Menu

Individual skill

validating-tpm-measured-boot-attestation

0upvotes

Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote/tpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware/kernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.

skills/validating-tpm-measured-boot-attestation/SKILL.md

Read pinned source

Source commit 54a798831d2266a3ca61ce68a7acb80b81160d57

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Network or broad shell
Last checked
Nov 9, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
35,926
Repository last updated
Aug 31, 2026
License
Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt
# Validating TPM Measured Boot and Attestation

> **Legal Notice:** Perform TPM operations only on systems you own or are authorized to assess. Some operations (clearing the TPM, taking ownership, defining NV indices) are destructive or can lock the device. This skill is for defensive integrity verification and authorized assessment.

## Overview

A Trusted Platform Module (TPM 2.0) is a hardware root of trust that supports **measured boot**: each stage of the boot chain hashes ("measures") the next stage and *extends* that measurement into a Platform Configuration Register (PCR) before handing off control. PCRs cannot be set arbitrarily — they can only be extended (`new = hash(old || measurement)`), so the final PCR value is a tamper-evident summary of everything that executed. The TCG firmware profile assigns specific meanings: UEFI firmware code/config measure into **PCR 0–7** (PCR 7 specifically captures Secure Boot policy), bootloaders measure the kernel into **PCR 8–9**, and Linux IMA measures executables into **PCR 10**.

Two complementary verifications matter. **Local validation** reads current PCRs (`tpm2_pcrread`) and replays the TPM event log (`tpm2_eventlog` on `/sys/kernel/security/tpm0/binary_bios_measurements`) to confirm the recorded measurements reproduce the live PCR values — proving the log is authentic and revealing exactly *what* changed if a value drifts from baseline. **Remote attestation** has the TPM produce a signed quote (`tpm2_quote`) over selected PCRs using an Attestation Key (AK), with a fresh nonce to prevent replay; a verifier then independently checks the signature and PCR digest (`tpm2_checkquote`) and compares against a golden/expected value. This lets a server cryptographically establish that a remote machine booted approved firmware and kernel before granting access, sealing secrets, or admitting it to a Zero Trust network.

This skill provides the full `tpm2-tools` workflow for enrolling an AK, capturing and verifying quotes, replaying event logs, sealing/unsealing data to a PCR policy, and building a golden-value baseline for fleet attestation.

## When to Use

- Establishing that endpoints/servers booted a known-good firmware and kernel before granting access (Zero Trust device posture).
Back to top