Lion Cipher Lab
Attest a machine's boot state with a TPM quote
- Cyber / Security Engineer
- Advanced
- ~60 min
- Free · no account required
Why it matters
Remote attestation answers a question you cannot answer with a password or a network scan: 'is this machine running the software I think it is, right now, and can it PROVE it to me over the network without me trusting the machine's own word?' A compromised host will happily report 'I am healthy' -- self-reported status is worthless once the reporter is owned. A TPM (Trusted Platform Module -- a small tamper-resistant chip, or a firmware equivalent) breaks that circularity. During boot and software load, each component is measured (hashed) and the hash is folded into a PCR (Platform…
What you'll learn
- explaining what a TPM and its PCRs are, and why a PCR can only be EXTENDED (new = hash(old || measurement)) and never overwritten -- so it accumulates a tamper-evident fingerprint of everything measured during boot
- standing up a software TPM with swtpm and pointing tpm2-tools at it over its socket with the TPM2TOOLS_TCTI environment variable -- a full attestation lab with zero TPM hardware
- creating the TPM key hierarchy: an Endorsement Key (EK) as the TPM's identity and a separate Attestation Key (AK) as the signing key, and explaining WHY quotes are signed by the AK and never by the EK directly
- running the attestation handshake: a verifier-generated random nonce, an attester tpm2_quote over chosen PCRs signed by the AK, and a separate-machine tpm2_checkquote against the AK public key + the same nonce + the expected PCR digest
- proving tamper detection by extending a PCR again (simulating changed software) and watching tpm2_checkquote FAIL against the old expected values
- articulating the production-grade hard parts: the AK trust problem (EK certificate, privacy CA, TPM2_ActivateCredential), the anti-replay role of the nonce, and why real deployments use a framework like Keylime instead of hand-rolled scripts
Steps in this lab
- The mental model: TPM, PCRs, and why a register you can only EXTEND is the whole trick
- Install swtpm + tpm2-tools and start the software TPM
- Point tpm2-tools at swtpm with TPM2TOOLS_TCTI, then run TPM startup
- Create the Endorsement Key (EK) -- the TPM's identity -- with tpm2_createek
- Create the Attestation Key (AK) -- the quote-signing key -- with tpm2_createak
- Extend a PCR with a known measurement so there is real state to attest
- Verifier issues a nonce; attester produces the signed quote with tpm2_quote
- Verifier checks the quote with tpm2_checkquote -- a passing attestation
- Break it on purpose: extend the PCR again, re-quote, watch checkquote FAIL
- Why the nonce matters: prove a recorded quote cannot be replayed
- when / why / better: the AK-trust problem, swtpm's missing root of trust, and Keylime