AbstractTrusted Platform Module (TPM) is the “root of trust” of the whole trusted computing platform. The TPM's own security assurance is very important. This paper describes the TPM 2.0 hash‐based message authentication code (HMAC) authorization scheme as a security protocol and makes a detail comparison of the TPM 2.0 authorization to the TPM 1.2 “Object‐Independent Authorization Protocol” and the “Object‐Specific Authorization Protocol.” Then the authors use the typed pi calculus to describe the TPM 2.0 HMAC authorization and its security properties under the Digital Rights Management (DRM) scenario and use ProVerify to reason that the key handle manipulation attack for TPM 1.2 does not exist any more in TPM 2.0, because the access entity unique name has been linked to the HMAC value, but the vulnerability of key blob substitution still exists in TPM 2.0. Copyright © 2015 John Wiley & Sons, Ltd.