 0x47, 0xA3,
0xE7, 0x7E, 0xF1, 0x4F, 0xE3, 0xDB, 0x7F, 0xCA, 0xFE, 0x0C,
0xBD, 0x10, 0xE8, 0xE8, 0x26, 0xE0, 0x34, 0x36, 0xD6, 0x46,
0xAA, 0xEF, 0x87, 0xB2, 0xE2, 0x47, 0xD4, 0xAF, 0x1E }}x coordinate ofbase point G

gY{48, {0x8A, 0xBE, 0x1D, 0x75, 0x20, 0xF9, 0xC2, 0xA4, 0x5C,
0xB1, 0xEB, 0x8E, 0x95, 0xCF, 0xD5, 0x52, 0x62, 0xB7, 0x0B,
0x29, 0xFE, 0xEC, 0x58, 0x64, 0xE1, 0x9C, 0x05, 0x4F, 0xF9,
0x91, 0x29, 0x28, 0x0E, 0x46, 0x46, 0x21, 0x77, 0x91, 0x81,
0x11, 0x42, 0x82, 0x03, 0x41, 0x26, 0x3C, 0x53, 0x15 }}y coordinate ofbase point Gn{48, {0x8C, 0xB9, 0x1E, 0x82, 0xA3, 0x38, 0x6D, 0x28, 0x0F,
0x5D, 0x6F, 0x7E, 0x50, 0xE6, 0x41, 0xDF, 0x15, 0x2F, 0x71,
0x09, 0xED, 0x54, 0x56, 0xB3, 0x1F, 0x16, 0x6E, 0x6C, 0xAC,
0x04, 0x25, 0xA7, 0xCF, 0x3A, 0xB6, 0xAF, 0x6B, 0x7F, 0xC3,
0x10, 0x3B, 0x88, 0x32, 0x02, 0xE9, 0x04, 0x65, 0x65 }}order of Gh{1,{1}}

cofactor

Page 22

TCG PUBLIC REVIEWFamily “2.0"April 13, 2023

Copyright © TCG 2023

Level 00 Revision 01.34

5.2.12 BP_P512_R1
Table 15 — Defines for BP_P512_R1 ECC Values
Parameter Value

Description

curveID

TPM_ECC_BP_P512_R1

identifier for the
curve

keySize

512

size in bits of the
key

kdf

{TPM_ALG_KDF1_SP800_56A, TPM_ALG_SHA512}

the default KDF
and hashsign{TPM_ALG_NULL, TPM_ALG_NULL}

no mandatory
signing schemep{64, {0xAA, 0xDD, 0x9D, 0xB8, 0xDB, 0xE9, 0xC4, 0x8B, 0x3F,
0xD4, 0xE6, 0xAE, 0x33, 0xC9, 0xFC, 0x07, 0xCB, 0x30, 0x8D,
0xB3, 0xB3, 0xC9, 0xD2, 0x0E, 0xD6, 0x63, 0x9C, 0xCA, 0x70,
0x33, 0x08, 0x71, 0x7D, 0x4D, 0x9B, 0x00, 0x9B, 0xC6, 0x68,
0x42, 0xAE, 0xCD, 0xA1, 0x2A, 0xE6, 0xA3, 0x80, 0xE6, 0x28,
0x81, 0xFF, 0x2F, 0x2D, 0x82, 0xC6, 0x85, 0x28, 0xAA, 0x60,
0x56, 0x58, 0x3A, 0x48, 0xF3 }}Fp (the modulus)a{64, {0x78, 0x30, 0xA3, 0x31, 0x8B, 0x60, 0x3B, 0x89, 0xE2,
0x32, 0x71, 0x45, 0xAC, 0x23, 0x4C, 0xC5, 0x94, 0xCB, 0xDD,
0x8D, 0x3D, 0xF9, 0x16, 0x10, 0xA8, 0x34, 0x41, 0xCA, 0xEA,
0x98, 0x63, 0xBC, 0x2D, 0xED, 0x5D, 0x5A, 0xA8, 0x25, 0x3A,
0xA1, 0x0A, 0x2E, 0xF1, 0xC9, 0x8B, 0x9A, 0xC8, 0xB5, 0x7F,
0x11, 0x17, 0xA7, 0x2B, 0xF2, 0xC7, 0xB9, 0xE7, 0xC1, 0xAC,
0x4D, 0x77, 0xFC, 0x94, 0xCA }}coefficient of thelinear term in the
curve equationb{64, {0x3D, 0xF9, 0x16, 0x10, 0xA8, 0x34, 0x41, 0xCA, 0xEA,
0x98, 0x63, 0xBC, 0x2D, 0xED, 0x5D, 0x5A, 0xA8, 0x25, 0x3A,
0xA1, 0x0A, 0x2E, 0xF1, 0xC9, 0x8B, 0x9A, 0xC8, 0xB5, 0x7F,
0x11, 0x17, 0xA7, 0x2B, 0xF2, 0xC7, 0xB9, 0xE7, 0xC1, 0xAC,
0x4D, 0x77, 0xFC, 0x94, 0xCA, 0xDC, 0x08, 0x3E, 0x67, 0x98,
0x40, 0x50, 0xB7, 0x5E, 0xBA, 0xE5, 0xDD, 0x28, 0x09, 0xBD,
0x63, 0x80, 0x16, 0xF7, 0x23 }}constant term forcurve equationgX{64, {0x81, 0xAE, 0xE4, 0xBD, 0xD8, 0x2E, 0xD9, 0x64, 0x5A,
0x21, 0x32, 0x2E, 0x9C, 0x4C, 0x6A, 0x93, 0x85, 0xED, 0x9F,
0x70, 0xB5, 0xD9, 0x16, 0xC1, 0xB4, 0x3B, 0x62, 0xEE, 0xF4,
0xD0, 0x09, 0x8E, 0xFF, 0x3B, 0x1F, 0x78, 0xE2, 0xD0, 0xD4,
0x8D, 0x50, 0xD1, 0x68, 0x7B, 0x93, 0xB9, 0x7D, 0x5F, 0x7C,
0x6D, 0x50, 0x47, 0x40, 0x6A, 0x5E, 0x68, 0x8B, 0x35, 0x22,
0x09, 0xBC, 0xB9, 0xF8, 0x22 }}x coordinate ofbase point G

gY{64, {0x7D, 0xDE, 0x38, 0x5D, 0x56, 0x63, 0x32, 0xEC, 0xC0,
0xEA, 0xBF, 0xA9, 0xCF, 0x78, 0x22, 0xFD, 0xF2, 0x09, 0xF7,
0x00, 0x24, 0xA5, 0x7B, 0x1A, 0xA0, 0x00, 0xC5, 0x5B, 0x88,
0x1F, 0x81, 0x11, 0xB2, 0xDC, 0xDE, 0x49, 0x4A, 0x5F, 0x48,
0x5E, 0x5B, 0xCA, 0x4B, 0xD8, 0x8A, 0x27, 0x63, 0xAE, 0xD1,
0xCA, 0x2B, 0x2F, 0xA8, 0xF0, 0x54, 0x06, 0x78, 0xCD, 0x1E,
0x0F, 0x3A, 0xD8, 0x08, 0x92 }}y coordinate ofbase point Gn{64, {0xAA, 0xDD, 0x9D, 0xB8, 0xDB, 0xE9, 0xC4, 0x8B, 0x3F,
0xD4, 0xE6, 0xAE, 0x33, 0xC9, 0xFC, 0x07, 0xCB, 0x30, 0x8D,
0xB3, 0xB3, 0xC9, 0xD2, 0x0E, 0xD6, 0x63, 0x9C, 0xCA, 0x70,
0x33, 0x08, 0x70, 0x55, 0x3E, 0x5C, 0x41, 0x4C, 0xA9, 0x26,
0x19, 0x41, 0x86, 0x61, 0x19, 0x7F, 0xAC, 0x10, 0x47, 0x1D,
0xB1, 0xD3, 0x81, 0x08, 0x5D, 0xDA, 0xDD, 0xB5, 0x87, 0x96,
0x82, 0x9C, 0xA9, 0x00, 0x69 }}order of Gh{1,{1}}

cofactor

Family “2.0"

TCG PUBLIC REVIEW

Page 23

Level 00 Revision 01.34

Copyright © TCG 2023

April 13, 2023

5.2.13 CURVE_25519
The curve parameters are defined in Montgomery form. This curve can be transformed into Twisted
Edwards form.
Table 16 — Defines for CURVE_25519 ECC Values
Parameter Value

Description

curveID

TPM_ECC_CURVE_25519

identifier for the
curve

keySize

256

Size in bits of the
key

kdf

{TPM_ALG_KDF1_SP800_56A, TPM_ALG_SHA256}

the default KDF
and hashsign{TPM_ALG_NULL, TPM_ALG_NULL}

no mandatory
signing schemep{32, {0x7F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xED }}Fp (the modulus)a{3,{0x07, 0x6D, 0x06}}

coefficient of thelinear term in the
curve equationb{1,{0x01}}

constant term forcurve equationgX{1,{0x09}}

x coordinate ofbase point G

gY{32, {0x5F, 0x51, 0xE6, 0x5E, 0x47, 0x5F, 0x79, 0x4B, 0x1F,
0xE1, 0x22, 0xD3, 0x88, 0xB7, 0x2E, 0xB3, 0x6D, 0xC2, 0xB2,
0x81, 0x92, 0x83, 0x9E, 0x4D, 0xD6, 0x16, 0x3A, 0x5D, 0x81,
0x31, 0x2C, 0x14 }}y coordinate ofbase point Gn{32, {0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0xDE, 0xF9,
0xDE, 0xA2, 0xF7, 0x9C, 0xD6, 0x58, 0x12, 0x63, 0x1A, 0x5C,
0xF5, 0xD3, 0xED }}order of Gh{1,{8}}

cofactor

Page 24

TCG PUBLIC REVIEWFamily “2.0"April 13, 2023

Copyright © TCG 2023

Level 00 Revision 01.34

5.2.14 CURVE_448
The curve parameters are defined in Montgomery form. This curve can be transformed into Twisted
Edwards form.

Table 17 — Defines for CURVE_448 ECC Values
Parameter Value

Description

curveID

TPM_ECC_CURVE_448

identifier for the
curve

keySize

448

Size in bits of the
key

kdf

{TPM_ALG_KDF1_SP800_56A, TPM_ALG_SHA256}

the default KDF
and hashsign{TPM_ALG_NULL, TPM_ALG_NULL}

no mandatory
signing schemep{56, {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF }}Fp (the modulus)a{3,{0x02, 0x62, 0xA6}}

coefficient of thelinear term in the
curve equationb{1,{0x01}}

constant term forcurve equationgX{1,{0x05}}

x coordinate ofbase point G

gY{56, {0x7D, 0x23, 0x5D, 0x12, 0x95, 0xF5, 0xB1, 0xF6, 0x6C,
0x98, 0xAB, 0x6E, 0x58, 0x32, 0x6F, 0xCE, 0xCB, 0xAE, 0x5D,
0x34, 0xF5, 0x55, 0x45, 0xD0, 0x60, 0xF7, 0x5D, 0xC2, 0x8D,
0xF3, 0xF6, 0xED, 0xB8, 0x02, 0x7E, 0x23, 0x46, 0x43, 0x0D,
0x21, 0x13, 0x12, 0xC4, 0xB1, 0x50, 0x67, 0x7A, 0xF7, 0x6F,
0xD7, 0x22, 0x3D, 0x45, 0x7B, 0x5B, 0x1A }}y coordinate ofbase point Gn{56, {0x3F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x7C,
0xCA, 0x23, 0xE9, 0xC4, 0x4E, 0xDB, 0x49, 0xAE, 0xD6, 0x36,
0x90, 0x21, 0x6C, 0xC2, 0x72, 0x8D, 0xC5, 0x8F, 0x55, 0x23,
0x78, 0xC2, 0x92, 0xAB, 0x58, 0x44, 0xF3 }}order of Gh{1,{4}}

cofactor

Family “2.0"

TCG PUBLIC REVIEW

Page 25

Level 00 Revision 01.34

Copyright © TCG 2023

April 13, 2023

6

Hash Parameters

6.1

Introduction

The tables in this clause define the basic parameters associated with the TCG-registered hashalgorithms listed in Table 3.
6.2

SHA1
Table 18 — Defines for SHA1 Hash Values

Name

Value

Description

SHA1_DIGEST_SIZE

20size of digest in octets

SHA1_BLOCK_SIZE

64size of hash block in octets

SHA1_DER_SIZE

15size of the DER in octets

SHA1_DER

0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
0x2B, 0x0E, 0x03, 0x02, 0x1A, 0x05,
0x00, 0x04, 0x14

the DER

6.3

SHA256
Table 19 — Defines for SHA256 Hash Values

Name

Value

Description

SHA256_DIGEST_SIZE

32

size of digest

SHA256_BLOCK_SIZE

64size of hash block

SHA256_DER_SIZE

19size of the DER in octets

SHA256_DER

0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20

the DER

6.4

SHA384
Table 20 — Defines for SHA384 Hash Values

Name

Value

Description

SHA384_DIGEST_SIZE

48

size of digest in octets

SHA384_BLOCK_SIZE

128

size of hash block in octets

SHA384_DER_SIZE

19size of the DER in octets

SHA384_DER

0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
0x04, 0x02, 0x02, 0x05, 0x00, 0x04, 0x30

the DER

Page 26

TCG PUBLIC REVIEWFamily “2.0"April 13, 2023

Copyright © TCG 2023

Level 00 Revision 01.34

6.5

SHA512
Table 21 — Defines for SHA512 Hash Values

Name

Value

Description

SHA512_DIGEST_SIZE

64size of digest in octets

SHA512_BLOCK_SIZE

128

size of hash block in octets

SHA512_DER_SIZE

19size of the DER in octets

SHA512_DER

0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
0x04, 0x02, 0x03, 0x05, 0x00, 0x04, 0x40

the DER

6.6

SM3_256
Table 22 — Defines for SM3_256 Hash Values

Name

Value

Description

SM3_256_DIGEST_SIZE

32

size of digest in octets

SM3_256_BLOCK_SIZE

64size of hash block in octets

SM3_256_DER_SIZE

18size of the DER in octets

SM3_256_DER

0x30, 0x30, 0x30, 0x0c, 0x06, 0x08,
0x2A, 0x81, 0x1C, 0x81, 0x45, 0x01,
0x83, 0x11, 0x05, 0x00, 0x04, 0x20

the DER

6.7

SHA3_256
Table 23— Defines for SHA3_256 Hash Values

Name

Value

Description

SHA3_256_DIGEST_SIZE

32

size of digest in octets

SHA3_256_BLOCK_SIZE

136

size of hash block in octets

SHA3_256_DER_SIZE

19size of the DER in octets

SHA3_256_DER

0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
0x04, 0x02, 0x08, 0x05, 0x00, 0x04, 0x20

the DER

6.8

SHA3_384
Table 24 — Defines for SHA3_384 Hash Values

Name

Value

Description

SHA3_384_DIGEST_SIZE

48

size of digest in octets

SHA3_384_BLOCK_SIZE

104

size of hash block in octets

SHA3_384_DER_SIZE

19size of the DER in octets

SHA3_384_DER

0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
0x04, 0x02, 0x09, 0x05, 0x00, 0x04, 0x30

the DER

Family “2.0"

TCG PUBLIC REVIEW

Page 27

Level 00 Revision 01.34

Copyright © TCG 2023

April 13, 2023

6.9

SHA3_512
Table 25 — Defines for SHA3_512 Hash Values

Name

Value

Description

SHA3_512_DIGEST_SIZE

64size of digest in octets

SHA3_512_BLOCK_SIZE

72

size of hash block in octets

SHA3_512_DER_SIZE

19size of the DER in octets

SHA3_512_DER

0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
0x04, 0x02, 0x0a, 0x05, 0x00, 0x04, 0x40

the DER

6.10 Hash Algorithms Bit Field
This table defines a bit field to concisely convey a set of hash algorithms. An example of where
this could be useful is a parameter returning the set of hash algorithms an interface supports.
Table 26 — Definition of (UINT32) TPMA_HASH_ALGS Bits
Bit

Name

Action0

hashAlgSHA1

SET (1): indicates the SHA1 hash algorithm
CLEAR (0): does not indicate SHA1

1

hashAlgSHA256

SET (1): indicates the SHA256 hash algorithm
CLEAR (0): does not indicate SHA256

2

hashAlgSHA384

SET (1): indicates the SHA384 hash algorithm
CLEAR (0): does not indicate SHA384

3

hashAlgSHA512

SET (1): indicates the SHA512 hash algorithm
CLEAR (0): does not indicate SHA512

4

hashAlgSM3_256

SET (1): indicates the SM3_256 hash algorithm
CLEAR (0): does not indicate SM3_256

5hashAlgSHA3_256

SET (1): indicates the SHA3_256 hash algorithm
CLEAR (0): does not indicate SHA3_256

6

hashAlgSHA3_384

SET (1): indicates the SHA3_384 hash algorithm
CLEAR (0): does not indicate SHA3_384

7hashAlgSHA3_512

SET (1): indicates the SHA3_512 hash algorithm
CLEAR (0): does not indicate SHA3_512

31:8

Reserved

Shall be zero

Page 28

TCG PUBLIC REVIEWFamily “2.0"April 13, 2023

Copyright © TCG 2023

Level 00 Revision 01.34

7

Symmetric Block Cipher Parameters

7.1

Introduction

The tables in this section define the parameters for each of the TCG-registered block ciphers listed
in Table 3.
7.2

AES
Table 27 — Defines for AES Symmetric Cipher Algorithm Constants

Name

Value

AES_KEY_SIZES_BITS{128, 192, 256}

AES_BLOCK_SIZES_BITS{128, 128, 128}

AES_ROUNDS{10, 12, 14}

7.3

Comments

SM4
Table 28 — Defines for SM4 Symmetric Cipher Algorithm Constants

Name

Value

SM4_KEY_SIZES_BITS{128}

SM4_BLOCK_SIZES_BITS{128}

SM4_ROUNDS

{32}

7.4

Comments

Camellia
Table 29 — Defines for CAMELLIA Symmetric Cipher Algorithm Constants

Name

Value

CAMELLIA_KEY_SIZES_BITS{128, 192, 256}CAMELLIA_BLOCK_SIZES_BITS{128, 128, 128}CAMELLIA_ROUNDS{18, 24, 24}Comments

the block size is the same for all key sizes

Family “2.0"

TCG PUBLIC REVIEW

Page 29

Level 00 Revision 01.34

Copyright © TCG 2023

April 13, 2023

7.5

TDES

Definitions for two and three key triple-DES.
A TCG compliant device shall not allow a triple DES key to be used if K1 = K2, or K2 = K3.
Table 30 — Defines for TDES Symmetric Cipher Algorithm Constants
Name

Value

Comments

TDES_KEY_SIZES_BITS{128, 192}

key sizes include the ‘parity’ bit in each byte

TDES_BLOCK_SIZES_BITS{64, 64}

TDES_ROUNDS{48, 48}

DES-equivalent rounds

The following 64, 64-bit DES key values shall not be used in a TCG compliant device.
010101010101010116
011F011F010E010E16
01FE01FE01FE01FE16
1FFE1FFE0EFE0EFE16
01011F1F01010E0E16
1F1FE0E00E0EF1F116
E0FE011FF1FE010E16
011FE0FE010EF1FE16
1FE0FE010EF1FE0116
FE011FE0FE010EF116
01E0E00101F1F10116
E00101E0F10101F116
FEE0011FFEF1010E16
01FEFE0101FEFE0116
E01F1FE0F10E0EF116
FEFE1F1FFEFE0E0E16

FEFEFEFEFEFEFEFE16
1F011F010E010E0116
FE01FE01FE01FE0116
FE1FFE1FFE0EFE0E16
1F1F01010E0E010116
E0E0FEFEF1F1FEFE16
011F1F01010E0E0116
1FE0E01F0EF1F10E16
FE0101FEFE0101FE16
FE01E01FFE01F10E16
1FFEFE1F0EFEFE0E16
FE1F1FFEFE0E0EFE16
01FEE01F01FEF10E16
E01F01FEF10E01FE16
FEFE0101FEFE010116
1F01FEE00E01FEF116

E0E0E0E0F1F1F1F116
01E001E001F101F116
1FE01FE00EF10EF116
E0FEE0FEF1FEF1FE16
E0E01F1FF1F10E0E16
0101FEFE0101FEFE16
1FE001FE0EF101FE16
E0FEFEE0F1FEFEF116
01E01FFE01F10EFE16
1FFEE0010EFEF10116
FE1FE001FE0EF10116
01FE1FE001FE0EF116
E001FE1FF101FE0E16
FEE0E0FEFEF1F1FE16
1F01E0FE0E01F1FE16
E0E00101F1F1010116

1F1F1F1F0E0E0E0E16
E001E001F101F10116
E01FE01FF10EF10E16
FEE0FEE0FEF1FEF116
0101E0E00101F1F116
1F1FFEFE0E0EFEFE16
E0FE1F01F1FE0E0116
011FFEE0010EFEF116
1FFE01E00EFE01F116
FE1F01E0FE0E01F116
01E0FE1F01F1FE0E16
E0011FFEF1010EFE16
FEE01F01FEF10E0116
1F01011F0E01010E16
E01FFE01F10EFE0116
FEFEE0E0FEFEF1F116

Page 30

TCG PUBLIC REVIEWFamily “2.0"April 13, 2023

Copyright © TCG 2023

Level 00 Revision 01.34

8

Hash-Based Signature Parameters and Considerations

8.1

Introduction

The hash-based signature schemes listed in Table 3 accept the following parameters:

8.2•

H, a hash function.

•h, the height of the Merkle tree. h relates to the trade-off between key generation work andthe number of signatures that can be produced by the key.

•

w is related to the length of the Winternitz chains that compose the signature. LMS andXMSS define this term differently. In TCG specifications, w refers to the number of bitsfrom the hash or checksum that are used in a single Winternitz chain (that is, LMS's
definition of w) 1. w relates to the trade-off between signature size and signature
generation/verification work.
NIST Parameter Sets

In SP800-208, FIPS approved and NIST recommended the following parameter sets for SHA256
family usage of LMS and XMSS:Table 31 — Parameters for LMS and XMSS Approved in SP800-208

1

Name

H

h

XMSS-SHA2_10_256

SHA256

10 4

2500

XMSS-SHA2_16_256

SHA256

16 4

2692

XMSS-SHA2_20_256

SHA25620 4

2820

XMSS-SHA2_10_192

SHA256_192

10 4

1492

XMSS-SHA2_16_192

SHA256_192

16 4

1636

XMSS-SHA2_20_192

SHA256_192

20 4

1732

LMS_SHA256_M32_H5

SHA256

5{1, 2, 4, 8}1292 (w=8) to 8684 (w=1)

LMS_SHA256_M32_H10 SHA256

10 {1, 2, 4, 8}1452 (w=8) to 8844 (w=1)

LMS_SHA256_M32_H15 SHA256

15 {1, 2, 4, 8}1612 (w=8) to 9004 (w=1)

LMS_SHA256_M32_H20 SHA256

20 {1, 2, 4, 8}

1772 (w=8) to 9164 (w=1)

LMS_SHA256_M32_H25 SHA256

25 {1, 2, 4, 8}

1932 (w=8) to 9324 (w=1)

LMS_SHA256_M24_H5

5{1, 2, 4, 8}

780 (w=8) to 4956 (w=1)

LMS_SHA256_M24_H10 SHA256_192

10 {1, 2, 4, 8}900 (w=8) to 5076 (w=1)

LMS_SHA256_M24_H15 SHA256_192

15 {1, 2, 4, 8}1020 (w=8) to 5196 (w=1)

LMS_SHA256_M24_H20 SHA256_192

20 {1, 2, 4, 8}1140 (w=8) to 5316 (w=1)

LMS_SHA256_M24_H25 SHA256_192

25 {1, 2, 4, 8}

1260 (w=8) to 5436 (w=1)

SHA256_192

w* (LMS definition)

signature size (bytes)

This is in contrast to XMSS, where w refers to the actual length of the Winternitz chain, which uses log 2 (w) bits from the hash or checksum. In the
NIST parameter sets for XMSS, w=4 (LMS definition) is equivalent to w=16 (XMSS definition).

Page 0TCG PUBLIC REVIEWFamily “2.0"April 13, 2023

Copyright © TCG 2023

Level 00 Revision 01.34

NIST introduced and recommended SHA256_192 (the 192-bit truncated SHA256 hash) for use
with both LMS and XMSS for a trade-off of reduced collision resistance for reduced signature size.
Along with the parameter sets for the SHA256 family algorithms, NIST recommended similarparameter sets that use SHAKE256 and SHAKE256/192 (not listed here).

Family “2.0"

TCG PUBLIC REVIEW

Page 1

Level 00 Revision 01.34

Copyright © TCG 2023

April 13, 2023

Annex A — Bibliography
For dated references, only the edition cited applies. For undated references, the latest edition of
the referenced document (including any amendments) applies.
•

GB/T 32907-2016: Information security technology—SM4 block cipher algorithm•

GB/T 32918.1-2016: Information security technology—Public key cryptographic algorithm SM2
based on elliptic curves—Part 1: General•

GB/T 32918.2-2016: Information security technology—Public key cryptographic algorithm SM2
based on elliptic curves—Part 2: Digital signature algorithm•

GB/T 32918.3-2016: Information security technology—Public key cryptographic algorithm SM2
based on elliptic curves—Part 3: Key exchange protocol•

GB/T 32918.4-2016: Information security technology—Public key cryptographic algorithm SM2
based on elliptic curves—Part 4: Public key encryption algorithm•

GB/T 32918.5-2017: Information security technology—Public key cryptographic algorithm SM2
based on elliptic curves—Part 5: Parameter definition•

IEEE Std 1363 TM -2000, Standard Specifications for Public Key Cryptography•

IEEE Std 1363a™-2004 (Amendment to IEEE Std 1363™-2000), IEEE Standard Specifications
for Public Key Cryptography- Amendment 1: Additional Techniques•

IETF RFC 8017, Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography
Specifications Version 2.2•

IETF RFC 7748, Elliptic Curves for Security•

IETF RFC 8032, Edwards-Curve Digital Signature Algorithm (EdDSA)•

ISO/IEC 9797-2, Information technology — Security techniques — Message authentication
codes (MACs) — Part 2: Mechanisms using a dedicated hash-function•

ISO/IEC 10116, Information technology — Security techniques — Modes of operation for an nbit block cipher•

ISO/IEC 10118-3-2018, Information technology — Security techniques — Hash-functions —Part 3: Dedicated hash functions•

ISO/IEC 14888-3, Information technology -- Security techniques -- Digital signature withappendix -- Part 3: Discrete logarithm based mechanisms•

ISO/IEC 15946-1, Information technology — Security techniques — Cryptographic techniques
based on elliptic curves — Part 1: General•

ISO/IEC 18033-3, Information technology — Security techniques — Encryption algorithms —Part 3: Block ciphers•

ISO/IEC 19772, Information technology — Security techniques — Authenticated encryption•

NIST SP800-108, Recommendation for Key Derivation Using Pseudorandom Functions(Revised)•

NIST SP800-56A, Recommendation for Pair-Wise Key Establishment Schemes Using Discrete
Logarithm Cryptography (Revised)•

NIST SP800-38C, Recommendation for Block Cipher Modes of Operation: The CCM Mode for
Authentication and Confidentiality•

NIST SP800-38D, Recommendation for Block Cipher Modes of Operation: Galois/Counter
Mode (GCM) and GMAC

Page 2

TCG PUBLIC REVIEWFamily “2.0"April 13, 2023

Copyright © TCG 2023

Level 00 Revision 01.34

•

NIST SP800-38F, Recommendation for Block Cipher Modes of Operation: Methods for Key
Wrapping•

NIST SP800-208, Recommendation for Stateful Hash-Based Signature Schemes•

NIST SP800-185, SHA-3 Derived Functions: cSHAKE, KMAC, TupleHash and ParallelHash•

TCG Trusted Platform Module 2.0 Library Specification – Part 1: Architecture

Family “2.0"

TCG PUBLIC REVIEW

Page 3

Level 00 Revision 01.34

Copyright © TCG 2023

April 13, 2023