is bound to a certain user. The following technical details are taken from [@TPM06].

The TPM is equipped with a physical random number generator, and a key generation component which creates RSA key pairs. The key generator is designed as a protected capability and the created private keys are kept in a shielded capability (a protected storage space *inside* the TPM).

The TPM possesses so-called shielded capabilities protecting internal data structures by controlling their use. Three of them are essential for applications. First, *key creation and management*, second the ability to create a *trust measurement* which can be used to assert a certain state toward a, remote party, and finally methods, which we call *sealing*, to protect arbitrary data by binding it (in TCG nomenclature) to TP states and TPM keys.

For the TPM to issue an assertion about the system state, a process called *attestation*, two protocols are available. As the uniqueness of every TPM leads to privacy concerns, they provide pseudonymity, respectively, anonymity. Both existing attestation protocols rest on Attestation Identity Keys (AIKs) which are placeholders for the EK. An AIK is a 1024 bit RSA key the private portion of which is also sealed inside the TPM. 