I have a Raspberry Pi with a TPM chip, where I use the TPM for disk encryption. The disk encryption password is sealed to the TPM using PCR register 0. I extend the PCR on the start of the system with certain values, but I found out that PCR 0 only resets on a power cycle, and not on a reboot.
Also running tpm2_shutdown --clear && tpm2_startup --clear
does not reset the value, while the TPM spec states the following:
TPM Reset is a Startup(CLEAR) that follows a Shutdown(CLEAR), or a Startup(CLEAR) for which there was no preceding Shutdown() (that is, a disorderly shutdown). A TPM Reset is roughly analogous to a reboot of a platform. As with a reboot, most values are placed in a default initial state, but persistent values are retained. Any value that is not required by this specification to be kept in NV memory is reinitialized. In some cases, this means that values are cleared, in others it means that new random values are selected.
How can I reset PCR 0 on a reboot?
The TPM is connected by a in-house made PCB, so it could be a hardware-connection problem.