Skip to content

doc: fix PCR table and stale comment #2203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tlaurion wants to merge 3 commits into
base: master
Choose a base branch
from
Open

doc: fix PCR table and stale comment #2203

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ee48f8f
doc: fix PCR table and stale comment
tlaurion Sep 7, 2026
a4c25a6
doc: remove unused PCR 16 box from security model
tlaurion Sep 8, 2026
e2ea4da
doc: remove PCR 16 references — unused since #1428
tlaurion Sep 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 0 additions & 7 deletions doc/security-model.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -409,13 +409,6 @@ creating additional hardware binding:
│ │ → Changing kernel modules or LUKS headers requires resealing DUK │ │
│ └─────────────────────────────────────────────────────────────────────┘ │
│ │
│ ┌─────────────────────────────────────────────────────────────────────┐ │
│ │ PCR 16 (Scratch) │ │
│ │ │ │
│ │ Used internally for calcfuturepcr (pre-computing future values) │ │
│ │ Not part of any sealing policy - purely for calculation │ │
│ └─────────────────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
```

Expand Down
1 change: 0 additions & 1 deletion doc/tpm.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,7 +164,6 @@ unchanged; the TXT mechanism adds the DRTM capability on top of it.
| 5 | Heads `insmod` wrapper | Each loaded kernel module: parameters + binary content (default `MODULE_PCR=5`) |
| 6 | Heads `qubes-measure-luks.sh` | LUKS header dump for each encrypted drive |
| 7 | Heads `cbfs-init.sh`, `uefi-init.sh` | Each CBFS/UEFI file: filename then content (default `CONFIG_PCR=7`) — covers `config.user`, GPG keyring, user CBFS files |
| 16 | `tpmr.sh calcfuturepcr` (scratch use only) | Resettable debug PCR used as scratch pad during pre-computation of future PCR values; not part of any sealing policy |

PCRs 0-3 are read at seal time and included in sealing policies. The zero
state of PCRs 0, 1, and 3 is intentional — any unexpected extension of those
Expand Down
6 changes: 2 additions & 4 deletions initrd/bin/kexec-seal-key.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -269,10 +269,8 @@ for dev in $key_devices; do
STATUS_OK "$dev: LUKS TPM Disk Unlock Key added to slot $duk_keyslot"
done

# Now that we have setup the new keys, measure the PCRs
# We don't care what ends up in PCR 6; we just want
# to get the /tmp/luksDump.txt file. We use PCR16
# since it should still be zero
# Now that we have setup the new keys, measure the LUKS headers into PCR 6.
# The dump goes to /tmp/luksDump.txt for calcfuturepcr to use as input.
STATUS "Measuring TPM Disk Unlock Key (DUK) for sealing policy (PCR[6])"
echo "$key_devices" | xargs /bin/qubes-measure-luks.sh ||
DIE "Unable to measure the LUKS headers"
Expand Down