> ## Documentation Index > Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL. > Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other. > Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking. > Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify. # TPM PCR Index Security Implications > A reference table of all TPM Platform Configuration Register (PCR) indexes, their usage in EVE-OS, and the security implications of each. ## Introduction TPM Platform Configuration Registers (PCRs) record cryptographic measurements of every component involved in the boot process. The following tables provide detailed usage, classification, and security implications of various Trusted Platform Module (TPM) Platform Configuration Registers (PCRs) defined across different Trusted Computing Group (TCG specifications). These specifications are drawn primarily from TCG PC Client Platform Firmware Profile (PFP), coreboot, and Grub2. In the TCG PFP specification for PCRs 0–7, a general guideline applies: even-numbered PCRs measure code; odd-numbered PCRs measure data or configuration. For background on how EVE-OS uses PCRs, see [Trusted Platform Module (TPM) Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/eve-os/tpm-overview.md). ## Firmware PCR Index Map (PCRs 0–7) These PCRs are measured by the platform firmware before EVE-OS takes control. EVE-OS relies on them for its vault sealing policy but does not directly measure into them. | PCR Index | Usage | Type | Security Implication | | - | - | - | - | | **0** | Static Root of Trust for Measurement (SRTM), BIOS, Host Platform Extensions, Embedded Option ROMs, and PI Drivers. Includes PEI, DXE, and SMM code in flash FV. | Code (Core Firmware) | Establishes the foundational integrity of the platform. A failure here means the starting point of trust is compromised. | | **1** | Host Platform Configuration. OEM configuration data including SMBIOS tables, Setup variables, `Boot####`/`BootOrder` variables, and CPU microcode. See [PCR 1 Interpretation Guide](https://zededa.mintlify.site/new-ui/infrastructure-services/eve-os/pcr1-interpretation-guide.md). | Configuration/Data | Verifies the integrity of static manufacturer-provided configuration settings, including boot order and hardware initialization data. | | **2** | UEFI driver and application code. Drivers loaded from HBAs, disks, external Option ROMs, or non-host firmware updateable by an entity other than the OEM. | Code (Third-party Drivers) | Tracks the integrity of user- or vendor-added executable components, such as PCIe card Option ROMs. | | **3** | UEFI driver and application configuration and data. Configuration data associated with PCR 2 components, such as SCSI configuration or non-host platform configuration. | Configuration/Data (Third-party) | Measures configuration for optional hardware components, for example RAID arrays. | | **4** | UEFI Boot Manager code (usually the MBR) and boot attempts. Includes the OS Loader and UEFI applications. Shim also measures UEFI applications (for example, `second_stage`, `MOK_MANAGER`) here. | Code (OS/Boot Transition) | Records the chain of execution leading to the OS, verifying the intended boot manager and OS loader are executed. | | **5** | Boot Manager code configuration and data, GPT/Partition Table. Records the `ExitBootServices` action. EVE-OS does **not** use PCR 5 for vault sealing because the GPT changes on every A/B base image update. | Configuration/Data (OS Boot Config) | Verifies static OS boot configuration, particularly the GPT integrity. Still included in the attestation quote. | | **6** | Host Platform Manufacturer Specific. Reserved for OEM-defined measurements. | Code (Manufacturer Specific) | Provides an index for OEM-specific measurements. Content is not uniform across platforms. | | **7** | Secure Boot Policy and Verification Authority. Includes UEFI Secure Boot variables (PK, KEK, db, dbx) and security feature disabling events. Shim uses PCR 7 for UEFI variables and verification policy authority. | Policy/Configuration (Security Policy) | Protects the integrity of the secure boot enforcement mechanism and cryptographic keys that determine what code is trusted to load. | ## EVE-OS PCR Index Map (PCRs 8–14) These PCRs are in the EVE-OS default vault sealing policy and in the attestation quote. PCRs 8, 9, 13, and 14 receive measurements from the EVE-OS bootloader (GRUB). PCRs 10, 11, and 12 are not written by EVE-OS itself, but they are still sealed and quoted so that any firmware or platform component that does measure into them is covered. | PCR Index | Usage | Type | Security Implication | | - | - | - | - | | **8** | GRUB command line: all executed commands, kernel command line, module command line. | Configuration/Data (GRUB command strings) | Ensures the OS is loaded using expected, non-malicious command line arguments. | | **9** | Files: any file read by GRUB (file binary content). | Code/Binary (File content) | Ensures the integrity of OS files accessed by the bootloader. | | **10** | Reserved by the TCG PFP for the OS loader or platform-specific use. EVE-OS does not measure into this index directly. | Platform-dependent | Included in sealing and quoting so that any unexpected platform measurement here is detected. On most platforms this value stays at its reset state. | | **11** | Reserved by the TCG PFP for the OS loader or platform-specific use. EVE-OS does not measure into this index directly. | Platform-dependent | Included in sealing and quoting so that any unexpected platform measurement here is detected. On most platforms this value stays at its reset state. | | **12** | Reserved by the TCG PFP for the OS loader or platform-specific use. EVE-OS does not measure into this index directly. | Platform-dependent | Included in sealing and quoting so that any unexpected platform measurement here is detected. On most platforms this value stays at its reset state. | | **13** | Used by EVE-OS bootloader (GRUB) to measure the booting read-only root filesystem image. Skipped for installer images. | Code (rootfs image binary) | Integrity of the operating system. Ensures core OS components, libraries, and binaries have not been modified. A mismatch indicates the core OS is unauthorized or compromised. | | **14** | Used by EVE-OS to measure the content of the `/config` partition. | Configuration (EVE-OS policies) | Integrity of core OS policies and operational state. Ensures critical configuration files have not been altered prior to runtime. | ## PCR Indexes Outside the Default Sealing Policy | PCR Index | Notes | | - | - | | **5** | GPT partition table and boot manager configuration. Quoted during attestation but excluded from sealing because EVE-OS itself rewrites the GPT on every A/B base image update. Cannot be added to a sealing policy. | | **15** | Reserved for OS or user-defined measurements. Quoted during attestation but not in the default sealing policy. Can be added to a sealing policy if your platform measures into it. | | **16** | Debug. Not intended for production use, sealing, or attestation. Resettable from any locality. Outside the 0–15 range EVE-OS seals or quotes. | | **17–22** | Dynamic Root of Trust for Measurement (DRTM). Not used by EVE-OS. | | **23** | Application support. Not used by EVE-OS. | ## How PCR Chaining Works PCRs act similarly to a blockchain ledger. Each new measurement is cryptographically linked to the previous state: ```text theme={"dark"} PCR(new) = HASH(PCR(old) || HASH(Data)) ``` The order of measurements matters. Any tampering or deviation in the measurement sequence produces a final PCR digest that will not match the expected state, triggering a security failure for applications such as the EVE-OS vault that are sealed to those values. ## References * TCG Trusted Boot Chain in EDK II. * TCG Trusted Attestation Protocol (TAP) Information Model for TPM Families 1.2 and 2.0 and DICE Family 1.0. * TCG PC Client Platform Firmware Profile Version 1.06 Revision 52. * Trusted Platform Module 2.0 Library, Part 1, Version 1.84. * Trusted Platform Module 2.0 Library, Part 2, Version 1.84. * Trusted Platform Module 2.0 Library, Part 3, Version 1.84. * Measured boot implementation in EVE-OS. ## Next Steps > [card] [Trusted Platform Module (TPM) Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/eve-os/tpm-overview.md) > > How EVE-OS uses the TPM for hardware-anchored security. > [card] [Host Platform Configuration (PCR 1) Interpretation Guide](https://zededa.mintlify.site/new-ui/infrastructure-services/eve-os/pcr1-interpretation-guide.md) > > Understand and interpret PCR 1 values for remote attestation. > [card] [Remote Attestation Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/eve-os/remote-attestation.md) > > How EVE-OS validates node integrity using the TPM.