Manage PCR Templates

Platform Configuration Registers (PCRs) are tamper-evident registers inside a device’s Trusted Platform Module (TPM) that record measurements of firmware, bootloader, and OS components as they load during startup. Each register holds a hash value representing the state of a specific layer of the boot chain. If any component is modified, the corresponding PCR value changes. A PCR template is a named set of expected PCR values that you associate with a hardware model. During remote attestation (the process by which Edge Infrastructure Services verifies a device’s boot integrity before trusting it), EVE-OS (Edge Virtualization Engine) reads the live PCR values from the device TPM and compares them against the template. If the values match, attestation succeeds and the node is trusted. If they do not match, Edge Infrastructure Services flags the device as untrusted. PCR templates are attached to hardware models in your enterprise library. ZEDEDA-managed catalog models do not support PCR templates directly; you must first import the model into your library.

​

Prerequisites

• Your enterprise must have at least one hardware model in My Library (origin: Imported or Local).
• You have the SysManager or SysAdmin role in your enterprise. See Manage Roles. Users without this role can view templates but cannot make changes.
• To obtain expected PCR values, boot a known-good reference device and retrieve the values from the TPM using your standard tooling.

​

View PCR Templates

1. In the sidebar, select Marketplace.
2. Select My Library.
3. Select the Hardware filter tab.
4. Select a hardware model to open its detail page.
5. Select the Attestation tab.

The PCR Templates tab header shows a count badge with the number of templates configured for the hardware model. The table lists each template with the following columns: Use the gear icon in the table row to edit a template, and the trash icon to delete it. If no templates have been configured, the tab displays: “No PCR templates configured — Add a PCR template to configure model attestation values.”

​

Add a PCR Template

1. Navigate to the Attestation tab of a hardware model in My Library.
2. Select Add Template.
3. Complete the fields in the dialog:

   Field	Description
   Name	A descriptive name for the template. Required.
   EVE-OS Image Version	The EVE-OS release this template applies to. Select a version from the dropdown. Required.
   Firmware Version	The firmware version of the reference device. Optional.

4. In the PCR Values table, enter the expected hash value for each PCR index you want to validate. The table contains 24 rows (Index 0 through 23). Leave a row empty to skip validation for that index.
   For a reference of what each PCR index measures and the security implications of a mismatch, see TPM PCR Index Security Implications.
5. Select Save.

The new template appears in the PCR Templates table and is immediately active for attestation checks on nodes using this hardware model. You can also reach this form prepopulated from a node. See Node Details.

​

Edit a PCR Template

1. Navigate to the Attestation tab of a hardware model in My Library.
2. In the PCR Templates table, select the gear icon for the template you want to edit.
3. Update the Name, EVE-OS Image Version, Firmware Version, or any PCR values.
4. Select Save.

Changes take effect for subsequent attestation checks.

​

Delete a PCR Template

1. Navigate to the Attestation tab of a hardware model in My Library.
2. In the PCR Templates table, select the trash icon for the template you want to remove.
3. In the confirmation dialog, select Delete.

Deleting a PCR template removes it permanently. Nodes that were previously validated against the template will require a new matching template to pass attestation on their next check.

​

Next Steps