Measured Boot is a boot process architecture in which each component in the boot chain — firmware, bootloader, kernel, initrd, kernel command line — is cryptographically hashed and that hash is recorded into a TPM Platform Configuration Register (PCR) before the component executes. The critical distinction from Secure Boot is in what each mechanism provides: Secure Boot is an enforcement mechanism that prevents unauthorised components from running at all; Measured Boot is a recording mechanism that creates a tamper-evident log of exactly what did run, without necessarily preventing anything. The two are complementary and typically deployed together — Secure Boot enforces a policy at boot time, Measured Boot produces the evidence that the policy was enforced as claimed. A system can have Measured Boot without Secure Boot (it records everything that ran, even unsigned components), but Secure Boot without Measured Boot provides enforcement with no attestable evidence of what was enforced.
The measurement process follows a strict extend semantics: a PCR cannot be written to directly; it can only be updated by PCR_Extend(new_value) → PCR := SHA-256(PCR ∥ new_value). Because the PCR’s initial value is all-zeros at boot and each extend operation hashes the current PCR value together with the new measurement, the final PCR value is a hash chain over the entire sequence of measurements in order — it is impossible to produce the same final PCR value by measuring different components or in a different order, even if each individual measurement is valid. This chain property means a PCR value is a commitment to a specific, ordered boot history. The standard Linux measured boot PCR allocation (defined in the UAPI Linux TPM PCR Registry) distributes measurements across registers by category: PCR 0 records the UEFI Core firmware (the BIOS/UEFI code itself); PCR 1 records the UEFI firmware configuration (NVRAM variables); PCR 2 records third-party UEFI drivers and option ROMs; PCR 3 records UEFI firmware application configuration; PCR 4 records the bootloader (GRUB or the UKI’s EFI stub); PCR 5 records the GPT partition table; PCR 6 records platform manufacturer-specific events; PCR 7 records Secure Boot policy state (the PK, KEK, db, and dbx contents that were active); PCR 8 receives the GRUB command line and config file hashes (if GRUB’s TPM module is loaded); PCR 9 receives the kernel image and initrd hashes as loaded by GRUB; PCR 11 is measured by systemd-stub in UKI boots, covering all UKI components (kernel, initrd, kernel command line, splash, credentials); PCR 12 covers the kernel command line and system credentials; PCR 13 covers initrd extension images; and PCR 15 is used for runtime identity measurements including the machine ID and filesystem UUIDs.
The utility of measured boot is realised through attestation and secret sealing. Remote attestation (via Keylime, Trustee, or a cloud attestation service) uses the TPM’s TPM2_Quote command to produce a signed statement over the current PCR values, bound to a fresh nonce from the verifier to prevent replay. A relying party that holds the TPM’s endorsement key certificate (rooted in the TPM manufacturer’s CA) can verify the quote’s signature, confirm the nonce freshness, and compare the PCR values against a known-good reference set — if they match, the platform is running exactly the software stack that produces those measurements. PCR sealing (used by LUKS via systemd-cryptenroll) encrypts a secret (a disk encryption key, a credential, a token) against specific PCR values using the TPM’s TPM2_PolicyPCR mechanism; the TPM will only release the secret if the current PCR state matches the policy at seal time, automatically unlocking LUKS volumes on a verified boot and requiring manual passphrase entry on any other. UKI-based measured boot significantly simplifies this: because a UKI bundles the kernel, initrd, and command line into a single signed binary, the PCR 11 measurement of the entire UKI is stable and predictable — changing any component produces a new, different measurement. This contrasts with GRUB-based measured boot, where the PCR 8 and 9 values depend on the assembled-at-runtime configuration, making pre-calculation of expected values after updates significantly harder. Measured Boot is the foundational prerequisite for the full attestation stack: without it, a TPM can prove its own identity but cannot prove what software is running on the platform it is embedded in; with it, the TPM becomes the hardware anchor for the entire boot chain’s integrity.