TPMHashes

TPMHashes is a term used to describe the collection of hash values produced by a Trusted Platform Module (TPM) that reflect the measured state of a computer system. These hashes arise from the TPM’s measurement process, in which components such as firmware, bootloaders, and operating system modules are hashed and extended into Platform Configuration Registers (PCRs). The resulting PCR values, often referred to as TPMHashes in documentation or tooling, summarize the integrity measurements of the boot and runtime environment.

Background and mechanics

TPMs maintain a chain of trust by extending PCRs with new measurements rather than overwriting them. Each measurement is hashed and combined with the current PCR value to produce a new PCR value, creating a tamper-evident log of the system’s state. In TPM 2.0, multiple banks and hash algorithms (for example SHA-256) can be used, and different PCRs may store measurements from different components. TPMHashes can be derived from these PCR values, and in some scenarios, a TPM quote or attestation includes the relevant hashes to prove the system state to an external verifier.

Applications

TPMHashes underpin remote attestation, secure boot verification, and integrity checks in enterprise environments. Verifiers compare the provided TPMHashes against expected values or a measured baseline to determine whether a system has remained in a trusted state. They are commonly used in combination with attestation keys and signed attestations to prove the integrity of a platform without revealing sensitive data.

Security considerations

Access to TPMHashes and attestation data should be tightly controlled, as exposure could allow replay or impersonation attacks. Privacy concerns arise when detailed measurements are disclosed; nonce challenges and selective disclosure are typical mitigations.

See also

TPM, PCR, Attestation, Remote Attestation, Secure Boot, TPM 2.0.