Manage PCR Templates

Updated

Introduction

Platform Configuration Registers (PCRs) are tamper-evident registers inside a device’s Trusted Platform Module (TPM) that record measurements of firmware, bootloader, and OS components as they load during startup. Each register holds a hash value representing the state of a specific layer of the boot chain. If any component is modified, the corresponding PCR value changes.

A PCR template is a named set of expected PCR values that you associate with a hardware model. During remote attestation (the process by which Edge Infrastructure Services verifies a device’s boot integrity before trusting it), EVE-OS (Edge Virtualization Engine) reports cryptographic proof of the freshness and authenticity of the PCR values to Edge Infrastructure Services, and then Edge Infrastructure Services compares them against the template. If the values match, attestation succeeds and the edge node is trusted. If they do not match, Edge Infrastructure Services does not release the key that unlocks the vault, and the device is flagged as untrusted.

PCR templates are attached to hardware models in your enterprise library. 

Prerequisites

  • You have the SysManager or SysAdmin role in your enterprise. Users without this role can view templates but cannot make changes.

  • To update EVE-OS on edge nodes that use PCR templates, first obtain expected PCR values, boot a known-good reference device and retrieve the values from the TPM using your standard tooling. Update your PCR templates before upgrading to ensure seamless vault unlocking after the upgrade and maintain your security posture. To obtain the values after decie is onboarded, using the following command : 
     

    eve enter vtpm
    tpm2 pcrread sha256

A Hardware Model Can Have Multiple PCR Templates

A single hardware model can have more than one PCR template for the same EVE-OS image version. This is expected and often necessary.

PCR values do not depend on the EVE-OS version alone. They also reflect the device firmware (BIOS) version and its boot configuration. Two devices of the same hardware model running the same EVE-OS version can still report different PCR values if they use different BIOS versions or BIOS settings (for example, boot order, USB boot, or Fast Boot). See Factors Affecting PCR[1] for the settings that change these values. 

To cover every legitimate variant in your fleet, you attach one template per known-good combination of EVE-OS image version and firmware version. This is why the Add PCR Template dialog asks you to select both an EVE-OS image version and a firmware version.

Is there a hierarchy?

No. PCR templates are not ranked and are not applied in a priority order. Edge Infrastructure Services treats the templates configured for a hardware model and EVE-OS image version as a set of allowed known-good states. During attestation, it compares the device’s reported PCR values against that set, and the device passes if the values match any one template. Attestation fails only when the reported values match none of the configured templates. When a match succeeds, Edge Infrastructure Services releases the key that unlocks the device vault.

Attestation Operations using UI

After you log in to ZEDEDA Infrastructure Services, you can manage PCR templates from the following locations:
  • Edge Nodes > YOUR_EDGE_NODE > Status tab > Attestation section 
  • Marketplace > Model > YOUR_MODEL > Attestation tab 
You can perform the following operations related to the PCR template and its values.
 

Create PCR Template

These steps show how to create a template from the Marketplace. 

  1. Navigate to Marketplace > Model > YOUR_MODEL > Attestation tab.
  2. Click Add PCR Template.  
  3. Click the Click here link to pre-fill the template using the values from the edge node. 
    • The link is active only during the first-time configuration of a PCR template for onboarded devices.
    • After you have filled the PCR values, keep only the PCRs you need and delete the remaining.
  4. Select a Name, EVE-OS image version, and Firmware version accordingly.
  5. Click Add.

View PCR Template

The attestation policy can be read from the following section.

Edge Nodes Details View

These steps show how to view PCR values from the edge node. 

  1. Navigate to Edge Nodes > YOUR_EDGE_NODE > Status tab.
  2. Scroll to the Attestation section.
  3. Click the Show Reported PCR Values link to see the reported values.
    Note: Starting with the ZEDEDA platform Release 7.3.0, a new attestation state 'Passed – No Attestation Enforced' is added. This state is appropriately seen under the Edge Node details page's attestation section.
  4. (Optional) Copy the values if you need them, for example if you want to use them for an update.
    Note: Copy the relevant PCR values common for all model devices into the template.
    Warning: Copying all the PCR values is not advised.
  5. A toast message is displayed.

Enforce PCR Template

From the project list view, the edge node attestation can be enforced as shown in the following steps.
  1. Navigate to Administration > Projects > YOUR_PROJECT.
  2. Click the edit (pencil) icon.
  3. Click the checkbox to select the Edge Node Policy to enforce edge node attestation & propagation of configuration changes to the edge node.
  4. Click the expand (⌄) icon on the policy to configure the project policy details. 
  5. Click Save.
You can now see that the edge node attestation is enforced for that particular project.
 

Update PCR Template

Step 1 > Click on the expand (⌄) icon to display the particular EVE-OS image PCR template.

Step 2 > Click on the edit (pencil) icon to edit or update the PCR template.

Step 3 > Pre-fill the template values with the copied values.

Step 4 > Click on the 'Save' button.

The selected PCR template is updated.

 

Delete PCR Template

You can delete the EVE-OS image versions using the following steps:
  1. Navigate to Edge Nodes > YOUR_EDGE_NODE > Status tab.
  2. Scroll to the Attestation section.
  3. Click the link to Configure a PCR Template.
  4. Select the EVE-OS image version that needs to be deleted.
  5. Click the ellipsis (...) icon.
  6. From the dropdown, select Delete.
  7. Click Delete to confirm.
 

Next Steps

This is a series of articles, you will likely follow them in this order: 

Was this article helpful?
3 out of 4 found this helpful