TPM: Measured Boot, Key Sealing, and What the Chip Actually Does

A Trusted Platform Module is a small dedicated chip — or a firmware equivalent — that stores keys and records what the system loaded as it started. It does not encrypt your disk or run your applications. It holds secrets in a place software cannot read them, and it attests to the state of the machine, and everything useful follows from those two capabilities.

Platform Configuration Registers

The mechanism behind measured boot, and the concept worth understanding properly.

As the system starts, each stage measures the next before handing control to it — hashing the firmware, the boot loader, the kernel and its configuration — and extends the result into a Platform Configuration Register. Extending means the new value is combined with the existing one and the result stored, so a register accumulates a hash chain of everything measured into it.

That chain cannot be rewound or set to an arbitrary value. Software can extend a register; it cannot reset one, and the order of measurements is baked into the result. So the register values at the end of boot are a fingerprint of exactly what loaded, in what order.

This is measured boot, and it is distinct from secure boot. Secure boot prevents unsigned components from loading. Measured boot records what loaded without blocking anything. They complement each other: one enforces, the other produces evidence.

Sealing

The capability that makes measurements useful. A key can be sealed to a set of PCR values, meaning the TPM will only release it when the registers match what they were when the key was sealed.

Full disk encryption uses this. The volume key is sealed to the boot measurements, so the system boots and unlocks without a user typing anything — and if the firmware is modified, the boot loader replaced, or the drive moved to another machine, the measurements differ, the TPM refuses to release the key, and recovery credentials are required.

That is why a firmware update sometimes triggers a recovery prompt: the measurements legitimately changed. It is also why moving an encrypted drive to another computer does not work, which is the intended behaviour and the answer to the offline attack described under offline boot environments.

Attestation

Sealing proves platform state to the machine itself. Remote attestation proves it to someone else: the TPM signs a quote of the register values with a key it holds, and a remote verifier checks the signature and compares the values against what it expects.

That allows a network or a service to grant access only to devices that booted a known-good configuration — a device health check with cryptographic backing rather than an agent's self-report, and a stronger input to the policies described under conditional access.

What else it provides

A hardware random number generator, which matters because poor entropy has produced predictable keys in real deployments. Key generation and storage where the private key never leaves the chip in usable form — the property that makes a device certificate identify the device rather than a copyable file, as under certificate lifecycle. Monotonic counters and a small amount of protected non-volatile storage. And dictionary attack protection, which slows repeated authorization attempts against the chip itself.

TPM, HSM, TEE and secure element

Frequently confused, and the distinction is scope.

A TPM is bound to one platform, stores keys and platform measurements, and performs a fixed set of operations. It is not a general cryptographic accelerator and it is slow.

An HSM is a dedicated device performing cryptographic operations at volume with keys that never leave it, used for certificate authorities and payment systems.

A TEE or secure enclave runs arbitrary application code in protected memory — the model under secure enclaves — which a TPM cannot do.

A secure element is the equivalent in phones and smart cards.

Limits

A TPM protects keys from software on the host; it is not proof against a determined attacker with physical possession and laboratory equipment. Discrete TPMs communicate with the processor over a bus that has been probed to intercept keys in transit, which is why firmware TPMs integrated into the processor are in some respects better positioned — and worse in others, since they share the processor's attack surface.

And a TPM proves what loaded, not that what loaded is trustworthy. A signed, measured, attested boot chain of vulnerable software attests accurately to a vulnerable system.

Exam angles

Know the TPM as hardware storing keys and platform measurements, with PCRs accumulating hashes of each boot stage. Distinguish measured boot (records) from secure boot (prevents unsigned components loading). Know sealing as releasing a key only when platform measurements match, which is how disk encryption unlocks automatically and why hardware changes trigger recovery. Distinguish TPM from HSM, TEE and secure element by scope and purpose.