Lesson 3.64: TPM measured boot
From the first firmware instruction to the kernel, each boot stage hashes the next one into the TPM's Platform Configuration Registers before running it. The PCRs can't be set, only extended, so they end up as a fingerprint of exactly what booted. Compare them with a known-good baseline and a replaced boot loader or a switched-off Secure Boot shows up, even if every log was cleaned. In the lab a finance server's disk unlocked from the TPM yesterday but asks for its recovery key today. You read the PCRs, find which stages changed, prove the boot loader was replaced, keep the evidence and restore the signed one.
18 min
You will learn to
- Explain how measured boot fills PCRs
- Read PCRs with tpm2_pcrread
- Know what PCRs 0, 2, 4 and 7 measure
- Find a changed boot stage by comparing with a baseline
- Explain why a TPM-sealed disk key stops unlocking
Key terms
- TPM
- Trusted Platform Module: a chip (or firmware) that stores keys and measurements and can seal secrets to them.
- PCR
- Platform Configuration Register: a TPM register changed only by extend, reset at power-on.
- PCR 0 / 2
- Firmware code / option ROMs (add-in card firmware).
- PCR 4
- The boot loaders that ran (shim, GRUB).
- PCR 7
- Secure Boot state and the keys used to verify the boot chain.
- Sealing
- Encrypting a secret so the TPM releases it only when chosen PCRs have chosen values.
← Boot loader and kernel command line · All lessons · Responding to ransomware →