Title: INTEGRITY MEASUREMENT AND REPORTING

Integrity Measurement and Reporting

A trusted platform subsequently collects information about its current configuration and stores it in a log outside the TPM, called Stored Measurement Log (SML). This enables the detection of modified code and malicious or unwanted software which might compromise the platform’s security and thus its level of trust. The information stored in the SML cannot be stored inside the TPM device since it may become very large. Manipulations of the SML will be detected because the digest of the original sequence is securely stored inside the TPM. For this purpose the TPM provides a set of registers called Platform Configuration Registers (PCR) that can be used to store hash values. The TPM hardware ensures that the registers can only be modified as follows: Ri+1 := SHA1(RijI), with the old register value Ri, the new register value Ri+1, and the input I. The process of modifying a PCR value is called extending a PCR and ensures that related values will not be ignored and the order of operations is preserved.

The content of the PCRs can be used for verifiable attestation of the platform’s configuration based on Validation Credentials and the chain of trust. Validation Credentials are digital certificates issued by hard- or software manufacturers that provide measurable components (like video and disk storage adapters, memory controllers, processors or software) or other qualified validation entities. They contain the validation entity name, component manufacturer name, component model number, version or stepping and digitally signed reference measurement values taken in a clean-room environment when the component is believed to work properly. The verification of a platform configuration state requires the re-computation of the measurement digest using the reference measurements from the Validation Credentials and a simple comparison of the resulting digest value with the actual content of the PCR. A TPM can attest to a PCR value by digitally signing it with an AIK.