Core engineering and protocols for SPI Bus Sniffing & Interposers.
While the internal silicon of a TPM is heavily armored against physical attack, communications between the TPM and host CPU historically traveled in unencrypted plaintext across SPI, I2C, or LPC motherboard traces. By attaching an inexpensive logic analyzer or interposer flex board to the physical pins, attackers routinely extract full-disk encryption keys in seconds during boot.
TPMShield mandates that all data transferred across the physical bus—including command headers, PCR measurements, authorization HMACs, and unsealed symmetric keys—is encrypted at the hardware layer using session keys negotiated via post-quantum cryptography, rendering bus probing completely useless.