Contents
What algorithms are used by TPM?
TPMs (current version is 1.2) use the following cryptographic algorithms: RSA, SHA1, and HMAC.
What is a measured boot?
Windows 8 introduces a new feature called Measured Boot, which measures each component, from firmware up through the boot start drivers, stores those measurements in the Trusted Platform Module (TPM) on the machine, and then makes available a log that can be tested remotely to verify the boot state of the client.
What are platform identity keys?
In a related fashion, TPM platform identity keys allow devices to authenticate using robustly protected credentials that are protected by TPM hardware.
What is TPM measured boot?
The Trusted Platform Module (TPM) is a tamper-proof, cryptographically secure auditing component with firmware supplied by a trusted third party.
How does Measured Boot Work?
Measured Boot uses the following process: The PC’s UEFI firmware stores in the TPM a hash of the firmware, bootloader, boot drivers, and everything that will be loaded before the anti-malware app. The TPM uses the unique key to digitally sign the log recorded by the UEFI.
What happens when you switch PCR banks on TPM 2.0?
This topic provides background about what happens when you switch PCR banks on TPM 2.0 devices. A Platform Configuration Register (PCR) is a memory location in the TPM that has some unique properties. The size of the value that can be stored in a PCR is determined by the size of a digest generated by an associated hashing algorithm.
How is a measurement stored in a TPM?
This means whenever a measurement is sent to a TPM, the hash of the concatenation of the current value of a PCR and the new measurement is stored (i.e. new_value = Hash (old_value || new_measurement) ). Obviously, there’s a beginning to all of this:
How is the size of a PCR Bank determined?
The size of the value that can be stored in a PCR is determined by the size of a digest generated by an associated hashing algorithm. A SHA-1 PCR can store 20 bytes – the size of a SHA-1 digest. Multiple PCRs associated with the same hashing algorithm are referred to as a PCR bank.
What is the Trusted Computing Group ( PCR ) standard?
The Trusted Computing Group have a standard for what measurements must (and optionally) take place during the boot process, eg: PCR 0 is the CRTM, PCR 1 is the measurement of the BIOS etc. PCRs 0 to 7 are set during this process. Other PCR values can be written to after boot, eg: PCR 10 is the defacto standard for Linux IMA.