Measured Boot

The Core Root of Trust for Measurement (CRTM) initiates the process by hashing the next boot component before execution. Each subsequent stage measures the next, extending hashes into Platform Configuration Registers (PCRs) using the operation: New PCR = Hash(Old PCR || New Hash). This cryptographic chaining ensures the final PCR values uniquely represent the exact boot sequence, making it impossible to forge a measurement log without detection.

Platform Configuration Registers are shielded memory locations within a Trusted Platform Module (TPM). They do not store hashes directly but rather a cumulative digest. Key characteristics include:

• PCR 0: Typically holds the CRTM, BIOS, and platform firmware measurements.
• PCR 7: Often used for Secure Boot policy and key state.
• PCRs 8-15: Defined for the operating system bootloader and kernel. The TPM's hardware isolation prevents software from resetting PCRs to arbitrary values except through a system reboot.

These two technologies are complementary but distinct:

• Secure Boot is an enforcement mechanism. It verifies digital signatures and halts the boot process if a component is untrusted.
• Measured Boot is a recording mechanism. It logs every component's hash regardless of trust, allowing a remote party to decide later if the state is acceptable. A system can implement both: Secure Boot enforces integrity, while Measured Boot provides auditable proof of the running configuration.

Alongside PCR extensions, the system maintains a TCG Event Log in system memory. This log records the exact sequence of hashes extended into the PCRs. During remote attestation, a verifier replays the event log to reconstruct the expected PCR values and compares them against the TPM-signed quote. Any mismatch indicates log tampering. The event log provides the semantic meaning—the 'what'—while the PCR provides the cryptographic proof.

The ultimate goal of Measured Boot is to enable a remote verifier to assess platform trustworthiness. The process:

1. A challenger requests a quote.
2. The TPM signs the current PCR values with an Attestation Identity Key (AIK).
3. The signed quote and event log are sent to the verifier.
4. The verifier replays the log and compares it to the signed PCRs. This allows a cloud orchestrator or enterprise server to verify that a node booted a known-good kernel before admitting it to the production cluster.

Measured Boot enables sealing, where data is encrypted to a specific platform state. A TPM can release a decryption key only if the current PCR values match a predefined policy. Use cases include:

• Unlocking a disk encryption key only if the boot sequence is unaltered.
• Releasing a service's TLS private key only to a verified, untampered OS. If malware modifies the bootloader, the PCR values change, and the TPM refuses to unseal the key, rendering the encrypted data inaccessible to the attacker.