The only way to add data to a PCR is with TPM Extend Current value of a PCR is X. (Say, 0x0000....0000.) We extend the PCR with some data Y. Y must be 160 bit (20 byte) value 20 bytes = SHA1 hash, allowing longer data TPM calculates hash(Y,X)=Z; changes value in PCR to Z. We can update further: Extend with A: value is hash(A,Z)=hash(A, hash(Y,X)) Extend with B: PCR value is hash(B, hash(A,Z)) ...etc. Verifiers who know the values extended into the PCRs can easily verify Perform the same hash chain themselves Computationally infeasible to forge (must break SHA-1) Given PCR state N and desired state M, adversary would need to find X such that hash(X,N)=M; violates one-way assumption
The only way to add data to a PCR is with TPM Extend Current value of a PCR is X. (Say, 0x0000....0000.) We extend the PCR with some data Y. Y must be 160 bit (20 byte) value 20 bytes = SHA1 hash, allowing longer data TPM calculates hash(Y,X)=Z; changes value in PCR to Z. We can update further: Extend with A: value is hash(A,Z)=hash(A, hash(Y,X)) Extend with B: PCR value is hash(B, hash(A,Z)) ...etc. Verifiers who know the values extended into the PCRs can easily verify Perform the same hash chain themselves Computationally infeasible to forge (must break SHA-1) Given PCR state N and desired state M, adversary would need to find X such that hash(X,N)=M; violates one-way assumption
Some (but not all) PCRs are resettable. This means they can be reset to a known state by executing the TPM PCR Reset command. Whether a given PCR is resettable or not is defined in platform spec All PC client TPMs have the same settings Server or virtual TPMs could differ; specs do not exist yet Reset requires appropriate permissions Usually based on locality, which we’ll discuss next Sets PCR value back to default, erasing all data currently present Either 0x000...000 or 0xFFF...FFF, depending on PCR & machine state
Some (but not all) PCRs are resettable. This means they can be reset to a known state by executing the TPM PCR Reset command. Whether a given PCR is resettable or not is defined in platform spec All PC client TPMs have the same settings Server or virtual TPMs could differ; specs do not exist yet Reset requires appropriate permissions Usually based on locality, which we’ll discuss next Sets PCR value back to default, erasing all data currently present Either 0x000...000 or 0xFFF...FFF, depending on PCR & machine stateSOURCE
