Platform Configuration Register (PCR)

PCRs do not support arbitrary write operations. New measurements are combined with the existing value using a cryptographic hash extension: PCR_New = Hash(PCR_Old || Digest_New). This one-way, monotonic process ensures that no entity can overwrite a measurement to hide a compromise. The sequence of extensions mathematically encodes the entire event history, making it impossible to forge a 'clean' state without replaying every legitimate event.

The TCG PC Client Platform Firmware Profile specification defines 24 PCRs (index 0-23) with fixed roles:

• PCR 0: Core System Firmware (BIOS/UEFI)
• PCR 1: Host Platform Configuration
• PCR 2-3: Option ROM Code
• PCR 4: Initial Program Loader (IPL) Code
• PCR 5: IPL Configuration
• PCR 7: Secure Boot Policy
• PCR 10: Integrity Measurement Architecture (IMA) for Linux
• PCR 23: Application-specific measurements

A single PCR index can store multiple digests simultaneously in distinct hash banks. A TPM 2.0 must support SHA-256 and may support SHA-384, SHA-512, or SM3. When a measurement is extended, the TPM computes the hash for all active banks in parallel. This allows a verifier to request a quote using its preferred algorithm, enabling interoperability across different security policies without re-measurement.

PCRs enable sealing, a cryptographic operation that encrypts data (like a disk decryption key) to a specific platform state. The TPM will only release the sealed data if the current PCR values match a policy-defined set. This binds secrets to a known-good configuration. For example, a BitLocker key can be sealed to PCRs 0, 2, 4, and 11, ensuring it is only released if the firmware, option ROMs, boot manager, and kernel are unmodified.

A remote verifier challenges a platform to prove its integrity. The TPM signs a quote—a cryptographically authenticated snapshot of selected PCR values—using an Attestation Identity Key (AIK). The quote includes a nonce to prevent replay attacks. The verifier compares the signed PCR digest against a reference database of known-good values to determine if the platform is in a trusted state before granting network access or deploying workloads.

PCR values alone are opaque hashes. To reconstruct the measurement history, the platform maintains a TCG Event Log in system memory. Each entry records the PCR index, the extended digest, and a human-readable description of the measured component. During attestation, the verifier replays the event log to recompute the expected PCR value. If the recomputed hash matches the signed quote, the log is proven authentic and provides granular forensic detail.