The provider ships sha256(PCR0 || ... || PCR7) and, when the quote path works, a TPM2B_ATTEST blob. No TCG event log is collected and the verifier does not replay one.
Impact. A PCR digest without its event log is opaque. A verifier can tell that platform state differs from a known-good value but not what changed, cannot express policy over individual boot components, and cannot debug a mismatch. In practice any allowlist of expected measurements becomes unmaintainable, because every firmware update invalidates the golden value with no way to explain why.
Fix. Collect the TCG event log (/sys/kernel/security/tpm0/binary_bios_measurements on Linux, Measured Boot APIs on Windows), ship it with the evidence, and have the verifier replay it against the reported PCR values.
Part of the TPM security model RFC.
The provider ships
sha256(PCR0 || ... || PCR7)and, when the quote path works, aTPM2B_ATTESTblob. No TCG event log is collected and the verifier does not replay one.Impact. A PCR digest without its event log is opaque. A verifier can tell that platform state differs from a known-good value but not what changed, cannot express policy over individual boot components, and cannot debug a mismatch. In practice any allowlist of expected measurements becomes unmaintainable, because every firmware update invalidates the golden value with no way to explain why.
Fix. Collect the TCG event log (
/sys/kernel/security/tpm0/binary_bios_measurementson Linux, Measured Boot APIs on Windows), ship it with the evidence, and have the verifier replay it against the reported PCR values.Part of the TPM security model RFC.