I am trying to learn more about trusted boot / trusted platform modules and I understand about platform configuration values being a measurement of a 'good' configuration signed by a key locked from access within the TPM chip.

What I don't understand is how these initial 'good' states are set within the PCR values. Is it a case of a signing authority allows the bios vendor or bootloader / kernel maintainer to sign off a release and its 'good' measurements or is it something recorded during first boot of a machine?

Also how are these PCRs populated and recognised as 'good' if someone upgrades kernel, is it again a signing authority, or does the PCRs need to be reset and good configurations set again?

Apologies if there are holes in my understandings here, trying to get a grip on a fairly complex topic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.