TPM Attestation

The TPM serves as an immutable hardware trust anchor physically bound to the motherboard. It contains a unique Endorsement Key (EK) burned in during manufacturing, which never leaves the chip. All attestation chains derive from this root, ensuring that trust cannot be spoofed by software alone.

• The EK is an RSA or ECC key pair generated and stored in shielded locations
• Private key material never enters system memory, preventing cold-boot extraction
• Establishes a hardware-based identity distinct from the operating system or application layer

PCRs are shielded memory locations within the TPM that store cryptographic hash measurements of system state. Each PCR holds a SHA-256 hash, updated through an extend operation that concatenates the new measurement with the existing value before hashing.

• PCRs capture boot chain integrity: BIOS, bootloader, OS kernel, and critical drivers
• The extend operation creates an append-only, tamper-evident log
• Once extended, PCR values cannot be reset without a platform reboot
• Typical TPM 2.0 implementations expose 24 PCR banks for different measurement categories

Remote attestation proves to a relying party that the platform is in a known-good state. The TPM signs a quote over selected PCR values using an Attestation Identity Key (AIK) , which is itself certified by the EK through a privacy-preserving chain.

• The verifier challenges the TPM with a nonce to prevent replay attacks
• The TPM returns a signed quote containing PCR values and the nonce
• The verifier compares PCR values against known-good reference measurements
• A mismatch indicates unauthorized modification, triggering access denial or remediation

Measured boot extends PCRs at each stage of the boot sequence, creating a tamper-proof audit trail. The companion Event Log stored in system memory records the actual hashed artifacts, enabling the verifier to reconstruct and validate the PCR values.

• Each boot component measures the next before transferring execution
• The Event Log provides transparency: verifiers can identify exactly which binary caused a PCR mismatch
• Supports Secure Boot integration, where unsigned or revoked binaries are blocked before measurement
• Critical for detecting bootkits and persistent firmware implants

Beyond attestation, the TPM can seal secrets to specific PCR states. A sealed key or data blob is encrypted such that the TPM will only release it if the current PCR values match the policy specified at sealing time.

• Binding encrypts data with the TPM's public key, ensuring only that specific TPM can decrypt
• Sealing adds PCR policy constraints: the platform must be in a trusted state
• Enables BitLocker and similar disk encryption to lock volumes if the boot chain is compromised
• Prevents offline attacks where an attacker moves a disk to a different machine

TPM attestation separates platform identity from user identity. The Endorsement Key uniquely identifies the TPM but is never used directly for attestation. Instead, Attestation Identity Keys (AIKs) are generated and certified through a Privacy CA or Direct Anonymous Attestation (DAA) protocol.

• AIKs are bound to the TPM but unlinkable to the EK by external observers
• DAA enables zero-knowledge proofs of TPM possession without revealing which specific TPM
• Prevents tracking and correlation of attestation events across services
• Essential for enterprise deployments where hardware identity must remain confidential