Lab 01 — TPM-Style Remote Attestation Verifier

Difficulty: 5/5 | Runs locally: yes, standard library only

Pairs with the Phase 13 WARMUP Chapters 3–5 (verified vs measured boot, the TPM and PCRs, remote attestation) and the HITCHHIKERS-GUIDE. Flagship of the phase.

Why This Lab Exists (Purpose & Goal)

Zero-trust device fleets, confidential-computing key release, and hardware-backed disk encryption all rest on one capability: a device can prove, freshly and cryptographically, that it booted genuine, unmodified, approved software on real hardware — before you trust it with secrets or network access. That capability is remote attestation, and this lab makes you build the verifier that decides whether to believe a device. You implement the full TPM-style chain: the one-way PCR extend, event-log replay, the signed quote, nonce anti-replay, and golden-value comparison.

The Concept, In the Weeds

Measured boot records what booted: each stage hashes the next and extends it into a Platform Configuration Register before running it —

\[ \text{PCR}{\text{new}} = H(\text{PCR}{\text{old}} ,|, \text{measurement}) \]

This extend is one-way and append-only, so the final PCR is an unforgeable, un-rollback-able fingerprint of the exact sequence of components that booted. The firmware keeps a plaintext event log; a verifier replays it from zero and confirms it reproduces the live PCRs (a log that doesn't is lying). To attest, the device returns a quote — the selected PCRs plus a verifier-issued nonce, signed by an Attestation Key rooted in the TPM. The relying party makes a four-part decision (this is attest()):

the AK is trusted (chains to a genuine manufacturer Endorsement Key);
the signature is valid (unforgeable — only that TPM could produce it);
the nonce matches (fresh — defeats replay of a captured good quote);
the PCRs match golden values and the event log replays to them.

Why This Matters for Protecting the Company

Trusting a device because it is "on the corporate network" is the failure model behind countless breaches. Attestation replaces network location with cryptographic proof of integrity, so a compromised or counterfeit device is denied secrets and access even if it is physically on the wire. This is the foundation of BeyondCorp-style zero trust, of confidential computing (a KMS only unwraps a key for an attested enclave), and of the hardware assurance that FedRAMP High / DoD IL5 require. When you can build and reason about an attestation verifier, you can design fleets and services whose integrity is provable to customers, not merely asserted.

Secure Implementation Patterns

The anti-pattern. Trust a device's self-report, or accept a quote without a fresh challenge:

if device.says_it_is_healthy: release_key()      # a rooted device lies
verify(quote)                                     # no nonce -> a captured GOOD quote replays forever

The secure pattern — the four-check relying-party decision (mirrors solution.py):

def attest(events, quote, *, golden_pcrs, expected_nonce, trusted_aks):
    reasons = []
    if quote.ak_pubkey not in trusted_aks:                         # 1. genuine, trusted TPM key
        return False, ("untrusted-attestation-key",)
    if not ak_verify(quote.ak_pubkey, quote.pcr_digest + quote.nonce, quote.signature):
        reasons.append("forged-quote-signature")                  # 2. unforgeable
    if not hmac.compare_digest(quote.nonce, expected_nonce):
        reasons.append("nonce-mismatch-replay")                   # 3. FRESH, not a replay
    pcrs = replay_event_log(events)                                # reconstruct from the log
    if not hmac.compare_digest(pcr_digest(pcrs, quote.selection), quote.pcr_digest):
        reasons.append("event-log-quote-mismatch")                # the log must match the signed PCRs
    for i in sorted(quote.selection):
        if golden_pcrs.get(i) != pcrs[i]:
            reasons.append(f"pcr{i}-unexpected-measurement")      # 4. matches APPROVED boot
    return (not reasons), tuple(reasons)

def pcr_extend(current_hex, measurement_hex):                      # one-way, append-only
    return hashlib.sha256(bytes.fromhex(current_hex) + bytes.fromhex(measurement_hex)).hexdigest()

The real-world equivalent (Phase 13 HITCHHIKERS): tpm2_quote on the device, tpm2_checkquote + event-log replay + golden comparison on the verifier; gate key release / fleet admission on the result.

Production practices to carry forward:

Always include a fresh nonce — freshness is what separates "this device is healthy now" from a replayed recording.
Derive golden values from your approved build, version them with firmware, and accept {old, new} during a rollout; treat an unexpected PCR as a finding triaged via the event log.
Chain the AK to a manufacturer EK so a software-emulated "TPM" can't pass.
Gate secrets/network on attestation, not location — the zero-trust device model.

Validation — What You Should Be Able to Do Now

Explain the PCR extend and why it makes the boot fingerprint unforgeable and un-rollback-able.
Walk a full attestation exchange and say what each of the four checks defends.
Detect a tampered firmware measurement, a replayed quote, a forged quote, an untrusted AK, and a dishonest event log.
Explain why measured boot is evidence, not enforcement.

The Broader Perspective

This lab is the hardware instantiation of a pattern you have seen throughout the curriculum: deny-by-default, prove-don't-assume, freshness against replay. The nonce is the OIDC state/ nonce (Phase 02) and the FedRAMP scan-freshness clock (Phase 15) in silicon; the golden-value match is the SLSA provenance policy (Phase 14) for boot. Attestation is the root of all zero-trust: every other "prove your identity/integrity before I trust you" decision ultimately wants to be anchored here. Mastering it lets you design systems whose trustworthiness is measurable from the silicon up.

Interview Q&A

"How does remote attestation prove a device's integrity, and why the nonce?" — The TPM signs a quote over the PCRs + a verifier nonce with an AK chained to the manufacturer EK; the verifier checks trusted AK, valid signature, matching nonce, and PCRs == golden (with the event log replaying to them). The nonce guarantees freshness — without it an attacker replays one captured good quote from a now-compromised device.
"What can attestation not prove?" — That the device wasn't compromised after boot (needs runtime attestation), and anything not measured into the PCRs; it's only as strong as the golden values and the AK trust chain.

Extension (Stretch)

Drive a real attestation with tpm2-tools on owned hardware (tpm2_quote/tpm2_checkquote), replay the binary_bios_measurements event log, and integrate with Keylime; add PCR-policy sealing (release a secret only when PCRs match).

References

TCG TPM 2.0 spec; PC Client Platform Firmware Profile (PCR/event-log); Keylime; go-attestation.
Phase 13 WARMUP Chapters 3–5.

Security Engineer