Skip to main content

​
Introduction

Platform Configuration Register 1 (PCR[1]) is a TPM register that records information about the system’s boot configuration, such as boot order, SMBIOS tables, and firmware configuration data. Because PCR[1] is one of the registers EVE-OS (Edge Virtualization Engine) uses to seal the vault encryption key by default, changes to the underlying hardware or firmware configuration will change the PCR[1] value and might cause vault unsealing to fail until the attestation template is updated. For background on how PCRs work in EVE-OS, see Trusted Platform Module (TPM) Overview.

​
How PCR[1] Is Measured

If the edge device has a TPM installed, GRUB logs each command executed and each file loaded into the TPM event log and extends PCR values accordingly. All events are logged with a type of EV_IPL and an event description. The measured boot creates a chain of trust: each stage of the boot process measures the next before executing it, starting with system firmware and continuing through the bootloader, kernel, and operating system. PCR indexes 8, 9, 13, and 14 provide more ZEDEDA-specific detail about the software stack than the earlier firmware-level PCRs.

​
Example TPM event

The following is an example of descriptive information that gets hashed and recorded in the TPM event log:
This boot option, including the NVMe drive’s serial number, shows how specific boot configurations, as determined by the BIOS manufacturer, can affect the PCR measurement. Other manufacturers or even different BIOS versions for the same device might use a different format, for example without a serial number. This event describes a Boot#### UEFI variable, which the firmware records as an EV_EFI_VARIABLE_BOOT event and extends into PCR[1]. Together with the BootOrder variable, these entries are the part of PCR[1] most often changed by operational activity such as attaching a USB drive or reordering boot devices. EVE-OS captures the values of these variables at sealing time and again when an unseal fails, so that a PCR[1] mismatch can be traced to the specific boot entry that changed. The TPM event log provides a narrative of the boot process. The Boot Option event tells you what device was booted from, while the subsequent events in PCRs 8 and 9 tell you what that device did to load the operating system. This complete picture is what allows ZEDEDA to have a high degree of confidence in the integrity of its edge nodes.

​
Factors That Influence PCR[1]

Several factors can influence the PCR[1] index.
The names and specific configurations of “Enable USB Boot” and “Fast Boot” options can vary depending on the BIOS manufacturer. Consult your system’s documentation or the UEFI specification for precise details regarding the names and configurations of these options.

​
Enable USB Boot option

  • Dynamic boot configuration. Enabling USB boot introduces dynamic changes to PCR[1] as the TPM records information related to the boot process. The addition or removal of USB boot options directly influences the PCR[1] value.
  • Extended measurements. The TPM extends measurements during the boot process to incorporate USB boot-related details when this option is enabled. PCR[1] reflects these extended measurements, providing a comprehensive view of the boot configuration.

​
Fast Boot option

  • Streamlined boot process. Fast Boot is designed to expedite system boot times by bypassing certain non-essential initialization steps. PCR[1] might be altered as a result of the streamlined boot process, with potential differences in recorded values compared to a standard boot.
  • Reduced measurements. The streamlined nature of Fast Boot might lead to fewer measurements being extended into PCR[1], affecting the overall contents of PCR[1]. This alteration is a consequence of skipping certain checks during the boot process.

​
Boot order and other BIOS settings

Any change to the BIOS boot order (including inserting or removing a bootable device such as a USB drive) is one of the most common causes of PCR[1] changes. Other BIOS settings that can affect PCR[1] include:
  • Secure Boot configuration.
  • CPU microcode updates.
  • SMBIOS table changes.
  • OEM-specific firmware settings.
Refer to the UEFI Forum’s specification index, which links to UEFI and related TCG specifications, for detailed PCR usage definitions.

​
Operational Guidance

Because PCR[1] is sensitive to boot configuration changes, evaluate your hardware and BIOS settings before deploying nodes at scale. Provide guidance to site teams on how to configure the BIOS consistently to avoid unexpected PCR[1] mismatches in the field. If PCR[1] on a particular platform changes between boots with no operational cause (for example, firmware that measures live CPU clock data into the SMBIOS table), you can exclude it from the vault sealing policy with the Flexible PCR Policy and from the attestation template as described in Excluded PCRs: Disk-Key Sealing vs. Attestation Template. Common situations that require updating the attestation template in Edge Infrastructure Services:
  • A USB drive was inserted or removed from the device.
  • The boot order was changed in the BIOS.
  • A firmware update was applied that changed SMBIOS or microcode data.
  • Fast Boot was enabled or disabled.

​
Next Steps

Host Platform Configuration (PCR 1) Interpretation Guide

The full list of events measured into PCR 1.

TPM PCR Index Security Implications

Reference for all PCR indexes used by EVE-OS.

Trusted Platform Module (TPM) Overview

How EVE-OS uses the TPM for hardware-anchored security.

Remote Attestation Overview

How EVE-OS validates node integrity using the TPM.