Lion Cipher Lab
Meet your TPM: read your machine's PCRs and its measured-boot log
- Foundations
- Beginner
- ~50 min
- Free · no account required
Why it matters
Everything the sibling boot-chain lab taught you about Secure Boot answers one question — 'will the machine refuse to run modified early code?' It cannot answer the other question a defender actually has to answer at scale: 'what DID run when this machine started, and can I prove it?' That second question is what the TPM answers, and it answers it with something an attacker on the machine cannot forge. During boot, the firmware and each following stage feed a hash of the code that is about to run into special registers inside a dedicated security chip — the TPM — and those registers can only…
What you'll learn
- explaining what a TPM (Trusted Platform Module) is and why it is a hardware root of trust
- explaining what a PCR (Platform Configuration Register) is and the extend-only property
- reading the TPM state on Windows with Get-Tpm (TpmPresent, TpmReady)
- reading PCR values on Linux with tpm2_pcrread across a hash bank
- parsing the measured-boot event log with tpm2_eventlog (/sys/kernel/security/tpm0/binary_bios_measurements)
- telling measured boot (RECORDS what ran) apart from Secure Boot (ENFORCES what may run)
- explaining remote attestation and how BitLocker/LUKS seal a key to a known-good boot state
- safely watching a PCR value change by extending and resetting the application PCR (PCR 23)
- stating honestly what a TPM proves (the boot state) and what it does not (that the running OS stays uncompromised)
Steps in this lab
- What a TPM is, in plain English
- What a PCR is, and the one property that makes it trustworthy
- Measured boot vs Secure Boot: RECORD versus ENFORCE
- Why anyone cares: attestation, sealing, and catching a bootkit
- Before you touch anything: the one real hazard here
- WINDOWS — is there a TPM, and is it ready?
- WINDOWS — the sealed disk key and the measured-boot log
- LINUX — install tpm2-tools and read your PCRs
- LINUX — read the measured-boot event log that EXPLAINS those PCRs
- LINUX — the payoff: watch a PCR change (safely, on PCR 23)
- JUDGMENT — what a TPM proves, and the honest limit of it
- What you learned