# Tpm Attestation Research

> Remote TPM attestation / trust crypto / serial research: TPM2 keys, quote/PCRs, Windows health attestation surfaces, AC trust anchors.

- Skill: `netvar1337/tpm-attestation-research` (Agent Skill)
- Install (CLI): `npx skillmds@latest add netvar1337/tpm-attestation-research`
- Raw SKILL.md: https://api.skillmd.com/api/skills/netvar1337/tpm-attestation-research/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Research & Search
- License: GPL-3.0-or-later
- Author: netvar1337 (https://skillmd.com/u/netvar1337)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/netvar1337/tpm-attestation-research

---


# TPM attestation & trust crypto (research)

## Concepts
- **EK** (Endorsement Key), **AK** (Attestation Key), restricted signing
- **PCR banks** (SHA1/SHA256) reflecting boot measurements
- **Quote** operations binding PCRs to nonce
- Platform cert chains / manufacturer endorsements
- OS "health attestation" / measured boot consumers

## Why ACs care
Remote attestation can prove: real TPM present, boot chain measurements, device key continuity across sessions — harder than simple serial spoof.

## Research workflow
1. Inventory TPM presence (`Get-Tpm`, TBS APIs, `Windows.Devices.Tpm` stacks)
2. Enumerate capabilities / algs / NV indices (read-only first)
3. Capture what user-mode AC modules query vs kernel
4. Map any **remote** challenge-response (nonce → quote/cert → server verify)
5. Document failure modes (no TPM, fTPM, VBS, Hyper-V nested)

## Lab notes
- Distinguish **spoofable software serials** from **crypto-backed identity**
- Virtual TPMs / pass-through change the threat model
- Pair with hypervisor research carefully (measured boot interactions)

## Pair with
`hwid-identifier-surfaces`, `stealth-hypervisor`, `eac-ban-stack`, `windows-recovery-state-research`.

## Refs
- UC: remote TPM attestation / trust crypto / serial threads