TPM attestation & trust crypto (research)
Concepts
- EK (Endorsement Key), AK (Attestation Key), restricted signing
- PCR banks (SHA1/SHA256) reflecting boot measurements
- Quote operations binding PCRs to nonce
- Platform cert chains / manufacturer endorsements
- OS "health attestation" / measured boot consumers
Why ACs care
Remote attestation can prove: real TPM present, boot chain measurements, device key continuity across sessions — harder than simple serial spoof.
Research workflow
- Inventory TPM presence (
Get-Tpm, TBS APIs,Windows.Devices.Tpmstacks) - Enumerate capabilities / algs / NV indices (read-only first)
- Capture what user-mode AC modules query vs kernel
- Map any remote challenge-response (nonce → quote/cert → server verify)
- Document failure modes (no TPM, fTPM, VBS, Hyper-V nested)
Lab notes
- Distinguish spoofable software serials from crypto-backed identity
- Virtual TPMs / pass-through change the threat model
- Pair with hypervisor research carefully (measured boot interactions)
Pair with
hwid-identifier-surfaces, stealth-hypervisor, eac-ban-stack, windows-recovery-state-research.
Refs
- UC: remote TPM attestation / trust crypto / serial threads