↓ Skip to main content
Le Site de François
  1. Index/

TPM (Trusted Platform Module)

Security Hardware Attestation Boot

A Trusted Platform Module (TPM) is a tamper-resistant security chip — implemented in hardware (dTPM), firmware (fTPM), or software — that acts as a hardware-anchored root of trust for a system. It provides a secure enclave for generating and storing cryptographic keys, performing cryptographic operations, and recording integrity measurements of the boot process.

The TPM’s most distinctive feature is its set of Platform Configuration Registers (PCRs): a series of hash accumulators that are extended (not overwritten) during the boot sequence. Firmware, bootloader, kernel, and initrd each contribute measurements to specific PCR banks, building a tamper-evident log of everything that ran before userspace. Standard TPMs expose 24 PCRs; PCRs 0–7 are owned by firmware (UEFI), while PCRs 8–15 are available to the OS. On Linux, these are allocated by convention: PCR 11 is used by systemd-stub to measure all UKI components, PCR 12 covers the kernel command line and credentials, PCR 13 covers initrd extension images, and PCR 15 is used for runtime identity measurements like the machine ID and filesystem UUIDs. The authoritative Linux-side allocation is maintained in the UAPI Linux TPM PCR Registry.

PCR values serve two complementary purposes: forward-looking policy binding, where a secret is sealed against a known-good PCR state and can only be unsealed if the machine boots identically (enabling automatic disk unlocking via systemd-cryptenroll), and backward-looking attestation, where a verifier inspects a signed measurement log to confirm that a remote machine ran a specific software stack before granting it access to sensitive resources. TPMs pair naturally with UKIs and Secure Boot, and are a foundational component in Confidential Computing, measured boot, and zero-trust infrastructure stacks.

Related

Measured Boot

Security Boot Tpm Attestation Linux Firmware Uefi
Measured Boot is a boot process architecture in which each component in the boot chain — firmware, bootloader, kernel, initrd, kernel command line — is cryptographically hashed and that hash is recorded into a TPM Platform Configuration Register (PCR) before the component executes. The critical distinction from Secure Boot is in what each mechanism provides: Secure Boot is an enforcement mechanism that prevents unauthorised components from running at all; Measured Boot is a recording mechanism that creates a tamper-evident log of exactly what did run, without necessarily preventing anything. The two are complementary and typically deployed together — Secure Boot enforces a policy at boot time, Measured Boot produces the evidence that the policy was enforced as claimed. A system can have Measured Boot without Secure Boot (it records everything that ran, even unsigned components), but Secure Boot without Measured Boot provides enforcement with no attestable evidence of what was enforced.

SEV-SNP (AMD Secure Encrypted Virtualization – Secure Nested Paging)

Security Confidential-Computing Hardware Attestation Virtualization Amd
SEV-SNP is AMD’s third-generation confidential computing technology for EPYC processors, and the generation in production use across major cloud providers (AWS, Google Cloud) and Linux distributions today. It builds on two predecessors: SEV (2016), which encrypted each VM’s memory with a per-VM AES key managed by the AMD Secure Processor, and SEV-ES (2017), which additionally encrypted CPU register state on VM exit to prevent the hypervisor from reading guest execution state. SEV-SNP’s defining addition is memory integrity: using Secure Nested Paging, the firmware enforces that if a guest can read an encrypted memory location, the value returned must be exactly what the guest last wrote there — closing the replay, remap, and memory aliasing attacks that made earlier generations insufficient for a fully untrusted hypervisor threat model.

TDX (Intel Trust Domain Extensions)

Security Confidential-Computing Hardware Attestation Virtualization
Intel Trust Domain Extensions (TDX) is a confidential computing technology built into Intel CPUs that allows entire virtual machines — called Trust Domains (TDs) — to run with hardware-enforced isolation from the host hypervisor, VMM, and any other software on the platform, including privileged system software with administrative access. Unlike SGX, which protects small application-level enclaves, TDX operates at the VM level, making it suitable for lifting existing workloads into a confidential environment without significant code changes.