Measured boot

Check the machine before you hand it a secret.

Everything that boots folds into one signed digest, and the key goes out only after you check it.

  1. What loadshashed before it runs
    • Firmwarefirmware.fda pinned, reproducible build
    • Kernelvmlinuz-6.12the distro kernel, as shipped
    • Initrdinitrd.imgthe code that opens the disk
    • Cmdlinero ip=dhcpflags, keys, network setup
  2. One digestsigned by the chip
    Boot measurement

    Every byte on the left folds into this value, in order. Swap a kernel or a flag and it comes out different.

    Signed on-chipTPM 2.0 quote

  3. You verify iton a machine you own

    $ attest verify \ --host 192.0.2.10

    • the quote chains to the vendor's root
    • the digest equals your own build
    • the nonce is the one you just sent

    verdictPASS

  4. Then the keyreleased on a pass

    $ ssh unlock@192.0.2.10

    Passphrase for nvme0n1p2: ********

    Volume open. Booting.

    over SSH, never via the host

    If it fails

    Keep the key. Assume the machine is not yours.