US How Intel PTT works
Intel Platform Trust Technology (PTT) is a firmware implementation of the Trusted Platform Module (TPM) 2.0 specification. Instead of a separate security chip on the motherboard, the TPM runs as firmware inside the Intel Converged Security and Management Engine (CSME), an isolated processor built into the chipset or system-on-chip. The operating system sees a standard TPM 2.0 device and uses it exactly as it would a discrete chip.
Intel introduced PTT in 2013 with 4th Gen Core processors and Bay Trail Atom systems-on-chip, and it is present on most Intel Core, Core Ultra, Atom and Intel Processor N platforms since. The TPM’s keys are protected by the CSME and stored encrypted in the board’s SPI flash, so they never leave the platform in readable form.
Because there is no extra chip, PTT costs nothing in board space or power. That is why it has become the usual TPM on compact fanless PCs, single-board computers and tablets, where a discrete TPM would have been left off.
What PTT is used for
On its own a TPM does nothing visible. The operating system and security software use it as a hardware root of trust.
-
//
Windows 11 requirement. Windows 11 needs TPM 2.0, and on most Intel systems PTT is what satisfies the check once it is enabled in the BIOS.
-
//
Drive encryption. BitLocker and Linux LUKS (through tpm2 tools or systemd-cryptenroll) seal the disk key to the TPM, so a removed SSD stays unreadable.
-
//
Measured boot and attestation. Firmware and bootloader measurements are recorded in the TPM’s registers, so a management server can check that a device booted untampered code.
-
//
Credential protection. Windows Hello, virtual smart cards and Credential Guard keep secrets in or behind the TPM rather than on disk.
-
//
Device identity. A TPM-held key gives each industrial PC or gateway an identity that cannot be copied to another device, which suits certificate-based enrolment for IoT fleets.
PTT vs dTPM vs fTPM
Every option below meets the same TPM 2.0 specification and works with the same software. They differ in where the TPM runs, how well it resists physical attack and how it is certified.
| Type | Where it runs | Physical attack exposure | Certification | Typical systems |
|---|---|---|---|---|
| Intel PTT | Firmware in the Intel CSME, inside the chipset or SoC | No external bus to probe; relies on CSME isolation | Varies by platform; check if a contract names FIPS 140 | Intel Core, Core Ultra, Atom and Processor N systems |
| AMD fTPM | Firmware in the AMD Platform Security Processor inside the CPU | No external bus to probe; relies on PSP isolation | Varies by platform | AMD Ryzen, Ryzen Embedded and some EPYC systems |
| Discrete TPM (dTPM) | Separate chip soldered on the board or on a header module | Hardened chip, but the LPC or SPI bus to it can be sniffed | Usually Common Criteria and FIPS 140 certified | Servers, defense and government builds, older boards |
| Microsoft Pluton | Security processor built into the CPU die | No external bus; firmware updated by Microsoft | Varies by processor | Recent AMD Ryzen, Qualcomm Snapdragon X and some Intel Core Ultra |
dTPM vs PTT: which to choose
For most industrial and embedded deployments, PTT is enough. It gives Windows 11, BitLocker and attestation everything they need, and because it lives inside the processor there is no exposed bus between the CPU and the TPM, which is the weak point exploited in published attacks that read BitLocker keys off a discrete TPM’s wires.
A discrete TPM is the better choice when a contract or security policy names a certified module. US federal and defense work often requires FIPS 140 validated cryptography, and some USA government and defense buyers ask for Common Criteria certified parts. Discrete chips from suppliers such as Infineon, Nuvoton and STMicroelectronics usually carry both certifications, while firmware TPM certification depends on the exact processor and firmware.
One rule applies to both: switching between PTT and a discrete TPM, or clearing the TPM, deletes its keys. Suspend BitLocker and keep the recovery key safe before changing TPM settings, or the next boot will stop at the recovery screen.
How to turn Intel PTT on
-
//
Find the TPM setting. Look under Advanced, Security, Trusted Computing or PCH-FW Configuration for “Intel PTT”, “Platform Trust Technology” or “TPM device selection”.
-
//
Choose the TPM source. Select PTT (sometimes labeled firmware TPM). On boards with a TPM header, the other choice is discrete TPM; only one can be active.
-
//
Turn on Secure Boot as well. Windows 11 and most measured-boot setups expect UEFI mode and Secure Boot together with the TPM.
-
//
Check it from the operating system. On Windows, run tpm.msc and look for TPM 2.0 with a manufacturer of INTC. On Linux, check that /dev/tpm0 exists or run tpm2_getcap properties-fixed.
PTT in industrial and embedded systems
Industrial PCs often sit unattended in kiosks, cabinets and vehicles, so encrypting the drive and proving what booted matters more than on an office desktop. PTT brings that protection to small fanless systems without adding a chip. Many of our industrial NUC PCs and several industrial Mini-ITX motherboards list Intel PTT in their specifications.
PTT also matters when planning an operating system. Windows 11 IoT Enterprise LTSC can install without a TPM, but BitLocker, Windows Hello and device attestation still depend on one, so it is worth enabling. Our guide to upgrading to Windows 11 IoT Enterprise covers the other hardware checks, and our explainer on how BitLocker protects a drive shows how the TPM key is used.
Quick answers on Intel PTT
Intel Platform Trust Technology: common questions
What does Intel PTT stand for?
Platform Trust Technology. It is Intel’s name for its firmware TPM, unrelated to the push-to-talk meaning of PTT on radios.
Is Intel PTT the same as TPM 2.0?
It is one way of providing TPM 2.0. PTT implements the TPM 2.0 specification in firmware. Windows and Linux treat it as a TPM 2.0 device, so it meets the Windows 11 requirement.
Should Intel PTT be on or off?
On, for almost every system. Leave it on unless a discrete TPM is fitted and selected instead. With no active TPM, BitLocker, Windows Hello and Windows 11 upgrade checks will not work.
Can I disable PTT without affecting BitLocker?
Not safely. BitLocker’s key is sealed to the TPM. Disabling or switching it forces BitLocker recovery, so suspend BitLocker first or decrypt the drive.
Is Intel PTT the same as AMD fTPM?
They do the same job on different processors. Both are firmware TPM 2.0 implementations. PTT runs in Intel’s CSME and fTPM runs in AMD’s Platform Security Processor.
We enable and check the TPM, Secure Boot and UEFI settings as part of our standard Windows build, so BitLocker and the Windows 11 checks work from first boot.