Lion Cipher Lab
Prove a machine's integrity to a remote party with TPM 2.0 remote attestation
- Cyber / Security Engineer
- Advanced
- ~75 min
- Free · no account required
Why it matters
Encryption answers 'can an eavesdropper read this?' Attestation answers a harder, newer question that zero-trust architectures live or die on: 'before I hand this machine a secret or let it onto my network, can it PROVE it booted software I trust — not a tampered kernel, not a rootkitted bootloader, not an attacker's clone?' A password or a TLS client cert proves the machine holds a key; it says nothing about the STATE of the machine holding it. TPM remote attestation closes that gap: the machine's boot chain is measured into hardware registers (PCRs), and the TPM will sign a fresh,…
What you'll learn
- the core distinction from the LUKS-sealing sibling: LOCAL sealing releases a key to the SAME box if its own PCRs match; REMOTE attestation proves your PCR state to a SEPARATE verifier who then decides whether to trust you
- the cast of a TPM attestation and who holds what: PCR (a hash accumulator only ever EXTENDED as each boot stage measures the next), EK (the TPM's certified identity key), AK/AIK (the key that SIGNS quotes), the quote (a signed TPMS_ATTEST over a PCR digest + your nonce), and the attester-vs-verifier split
- standing up a software TPM with swtpm in socket mode and pointing tpm2-tools at it via TPM2TOOLS_TCTI=swtpm:path=... — a full attestation lab with no physical TPM and no root for the emulator itself
- creating and persisting an EK and an AK on the attester (tpm2_createek, tpm2_createak, tpm2_evictcontrol) and exporting ONLY the AK public key to the verifier — the verifier never touches your TPM
- the freshness handshake: the verifier mints a fresh random NONCE (tpm2_getrandom) per attestation and the attester folds it into tpm2_quote as qualifying data, so an old captured quote can't be replayed
- verifying with tpm2_checkquote using just the AK public key: it checks the AK signature, that the nonce matches (no replay), and that the PCR values recompute to the digest the TPM signed — then YOU compare those PCRs to a known-good 'golden' set
- proving replay protection by hand: replay a valid old quote.msg/quote.sig against a NEW nonce and watch tpm2_checkquote reject it with 'Error validating nonce from quote'
- breaking trust reproducibly: tpm2_pcrextend a PCR to simulate a changed boot component, re-quote, and watch tpm2_checkquote against the GOLDEN pcrs fail with 'PCR values failed to match quote's digest' even though the signature is genuine
- why an AK must be bound to a real EK (credential activation with tpm2_makecredential/tpm2_activatecredential) — without it an attacker attests with a software fake and a valid-looking quote proves nothing about a real machine
- the named subtleties: NONCE-or-it's-replayable (#1), EK/AK binding or a fake TPM attests, PCR SELECTION (attest the boot chain, not runtime-mutable registers), and TOCTOU — a quote proves state AT QUOTE TIME, not right now
Steps in this lab
- Remote attestation vs local sealing: the mental model
- Stand up a software TPM with swtpm and point tpm2-tools at it
- On the ATTESTER: create an EK, an AK, and read the PCRs
- The trust root: bind the AK to a REAL EK (credential activation)
- VERIFIER issues a fresh nonce; ATTESTER produces a quote
- VERIFIER verifies the quote — and compares to a known-good baseline
- Attack #1 — REPLAY: why a fresh nonce is the whole game
- Attack #2 — TAMPER: change a PCR, re-quote, watch trust fail
- The named failure modes and advanced depth
- The judgment: when to attest remotely, and the do-it-better