Platform Configuration Registers

Abstract

Platform Configuration Registers (PCRs) are one of the essential features of a TPM. Their prime use case is to provide a method to cryptographically record (measure) software state: both the software running on a platform and configuration data used by that software. The PCR update calculation, called an extend, is a one-way hash so that measurements can't be removed. These PCRs can then be read to report their state. They can also be signed to return a more secure report, called an attestation (or quote). PCRs can also be used in an extended authorization policy to restrict the use of other objects.The TPM never passes judgment on the measurements. Internally, it doesn't know which measurements are good or bad, or more or less secure or trusted. At the time of measurement, TPM PCRs just record values. Security or trust comes later, when an application uses PCR values in an authorization policy, or a remote party asks for a signed attestation (quote) of the values and judges their trustworthiness.New for TPM 2.0, TPMs no longer hard-code the SHA-1 algorithm for PCRs. The algorithm can be changed. Some implementations include banks of PCRs, with each bank implementing a different algorithm.A TPM implements a number of PCRs: for example, 24 for a PC TPM. The PCRs are allocated by convention to the various software layers, from early boot code to the operating system and applications. They're also allocated for both the software to be run (often the even-numbered PCRs) and the configuration files that customize the boot process (typically the odd-numbered PCRs.) PCR ValueThe primary use case for a PCR is to represent the platform software state, the history of the critical software (and configurations) that have run on the platform until the present. The TPM initializes all PCRs at power on, typically to either all zeroes or all ones, as specified by the TPM platform specification. The caller can't directly write a PCR value. Rather, a PCR value is changed through what the TPM calls an extend operation, as described in Chapter 2. Cryptographically, it is as follows:PCR new value = Digest of (PCR old value || data to extend)

A Trusted Platform Module-based, Pre-emptive and Dynamic Asset Discovery Tool

“…As previously mentioned, the methodology to secure the information contained in the MN involves periodically accessing PCRs in order to monitor the system's integrity. With this purpose, the MN keeps track of potential hardware changes taking place in the PCRs 0 to 7, as these ones can reveal any hardware configuration in the system [20].…”

MA-TEECM: Mutual Anonymous Authentication-Based Credential Migration Technology for Mobile Trusted Execution Environments

“…• Join. Agent establishes a connection with GM through (σ, K), and then T A sends the system environment hashs (similar to platform configuration register (PCR) [23]) signed by K to GM . GM verifies the integrity and issues group membership certificates for Agent and T A.…”

Integration of Hardware Security Modules and Permissioned Blockchain in Industrial IoT Networks

“…2 shows the architecture of a TPM2.0 device [45], where the different components are interconnected by a bus, which also connects to the I/O interface. In addition to the aforementioned TRNG and the nonvolatile memory, where the Platform Configuration Registers (PCR) [48] are located, there are other important modules such as the symmetric and asymmetric key engines and the key generation engine. Typically, TPMs are used in computing systems supporting a BIOS or a similar firmware in charge to boot the device for adding a security layer below the software.…”

“…In this sense, the TPM provides a root of trust. In this scheme, PCRs are records containing a concatenation of hashes [48] which are the base of the different protection mechanisms performed by the TPM. As an example, during the secure boot process provided by modern BIOSes, the startup firmware checks different parameters of the system as the peripherals attached, the status of the memory, and others.…”