What piece of hardware on a computer's motherboard generates encryption keys and only releases a part of the key so that decrypting a disk on a new piece of hardware is not possible?

The CPU is a general-purpose processing unit responsible for executing instructions; it does not have dedicated hardware storage for generating and binding encryption keys to a specific machine.

UEFI is firmware that initializes hardware during boot and can interact with the TPM, but it is not itself the hardware component that generates and stores encryption keys.

The GPU is a graphics processing unit designed for rendering and parallel computation; it has no role in generating or storing motherboard-bound encryption keys for disk encryption.

The TPM (Trusted Platform Module) is a dedicated security chip on the motherboard that generates encryption keys and stores a portion of the key internally, releasing only part of it during the boot process. This binding of the key to specific hardware means that if a TPM-protected drive is moved to another machine, the full key cannot be reconstructed and the disk cannot be decrypted. This is the foundational mechanism behind technologies like BitLocker, which uses the TPM to seal encryption keys to a specific hardware configuration.