The "Evil Maid" Problem
Imagine you leave your laptop in a hotel room. An attacker — in security research this is called the "evil maid" — enters, inserts a USB drive, and replaces your operating system's bootloader with a malicious version. When you return and type your password, the malicious bootloader captures it, sends it to the attacker, and then silently loads the real Windows or Linux OS.
- The OS thinks everything is fine.
- The Antivirus thinks everything is fine.
- The Logging thinks everything is fine.
Because the compromise happened before the OS started, no software running inside the OS can detect it. This is the fundamental limitation of software-only security: it cannot observe or verify the environment it was loaded into.
Attestation Chains solve this by creating a cryptographically verifiable "Chain of Trust" that starts from the physical hardware and extends upward through the bootloader, kernel, and application layer. Every link in the chain is measured and recorded before the next link executes. Only when the entire chain is verified does the system release sensitive material — like a disk encryption key or a database credential.
The word attestation means "bearing witness." In this context, the hardware itself bears witness to what software was loaded, in what order, and whether any of it was tampered with.
Key Point: Software-only security cannot detect compromises that occur before the OS boots. The only trustworthy observer of the boot process is a piece of hardware that exists outside the software stack — the TPM.