Several of us at the TCC have taken the time to investigate recent "allegations" of TPM backdoors, specifically TPM 2.0, and the allegations don't stand up. The best points have been made by David Challener of the Johns Hopkins University Applied Physics Laboratory who noted that when 2.0 is commercially available it will be subject to the same rigorous lab testing of 1.2, and most importantly, TPM manufacturers and PC OEMs will not subject themselves to costly product liability suits and loss of market if they sell flawed "trusted" platform modules. So the vendors themselves will perform their own very rigorous testing, lest they be punished by the market. And, we can be sure TPM 2.0 will also be put to the critical test by independent labs, many of which are located outside the US.
Furthermore, like its predecessors, the TPM 2.0 specifications are based on open standards developed by TCG members from across the globe.
Many at the TCC feel the German BSI employee made misleading statements to the press that TPM 2.0 would have a backdoor for the NSA. It's possible that the unseen proprietary code of Windows 8 could have a backdoor but not the TPM itself. This person is known to have had issues with Microsoft, however he did a disservice by unnecessarily tainting the use of TPMs, a security component that his own government fully supports.
In the coming months my expectation - and preference - is that high profile TPM adoption occur first in the corporate enterprise market rather than with government where rightly or wrongly it could be stigmatized. Enterprise adoption should provide more positive validation of TC technologies for the marketplace.
