1

In my laptop I've set up a bios password when I power on the laptop, and once I enter it the laptop starts my linux distro and decrypts the disk without asking any other password. To do this I've set up TPM to automatically decrypts the disk, if PCR are unaltered.

But now I'm playing with TPM's PCRs in order to be able to prevent that some thief who steals my laptop (which has a bios password when you power it on) to boot anything. I wanted to set a PCR to change when UEFI state changes (so also when a potential thief resets CMOS then the UEFI is reset and so removes bios password), so that my linux distro prompts decryption password and the thief can't do anything.

But I tried with PCR1 which should be related to UEFI settings, and if I change anything in UEFI setting, nothing changes. So I tried all the PCRs, and none changed if I edited the UEFI settings.

Why? Is there something I can do to block the possibility to reset CMOS and boot the laptop?

Since all this does not work and PCR does not consider BIOS/UEFI changes etc., I reflected that, instead of using TPM just to prevent asking for decryption password, I just disable SecureBoot and don't use TPM and I'll enter the decryption disk password. But instead of entering two passwords (bios boot password and decrypt disk password), I replaced the bios boot password with the bios settings password (so it asks me only when I want to access bios or want to change the boot order) and so I only have one password to enter when I power on the laptop: the disk decrypt one.

1
  • If you don't anchor your trust to a root of trust in the CPU itself (i.e. Intel TXT) this setup is useless. There's nothing preventing an attacker (a thief won't care) from flashing a firmware that will measure your setup but then launch something else. Also, they can still boot something else, the TPM won't protect you from that (it's used for measurement and remote attestation). It's also not a problem, if I have your laptop I always can make it run what I want and as long as I can't access your data, that's OK. Finally, measuring the UEFI config would be annoying for almost all users. Nov 18, 2023 at 11:33

1 Answer 1

1

If you change the boot order, PCR[1] should change. It's possible you have a BIOS that doesn't comply with the TCG PC Client Platform Firmware Profile specification (https://trustedcomputinggroup.org/resource/pc-client-specific-platform-firmware-profile-specification/). It's also possible you're changing BIOS settings that aren't measured into PCR[1]. Not every setting is. If they were, PCR[1] would be extremely brittle, changing with every little item whether it affects security or not.

There's a section in the TCG PC Client Platform Firmware Profile spec for each PCR from 0 to 7 in Section 3.3.4 of version 1.05 revision 23. That describes what should change when you have a compliant BIOS.

https://security.stackexchange.com/a/258748/304757 might be relevant to your question as well. Use fwupdtpmevlog to view the TPM Event Log and compare events between settings changes.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .