What Is Measured Boot in UEFI and TPM Integration?

Measured Boot is an advanced security feature in modern Unified Extensible Firmware Interface (UEFI) systems that creates a verifiable, tamper-evident record of every component loaded during the system startup sequence. By interfacing directly with a Trusted Platform Module (TPM), Measured Boot cryptographically logs each stage of the startup process—including firmware, boot loaders, drivers, and the operating system kernel—rather than simply blocking unauthorized software. This article explains how Measured Boot functions within the UEFI environment, how it relies on the TPM's cryptographic hardware, and how the resulting metrics are utilized for system health attestation.

Understanding Measured Boot

In a traditional startup process, an attacker who compromises firmware or low-level boot components can bypass operating system security controls. Measured Boot addresses this vulnerability by applying the principle of a "Chain of Trust."

Before any executable code runs during the boot sequence, the component currently executing calculates a cryptographic hash (measurement) of the next component scheduled to execute. That hash is recorded before control is handed over. Unlike Secure Boot—which stops execution if a digital signature is invalid—Measured Boot does not halt the boot process if an unexpected component is detected. Instead, it precisely logs the exact state of what was loaded, enabling the operating system or a remote verifier to assess whether the system is trustworthy.

Integration with the Trusted Platform Module (TPM)

The measurements gathered by the UEFI firmware would be useless if an attacker could alter the log after the fact. This is where the Trusted Platform Module (TPM) integrates with the process.

The TPM is a specialized, tamper-resistant cryptographic microchip (either discrete or integrated into the CPU). It contains Platform Configuration Registers (PCRs), which are hardware-protected memory locations designated to store these boot measurements.

Integration occurs through specific mechanisms:

  1. The Extend Operation: PCRs cannot simply be overwritten with new values. Instead, they use a cryptographic "extend" operation. When a new measurement is taken, the TPM combines the current value of the PCR with the new hash, then hashes that combined value: New PCR Value = Hash(Old PCR Value + New Measurement Hash) This mathematical design ensures that the order and content of the measurements cannot be manipulated, forged, or rolled back.

  2. PCR Mapping: The UEFI specification assigns distinct aspects of the boot chain to specific PCRs (typically PCR 0 through PCR 7):

    • PCR 0: Core firmware executable code and platform settings.
    • PCR 2: UEFI drivers loaded during early initialization.
    • PCR 4: The Master Boot Record (MBR) or UEFI Boot Manager.
    • PCR 7: Secure Boot state and platform certificates.

  3. TCG Event Log: Alongside the cryptographic extend operations performed on the TPM, the UEFI firmware maintains a human- and software-readable list called the Trusted Computing Group (TCG) Event Log. This log lists the actual files and drivers that correspond to the mathematical hashes stored inside the TPM's PCRs.

How Measured Boot Data Is Used

Once the operating system finishes loading, the TPM and the TCG Event Log provide a reliable foundation for several critical security implementations:

  • Remote Attestation: A network server or device management system can challenge the client device to prove its boot integrity. The TPM signs the PCR values with a hardware-bound private key (the Attestation Identity Key), and sends the signed report and the Event Log to the server. If any unauthorized boot file or rootkit was loaded, the PCR values will not match expected baselines, and the server can deny network access.
  • Sealed Storage: Cryptographic keys—such as full-disk encryption keys used by utilities like Microsoft BitLocker or Linux Unified Key Setup (LUKS)—can be "sealed" against specific PCR values. The TPM will only unseal and release the decryption key if the current PCR values match the exact, authorized configuration of the platform. If the firmware is altered or a bootloader is replaced, the TPM refuses to release the key, leaving the drive encrypted and inaccessible.