Metraipolis › archive › dc_600d2df70874

TPMSpy: Validation of Measured Boot Systems by Low-Level Tracing of TPM Usage — arXiv:2609.05011

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.05011
License (as archived): CC0-1.0
Archived: 2026-10-16T22:51:18.320Z
SHA-256 of the archived text: e60c2295b077ffc0fffc245ce748e917ade77500ae3a1df5862cb6fd07593996
Stable URL of this page: https://metraipolis.com/documento/dc_600d2df70874

How to cite

TPMSpy: Validation of Measured Boot Systems by Low-Level Tracing of TPM Usage — arXiv:2609.05011 — arXiv (en), https://arxiv.org/abs/2609.05011 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_600d2df70874 (Metraipolis archive dc_600d2df70874, sha256 e60c2295b077ffc0fffc245ce748e917ade77500ae3a1df5862cb6fd07593996)

BibTeX

@misc{dc600d2df70874,
  title = {TPMSpy: Validation of Measured Boot Systems by Low-Level Tracing of TPM Usage — arXiv:2609.05011},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.05011},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_600d2df70874; sha256 e60c2295b077ffc0fffc245ce748e917ade77500ae3a1df5862cb6fd07593996},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.05011. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Measured Boot extends trust in a booted system by recording cryptographic measurements of executed software and system state into a Trusted Platform Module (TPM), enabling subsequent verification through remote attestation. Although this mechanism is increasingly deployed in contemporary operating systems, its practical security depends on whether implementations measure the expected components under the expected conditions, yet this is not checked systematically. We propose a platform-agnostic method for analysing low-level TPM usage at the level of virtualized system--TPM interactions. It enables independent reconstruction and validation of the TPM Event Log without relying on the quoting mechanism itself. Because it does not depend on implementation details, it is applicable to both open and closed systems. We demonstrate the method on both Linux and Windows and conduct a systematic longitudinal analysis of Linux systems with systemd versions 245--258 (2020--2025), examining how Measured Boot usage evolved and observing wide divergence. No single usage pattern emerged amongst systems, warranting customized analysis. The analysis identifies undocumented behavioural changes, reveals inconsistent measurements of user-space systemd services, which prevent reliable remote attestation and LUKS disk decryption on such systems.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-09-07 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR).
Pagina del lavoro: https://arxiv.org/abs/2609.05011 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-16T22:30:54.314Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-09-07?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).