In the TPM architecture, we know that after a "Measurement" procedure is performed, it is followed by a "PCR Extend" procedure, in which the resulting system configuration metrics data (20 bytes) are appended to the value that the PCR in the TPM currently stores, which (in case it is not zero, i e. "Measurement" is performed for the first time ever/after a PCR restart) is a SHA-1 / SHA256 hash (20 bytes) of the previous metrics + hash concatenation, and the resulting 40 bytes string is SHA-1 / SHA-256-hashed to form the new value of the PCR.

Given that the old hash in the PCR is replaced by the new hash, my questions are these:

  1. If we don't have the old SHA-1 / SHA-256 hash anymore, but it was part of the data used for the new hash, how is the current hash in the PCR useful? How can we verify the system integrity using it, since we can not even compute it back? We can get the system metrics again, but since the PCR is overwritten, the old hash is lost, and we can not compute the current hash in the PCR without the previous one.

  2. How is such Chain Of Trust implementation useful, if the current PCR hash holds all the previous hashes (because they were used for the computation at some level down), but these hashes are irretrievable themselves?

  3. How often "Measurement" and the subsequent "PCR Extend" happen? Is it platform specific and what is the most common implementation? Every boot, on hardware change...?

1 Answer 1

  1. The concept of integrity measurement log is used: the current PCR value and the measurement are logged each time a new measurement is added. A verifier replays the log by doing each extend in software and checks if the final value it computes matches the actual final PCR value, in which case it can conclude that the measurements listed in the log are genuine. Example here: https://sourceforge.net/p/linux-ima/wiki/Home/#ima-measurement-list A similar concept is used for the boot stage as well.

  2. If the log replayed correctly, the measurements are trustworthy so the verifier can decide if they are the expected ones.

  3. As often as needed: Boot PCRs are extended mainly during boot, at every boot. Other PCRs may be extended during system operation, as often as needed, e.g. as Linux IMA referenced above does, or like a DRTM such as Intel TXT.

  • Where is this log stored? What prevents the attacker from manipulating it? Is it on the TPM? Commented Feb 8 at 17:15
  • 2
    In principle, it doesn't matter where it's stored. It is tamper evident, as explained with the PCR verification, but doesn't need to be tamper proof or confidential. E.g. IMA log is stored in the kernel memory, but that's just because it's maintained by the kernel.
    – Silviu
    Commented Feb 9 at 11:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .