to sign the data the tpm then sends the signed data to the user e g to the user 39 s application one advantage of the above approach is that in the event the device is stolen the thief may not be able to access the keys protected by the tpm consequently the thief may not be able to access any information protected by those keys the tpm also may be used to provide cryptographic services for asf operations for example a tpm 300 may be used during an asf authentication e g hmac process in some embodiments the tpm maintains keys for the authentication process within the tpm 39 s security boundary represented by the dashed line in fig3 for example the tpm may use one of the keys it generates e g key 312 to encrypt the keys the tpm may then securely store these encrypted keys in the data memory 304 the device may thus only expose keys in the clear when the device needs to perform an asf authentication operation as discussed above when the device and the management console initiate a new session e g via a network 308 the device needs to perform a calculation for a new key in this case the tpm retrieves the encrypted key from the data memory decrypts it and passes the clear text key to the asf component thus in contrast with conventional techniques the keys used in.