The Hardware Ledger: Trusted Platform Module (TPM)

What Is a TPM?

A TPM (Trusted Platform Module) is a dedicated security microcontroller soldered directly onto the motherboard of virtually all modern servers, laptops, and cloud instances. It is not a software library or a virtual construct — it is a physical chip with its own CPU, memory, and cryptographic engine, isolated from the main processor.

The TPM specification is maintained by the Trusted Computing Group (TCG). TPM 2.0 is the current standard and is required for Windows 11 and most modern Linux security features.

The TPM has two capabilities that make attestation possible:

1. Secure Key Storage: Cryptographic keys generated inside the TPM never leave the chip in plaintext. You can ask the TPM to sign or decrypt data, but you cannot extract the raw key material. Even a kernel-level attacker with full root access cannot read these keys.
2. Platform Configuration Registers (PCRs): These are 24 special-purpose memory slots inside the TPM. They cannot be arbitrarily written to. They can only be extended.

The "Extend" Operation

Think of a PCR like a tamper-evident logbook. You cannot erase a page — you can only append to it, and each new entry includes a hash of everything that came before.

The extend operation works like this:

PCR_new = SHA-256( PCR_current || new_measurement )

Where || means concatenation. The new PCR value is the hash of the old value combined with the new measurement. This has a critical property: the final PCR value encodes the entire history of all measurements, in order. If you change any measurement, or change the order of measurements, the final value is completely different.

For example, if PCR 4 starts at all-zeros and you extend it with the hash of GRUB, then extend it with the hash of the Linux kernel:

PCR[4] = SHA-256( SHA-256( 0x000...0 || hash(grub.efi) ) || hash(vmlinuz) )

If an attacker replaces grub.efi with a malicious version, hash(grub.efi) changes, and the final PCR[4] value is completely different from the expected "known-good" value.

Standard PCR Assignments

Different PCR slots are reserved for different parts of the boot process by convention:

Key Point: PCR extension creates a cryptographic audit log of the entire boot sequence. Because each new value depends on all previous values, the log cannot be forged, replayed, or reordered. An attacker who compromises any stage of boot will produce a different final PCR state — and the TPM will notice.