How Does a TPM Store Keys and Measure Boot Integrity?

A Trusted Platform Module is a dedicated hardware security chip that protects cryptographic keys and verifies system integrity during startup. By isolating sensitive operations from the main processor and recording cryptographic measurements of each boot stage, it establishes a hardware-backed root of trust that defends against software tampering and unauthorized access.

Hardware Architecture and Root of Trust

A Trusted Platform Module (TPM) is a microcontroller designed to perform cryptographic operations in a physically isolated environment. Unlike software-based security mechanisms that run in system memory alongside the operating system, a TPM has its own internal processor, volatile memory, and non-volatile storage. This physical separation ensures that even if the main operating system is compromised, attackers cannot directly read the secrets stored inside the chip.

The TPM relies on three fundamental roots of trust:

  • Root of Trust for Measurement (RTM): The initial code, typically part of the system firmware (BIOS or UEFI), that begins measuring the boot environment before passing control to subsequent components.
  • Root of Trust for Storage (RTS): The internal hierarchy of cryptographic keys and protected storage mechanisms that safeguard data and keys outside the TPM.
  • Root of Trust for Reporting (RTR): The ability to sign and attest to the integrity measurements recorded during boot, proving the system state to remote verifiers.

Secure Cryptographic Key Storage

A TPM does not store every cryptographic key in its limited internal non-volatile memory. Instead, it uses a hierarchical key model rooted in a permanent, hardware-bound secret.

Endorsement Key and Storage Root Key

Every TPM is manufactured with a unique, immutable Endorsement Key (EK) embedded in its hardware. The private portion of the EK never leaves the TPM. From this foundation, the TPM derives or protects a Storage Root Key (SRK), which serves as the parent key for the storage hierarchy.

Key Wrapping and Sealing

Because internal TPM memory is small, user keys and application keys are often stored on the host system's hard drive in an encrypted form known as a wrapped key. When a key is created, the TPM encrypts (wraps) the private portion of the new key using the SRK or another parent key in the hierarchy.

  • Unwrapping: To use a wrapped key, the operating system loads the encrypted blob back into the TPM. The TPM decrypts it internally using the parent key, performs the requested cryptographic operation (such as signing or decryption), and never exposes the plaintext private key to system memory.
  • Sealing: A TPM can also bind a key or secret to specific platform states. Sealing encrypts data so that the TPM will only release it if the system's current integrity measurements match the expected values recorded when the data was sealed.

Measuring Boot Integrity

Measuring boot integrity, often called Measured Boot, ensures that every component loaded during startup is recorded before it executes.

Platform Configuration Registers

Inside the TPM are specialized memory locations called Platform Configuration Registers (PCRs). PCRs cannot be written to directly with arbitrary values. Instead, they are updated exclusively through a cryptographic extend operation.

When a boot component (such as firmware, a bootloader, or an operating system kernel) is about to run, the previous component computes a cryptographic hash \(h = H(\text{component})\) using a standard algorithm like SHA-256. It then sends this hash to the TPM, which updates the target PCR using the formula:

\[\text{PCR}_{\text{new}} = H(\text{PCR}_{\text{old}} \parallel h)\]

Here, \(\parallel\) denotes concatenation. Because cryptographic hash functions are one-way and collision-resistant, a PCR value cannot be forged or rolled back to a previous state without resetting the entire system.

Chain of Trust

The measurement process forms a sequential chain:

  1. Firmware Initialization: The RTM measures the core firmware and extends the result into early PCRs.
  2. Bootloader: The firmware measures the bootloader before executing it, extending the hash into a designated PCR.
  3. Operating System: The bootloader measures the OS kernel and critical drivers, recording them in subsequent PCRs.

If any component is modified by malware or unauthorized configuration changes, its hash changes, resulting in a completely different final PCR value.

Attestation and Verification

Recording measurements is only useful if those measurements can be verified. The TPM supports Remote Attestation, allowing a system to prove its boot state to an external server or network.

During attestation, the TPM uses an Attestation Identity Key (AIK)—a specialized signing key certified by the EK—to sign the current PCR values along with a cryptographic nonce provided by the verifier to prevent replay attacks. The verifier compares the signed PCR values against known-good reference values. If they match, the verifier can trust that the system booted into an authentic, untampered state.