CyArt Academy
Unlock ProSign in

Remote attestation: proving what is running

How a machine proves to someone else what it booted: TPM quotes, nonces, event log replay, the IETF RATS roles, device attestation in zero trust, and how build provenance borrows the idea.

🔒 PROLesson·14 min read·Advanced → Staff
remote attestationTPM quoteRATS RFC 9334device attestationKeylimeSLSA provenance

01The attestation flow, step by step

✓What you will learn
  • Walk through a TPM quote from nonce to verdict
  • Explain why the verifier replays the event log instead of trusting PCR values alone
  • Map a real system onto the RATS roles: attester, verifier, relying party
  • Use device attestation as a zero trust signal without overselling it
  • Separate hardware attestation from SLSA provenance attestations and know the limits of both

Remote attestation is a machine proving to a remote party what software it is running, using evidence signed by hardware the remote party trusts. Measured boot fills the PCRs; attestation is how those PCRs leave the box in a form nobody can forge.

  1. Challenge: the verifier sends a fresh random nonce (say 32 bytes). Without it, an attacker could replay a quote captured from the machine when it was healthy.
  2. Quote: the attester asks its TPM for TPM2_Quote over a PCR selection, with the nonce as qualifyingData. The TPM builds a TPMS_ATTEST structure (magic TPM_GENERATED, PCR digest, nonce, clock, firmware version) and signs it with the AK.
  3. Evidence: the attester sends the quote, the signature, the AK certificate and the TCG event log (the list of every measurement extended into each PCR).
  4. Verify signature and key: the verifier checks the AK is bound to a genuine TPM (AK certificate from a CA that did credential activation against a trusted EK certificate) and the signature is valid.
  5. Check freshness: the nonce in the quote must be the one just issued and not yet used.
  6. Replay the log: recompute each PCR by extending the logged digests in order, and check the result matches the PCR digest in the quote. A log that does not replay to the quoted values is a lie.
  7. Appraise: compare the log entries against reference values (known-good boot manager hashes, Secure Boot enabled, no debug mode, dbx up to date) and produce an attestation result: pass, fail, or a set of claims.
A TPM quote by hand with tpm2-toolsbash
# Attester: quote PCRs 0,2,4,7 over a verifier-supplied nonce
tpm2_quote -c ak.ctx -l sha256:0,2,4,7 -q "$NONCE_HEX" \
  -m quote.msg -s quote.sig -o quote.pcrs -g sha256

# Verifier: check signature, nonce and PCR digest against the AK public key
tpm2_checkquote -u ak.pub -m quote.msg -s quote.sig \
  -f quote.pcrs -g sha256 -q "$NONCE_HEX"
◎Interview radar

The trap question is "why not just send the PCR values?" Because PCR values alone are opaque hashes: you cannot tell which of a million possible boot paths produced them. The event log tells you what was measured; the quote proves the log is honest. You need both.

This is an advanced module

Hardware roots of trust & confidential computing is part of the Pro pass. 3 more sections — the deep dives, the final design, follow-ups and the test — unlock with it.

Enter access codeSee Pro pass

Already a cyart.io or studio.cyart.io member? Your pass code is in your Studio account.

Related lessons