S
P
E
C
I
F
I
C
A
T
I
O
N

TCG PC Client Platform
Firmware Integrity
Measurement
Specification
Version
1.0 Revision 43
Family 2.0
May 7, 2021

Contact:admin@trustedcomputinggroup.org

PUBLISHEDTCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED© TCG 2021

TCG PC Client Platform Firmware Integrity Measurement Specification

DISCLAIMERS, NOTICES, AND LICENSE TERMS
THIS SPECIFICATION IS PROVIDED “AS IS” WITH NO WARRANTIES WHATSOEVER, INCLUDING ANYWARRANTY OF MERCHANTABILITY, NONINFRINGEMENT, FITNESS FOR ANY PARTICULAR PURPOSE, OR
ANY WARRANTY OTHERWISE ARISING OUT OF ANY PROPOSAL, SPECIFICATION OR SAMPLE.
Without limitation, TCG disclaims all liability, including liability for infringement of any proprietary rights, relating to useof information in this specification and to the implementation of this specification, and TCG disclaims all liability forcost of procurement of substitute goods or services, lost profits, loss of use, loss of data or any incidental,
consequential, direct, indirect, or special damages, whether under contract, tort, warranty or otherwise, arising in any
way out of use or reliance upon this specification or any information herein.
This document is copyrighted by Trusted Computing Group (TCG), and no license, express or implied, is granted
herein other than as follows: You may not copy or reproduce the document or distribute it to others without written
permission from TCG, except that you may freely do so for the purposes of (a) examining or implementing TCG
specifications or (b) developing, testing, or promoting information technology standards and best practices, so longas you distribute the document with these disclaimers, notices, and license terms.
Contact the Trusted Computing Group at www.trustedcomputinggroup.org for information on specification licensing
through membership agreements.
Any marks and brands contained herein are the property of their respective owners.

TCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED Page 1 © TCG 2021

TCG PC Client Platform Firmware Integrity Measurement Specification

Acknowledgements
The writing of a specification, particularly a security specification, takes many hours for both development and review.
The TCG would like to acknowledge the contribution of those individuals (listed below) and the companies who allowed
them to volunteer their time to the development of this specification. Special thanks are due to Amy C Nelson andRonald Aigner, who served as Chairs of the PC Client Working Group during the development of this specification.
The TCG would also like to give special thanks to Amy C Nelson who served as the editor of this specification.

Contributors
Dean Liberty, Advanced Micro Devices, Inc.
Gongyuan Zhuang, Advanced Micro Devices, Inc.
Thomas Peng, Advanced Micro Devices, Inc.
Frederick Otumfuor, American Megatrends, Inc.
Stuart Yoder, ARM Ltd.
Dr. David Challener
Amy C Nelson, Dell, Inc.
Monty Wiseman, General Electric Company
Alphan Ulusoy, Google, Inc.
Ludovic Jacquin, Hewlett Packard Enterprise
Shiva Dasari, Hewlett Packard Enterprise
Jeff Jeansonne, HP Inc.
Joshua Schiffman, HP Inc.
Mengliang Zhang, Huawei Technologies Co., Ltd.
Silvia Vlasceanu, Huawei Technologies, Co., Ltd.
Ken Goldman, IBM
Nayna Jain, IBM
David Riss, Intel Corporation
Jiewen Yao, Intel Corporation
Joe Pennisi
Robert Hart, Johns Hopkins University, Applied Physics Lab
Bill Keown, Lenovo (US) Inc.
Masoud Manoo, Lenovo (US) Inc.
Ronald Aigner, Microsoft
Vijay Pandrangi, Microsoft
Dick Wilkins, Phoenix Technologies Ltd.
Michael Mattioli, The Goldman Sachs Group, Inc.
Joseph Chen, ULINK Technology Inc.
Andrew Regenscheid, United States Government
Lawrence Reinert, United States Government

TCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED Page 2 © TCG 2021

TCG PC Client Platform Firmware Integrity Measurement Specification

CONTENTSDISCLAIMERS, NOTICES, AND LICENSE TERMS ................................................................................................... 1
Acknowledgements ..................................................................................................................................................... 2
1

SCOPE………………………………………………………………………………………………………………...…….4
1.1 Key Words ................................................................................................................................................... 4
1.2 Statement Type ............................................................................................................................................ 42

Background.......................................................................................................................................................... 5
2.1 Platform Firmware Integrity Measurement Scenarios .................................................................................. 5
2.2 Platform Firmware Integrity Measurement Flow ........................................................................................... 6

3

FIM Functional Components ................................................................................................................................ 9
3.1 Roots of Trust (RoTs) ................................................................................................................................... 9
3.1.1 Overview of Software Agents .............................................................................................................. 9
3.1.2 Overview of Roots of Trust................................................................................................................ 10
3.1.3 Agent Coordination ........................................................................................................................... 10
3.1.4 Platform Compliance with FIM .......................................................................................................... 11
3.2 Platform Measurement and Assertion Baselines........................................................................................ 11
3.2.1 Definitions of Terms .......................................................................................................................... 12
3.2.2 Platform Certificate ........................................................................................................................... 12
3.2.3 Platform Firmware Integrity Measurements ...................................................................................... 18
3.2.4 Platform Firmware Reference Integrity Manifest ............................................................................... 18
3.3 Platform Firmware Integrity Reporting ........................................................................................................ 18
3.3.1 Attestation Client ............................................................................................................................... 18
3.3.2 Endpoint Reports .............................................................................................................................. 19
3.4 Platform Firmware Integrity Measurement Collection and Transmission ................................................... 19
3.4.1 Overview of Measurement Collection and Transmission .................................................................. 19
3.5 Verifier ........................................................................................................................................................ 19
3.5.1 Overview ........................................................................................................................................... 19

4

Normative References ....................................................................................................................................... 20

TCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED Page 3 © TCG 2021

TCG PC Client Platform Firmware Integrity Measurement Specification

1 SCOPE
This document describes the requirements for a PC Client Endpoint in an enterprise computing environment
complying with SP 800-155 BIOS Integrity Measurements. This document tailors optional requirements in TCG
specifications such as the TCG PC Client Platform Firmware Profile for TPM 2.0 Systems [1] and the TCG Platform
Certificate Profile Specification [3]. Compliance with other TCG specifications may be necessary for a full enterprisesolution.

1.1 Key Words
The key words “MUST,” “MUST NOT,” “REQUIRED,” “SHALL,” “SHALL NOT,” “SHOULD,” “SHOULD NOT,”“RECOMMENDED,” “MAY,” and “OPTIONAL” in this document normative statements are to be interpreted as
described in RFC-2119, Key words for use in RFCs to Indicate Requirement Levels.

1.2 Statement Type
Please note a very important distinction between different sections of text throughout this document. There are two
distinctive kinds of text: informative comment and normative statements. Because most of the text in this specification
will be of the kind normative statements, the authors have informally defined it as the default and, as such, havespecifically called out text of the kind informative comment. They have done this by flagging the beginning and end ofeach informative comment and highlighting its text in gray. This means that unless text is specifically marked as of
the kind informative comment, it can be considered a kind of normative statements.

EXAMPLE: Start of informative comment
This is the first paragraph of 1–n paragraphs containing text of the kind informative comment ...
This is the second paragraph of text of the kind informative comment ...
This is the nth paragraph of text of the kind informative comment ...
To understand the TCG specification the user must read the specification. (This use of MUST does not require any
action).
End of informative comment

TCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED Page 4 © TCG 2021

TCG PC Client Platform Firmware Integrity Measurement Specification

2 BackgroundStart of informative comment
Endpoint computers, desktops and laptops for instance, contain hardware, firmware, drivers, operating endpoints andapplication software that affect the integrity and security of the devices and the network within which they reside. For
a network administrator, knowing the current posture of endpoints in their network can be a frustrating exercise. There
are multiple problems at play: 1) are newly deployed machines built and configured as required? and 2) what is theongoing status of machines in the environment over the course of the lifetime of those machines? The PC Client
Firmware Integrity Measurement Specification (FIM) provides a framework for determining the configuration of the
hardware and what firmware has been run to initialize the endpoint in a booted state. This specification works inconjunction with other TCG specifications to provide a complete solution for verification of the platforms in anenterprise environment and forms the basis for trust decisions based on that verification.
Endpoint computers rely on platform OEM provided and 3rd party provided firmware to initialize and boot to a usable
state. The firmware is stored in non-volatile memory and can be updated using utilities provided by the platform OEM.
Some 3rd party provided firmware can be updated via utilities provided by the 3rd party, e.g. hard drive firmware
updates. The firmware which runs during platform initialization and boot is measured and stored in the TPM, according
to the TCG PC Client Platform Firmware Profile for TPM 2.0 Systems [1]. These measurements provide the foundation
for FIM but are an insufficient basis for a trust decision. These measurements tell a Network Administrator, or Verifier,what is currently running. What the Verifier also needs to know is what is supposed to be running. How does a
Verifier relate the current state to the required state? Reference Integrity Measurements, as specified in the TCG
Reference Integrity Manifest Specification (RIM) [4] are the set of measurements that reflect a baseline, or golden,
set of measurements against which a comparison can be made.
The FIM and RIM reflect the firmware which runs on an endpoint computer, but configuration also affects endpoint
integrity and security. How does a Verifier know that any particular endpoint is properly configured?
Functionality and devices currently enabled in an endpoint computer are captured in FIM and RIM, but this is a subsetof what a Verifier would like to know about an endpoint computer. What configuration changes can be made to thedevice to improve the security posture? What are the inherent attributes of the endpoint computer that allow a Verifier
to better trust that endpoint? This information is not available in FIM, so it must be captured elsewhere. The Platform
Certificate, defined in the TCG Platform Certificate Specification [3], captures this information.
A platform OEM can provide a set of RIMs and a Platform Certificate to a Verifier for an endpoint delivered to the
Verifier that allows the Verifier to establish a baseline for that computer. The scenarios enabled by this set of integrity
and attribute information are detailed below.
End of informative comment

2.1 Platform Firmware Integrity Measurement Scenarios
Start of informative comment
The following scenarios are informative and describe the sequence of events that allow a Verifier to establish abaseline for trust in an endpoint computer.
End of informative comment
1. Verification that an endpoint computer received by a customer matches what the customer ordered:a. A customer places an order for a computer with a specific configuration of hardware and firmware.
b. The platform OEM builds the computer, generates the RIM, and ships the computer to the customer.
c. The platform OEM provides the customer with the RIM.
d. The customer receives the computer, collects the FIM and compares it to the RIM.
e. The customer compares the current Platform configuration to the RIM.
f. Using the information determined from steps d and e, the customer determines that the platform has
been delivered without modification and establishes a baseline.
2. [Optional Case when a Platform Certificate is provided] Verification that an endpoint computer received by acustomer matches what the customer ordered:
TCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED Page 5 © TCG 2021

TCG PC Client Platform Firmware Integrity Measurement Specification

a. A customer places an order for a computer with a specific configuration of hardware and firmware.
b. The platform OEM builds the computer, generates the RIM and the Platform Certificate, and ships
the computer to the customer.
c. The platform OEM provides the customer with the RIM and Platform Certificate.
d. The customer receives the computer, collects the FIM and compares it to the RIM.
e. The customer compares the current Platform configuration to the Platform Certificate and the RIM.
f. Using the information determined from steps d and e, the customer determines that the platform has
been delivered without modification and establishes a baseline.
3. Verification that an endpoint computer is correctly configured to connect to a network
a. An administrator configures an endpoint computer to match the baseline security configuration
based on the capabilities described in the Platform Certificate and delivers the computer to an end
user.
b. The end user boots the endpoint and attempts to connect to the network.
c. The network gatekeeper collects the FIM and Endorsement Key Certificate for the endpointcomputer’s TPM.
d. The network gatekeeper compares the FIM to the RIM and the Platform Certificate for that platform,
as identified by the EK Cert, and makes a decision that the platform is properly configured.
e. The endpoint computer is permitted to access the network.
4. Quarantine of an incorrectly configured endpoint computer.
a. An administrator configures an endpoint computer to match the baseline security configuration anddelivers the computer to an end user.
b. The end user boots the endpoint and modifies the configuration by turning off a security feature, e.g.
Secure Boot, and attempts to connect to the network.
c. The network gatekeeper collects the FIM and the EK Certificate for the endpoint computer’s TPM.
d. The network gatekeeper compares the FIM to the RIM and the Platform Certificate for that platform,
as identified by the EK Certificate and determines the security configuration has been modified fromthe baseline.
e. The endpoint computer is quarantined from the network and remedial action is required to accessthe network.

2.2 Platform Firmware Integrity Measurement Flow
Start of informative comment
As a platform boots, each code module is measured by the previous code module prior to receiving control of hostcomputing resources. The chain starts at the S-CRTM and ends with the transition to the OS bootloader. The
sequence and set of required measurements are defined in the TCG PC Client Platform Firmware Profile for TPM 2.0
Endpoints (PFP) [1]. Each measurement is created and extended into a TPM PCR. An event describing thatmeasurement is recorded in an event log maintained by platform firmware through the end of the transition to the OSbootloader. When the OS bootloader gains control of the execution flow, it requests the event log from platform
firmware and may make a copy of the event log within which the bootloader adds records of measurements it makes.
The behavior of the bootloader is not specified by TCG. The call to request the event log is specified by TCG, butmaintenance of the event log by an OS is not specified. Due to the potential for measurements to be made andrecorded in the event log maintained by platform firmware between the call to retrieve the event log and delivery to
the OS bootloader, the PFP [1] defines a secondary log available in memory which contains copies of events
measured and recorded following the request for the log. OS bootloaders may retrieve this copy of the event log after
EFI boot services drivers are unloaded and can use this copy to ensure they have a record of all measurements madeto the TPM by platform firmware. This process is informatively illustrated in Figure 1 Overview of the Measurement
Process.

TCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED Page 6 © TCG 2021

TCG PC Client Platform Firmware Integrity Measurement Specification

Figure 1 Overview of the Measurement Process

A platform manufacturer produces a RIM and signs it, as specified in the TCG Reference Integrity Manifest Information
Model [4], which reflects the set of measurements made when the platform is configured as when the platform
manufacturer ships the endpoint. This RIM may be stored in the endpoint or may be delivered asynchronously. If a
RIM exists, the platform manufacturer is expected to record a non-measured event in the event log which identifies
the presence of the RIM with a GUID that can be matched to the RIM.
The event, using the
TCG_SP800_155_PlatformId_Event2, is specified in the PFP [1].
Verification of the RIM signature confirms to a verifier that the RIM is indeed produced by the platform manufacturer.
Once the RIM signature is verified, the values contained in the RIM can be stored in a database used for verificationof platform measurements. The RIM and the TCG_SP800_155_PlatformId_Event2 element in the event log containthe same set of attributes that can be used to verify that the RIM and the Event log come from the same endpoint withthe same version of the firmware.
A Verifier compares an event log with the RIM attributes and then can parse the event log to extract the digests fromthe TCG_PCR_Event2 structure, defined in the PFP [1], for the PCR of interest. The event log is not inherently trusted
until the PCR values are verified against the digests contained in the event log. These digests and the sequence
thereof can be used to reconstruct the final value of the PCR. This final digest value can be compared to the actual
PCR value by obtaining a Trusted Attestation Protocol (TAP) [5] report which maintains the integrity of the log using
TPM signatures. Further, the Verifier can compare the verified log digest values to those expected in the RIM. If
nothing has been modified, the digests will match. If a mismatch occurs, the Verifier should decide that the endpointneeds to be remediated.
A Platform Certificate can be used to provide another layer of verification. The Platform Certificate contains a signed
set of assertions and configuration in addition to the attributes which are replicated in the RIM and the
TCG_SP800_155_PlatformId_Event2 element. The Platform Certificate reflects the state of the endpoint as it wasshipped to a customer. The ongoing maintenance of the endpoint, including updates to the platform firmware, isreflected only in the RIM. This additional layer is used to definitively associate the RIM and the endpoint through theinclusion in the Certificate of the endpoint’s TPM Endorsement Key Certificate serial number, the BIOS revision, and
the GUID of the RIM. The configuration elements contained in the Platform Certificate may additionally be captured
as measurements in TPM PCRs, providing another set of cross-references for a verifier between the measurements
made of the platform configuration on any given boot, the RIM, and the Platform Certificate.

TCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED Page 7 © TCG 2021

TCG PC Client Platform Firmware Integrity Measurement Specification

End of informative comment

TCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED Page 8 © TCG 2021

TCG PC Client Platform Firmware Integrity Measurement Specification

3 FIM Functional Components
Start of informative comment
Multiple components are necessary to provide a complete FIM solution. Many of these components are documented
in other TCG specifications and are referenced informatively in this specification.
The following sections provide a description and associated requirement guidelines for the FIM functional
components:- Section 3.1 addresses Roots of Trust (RoTs) and the endpoint requirements for compliance with this specification.
- Section 3.2 defines firmware integrity attributes, firmware capabilities and requirements for Platform Certificates fora PC Client platform; references the PC Client Platform Firmware Profile [1] and the TCG Platform Certificate Profile
Specification [3].
- Section 3.3 informatively describes integrity reporting as specified in the TCG Trusted Attestation Protocol
Information Model for TPM Families 1.2 and 2.0 and DICE Family 1.0 [5].
- Section 3.4 informatively describes the collection and transmission of FIMs to the Verifier, as specified the TCG
Trusted Attestation Protocol Information Model for TPM Families 1.2 and 2.0 and DICE Family 1.0 [5].
- Section 3.5 informatively describes the Verifier itself.
End of informative comment

3.1 Roots of Trust (RoTs)
Start of informative comment
Roots of Trust (RoTs) are the foundation of any platform firmware integrity assurance. As defined in the TCG Glossary,“RoTs are components that perform one or more security specific functions, such as measurement, storage, andreporting…. A RoT is trusted always to behave in the expected manner because its misbehavior cannot be detected(such as by measurement) by attestation or by observation.” RoTs form the basis for firmware integrity measurements
as defined in [1]. The RoTs and integrity measurements provide a record of the boot such that a Verifier can reliably
determine what code ran on any given platform. Without the RoTs, a Verifier has no way to determine that the recordof the boot is valid.
The trustworthiness of Software Agents that leverage one or more RoTs is dependent on the trustworthiness of the
RoT itself and its attack surface. In a PC Client platform, the minimum set of RoTs comprises the Root of Trust for
Measurement (RTM), the Root of Trust for Reporting (RTR) and the Root of Trust for Storage (RTS). The RTR and
RTS are instantiated in the Trusted Platform Module (TPM).
The chain of trust starts at host platform reset. From the reset vector, the hardware is initialized, and firmware begins
measuring code and extending it to the TPM Platform Configuration Registers (PCRs). The measurements containedin the TPM PCRs and the description of the measurements contained in the Event Log represent the platform bootprocess from reset through the OS Boot Manager code. Some platforms may instantiate the measurement process
in a hardware element, e.g. the S-HCRTM or a DRTM. These elements provide an additional layer of assurance.
End of informative comment

3.1.1 Overview of Software Agents
Start of informative comment
FIM requires coordination of the RTM and the Chain of Trust to perform measurements on an endpoint, a TPM toprotect the measurements from modification until they can be reported, and a Reference Integrity Manifest (RIM) forcomparison with the measurements of any individual boot process. A software agent, the Attestation Client, may be
used to collect the measurements from the TPM and the record of the event logs. The information collected by theAttestation Client would minimally include the event log, the PCR quote results, and possibly a certificate for thesigning key used to sign the quote. In some cases, the certificate for the signing key might be provided as part of an
endpoint enrollment process. A comprehensive system for ensuring firmware integrity will also include some form ofverification of the collected measurements, and correspondingly a Verifier is necessary to assess reported
TCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED Page 9 © TCG 2021

TCG PC Client Platform Firmware Integrity Measurement Specification

measurements. Such Verifiers generally reside externally in the network infrastructure. In addition, if any of thecomponents of the measurement, reporting and/or verification process can be modified or updated, then thetrustworthiness of such components depends upon the mechanism used to implement updates. Updates of theplatform firmware are required to comply with NIST SP800-147. The Platform Certificate for the platform provides anassertion of the endpoint’s compliance to a signed firmware update process.
End of informative comment

3.1.2 Overview of Roots of Trust
Start of informative comment
The RoT for Measurement (RTM) is a RoT that makes the initial integrity measurement and adds it to a tamperresistant log. The RTM is the root of the chain of transitive trust for subsequent Measurement Agents. TCG specifies
two major types of RTM: Static or S-RTM and Dynamic or D-RTM. The SRTM starts measuring at platform reset andcannot be re-initialized without a subsequent platform reset. The D-RTM, if supported by the platform, may start at
any point after boot by initializing the state of the platform without requiring a reboot. In general, the D-RTM launches
after an S-RTM, but the trust-chains anchored in each RTM are independent.
TCG defines the RoT for Storage (RTS) as the combination of a RoT for Confidentiality (RTC) and a RoT for Integrity(RTI). The RTS provides for confidentiality and integrity of data stored in TPM shielded locations. In the context of
this specification, the RTS maintains a tamper-evident summary of the integrity measurement values and thesequence of those measurements. It does not include the details of the sequence of integrity measurements, butrather holds cumulative integrity results for those sequences. These cumulative integrity values can either be used toverify the integrity of a log containing the integrity measurement values and the sequence of those measurements, orit can be used as a proxy for that log.
The RoT for Reporting (RTR) is a RoT that reliably provides authenticity and non-repudiation services for the purposeof attesting to the origin and integrity of platform characteristics. It necessarily leverages the RTM and RTS. A principal
function of the RTR is to provide an unambiguous identity, statistically unique for the endpoint in the form of anAttestation Key (AK). The AK may be persistent or temporary. A typical usage of the AK in this instance involves a
TPM2_Quote of the TPM PCRs signed by the AK that may be accompanied by a certificate.
End of informative comment

3.1.3 Agent Coordination
Start of informative comment
The trustworthiness and coordination of the RoTs, trust chain, and Agents in combination gives Verifiers theconfidence to make a reliable assessment of the measured endpoint’s firmware integrity. Evaluation of the trust
properties afforded by the composite endpoint is critical, and evaluation of an individual Agent’s trust properties is only
relevant in the context of the entire system.
Figure 2 informatively illustrates that the RoTs must act in concert to enable reliable and trustworthy measurement,
reporting, and verification of FIMs. In addition, these RoTs must be combined in an endpoint that contains mechanisms
for secure platform firmware updates, among other security functions.
End of informative comment

TCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED Page 10 © TCG 2021

TCG PC Client Platform Firmware Integrity Measurement Specification

Figure 2 Verification of Measurements

3.1.4 Platform Compliance with FIM
1. The platform manufacturer SHALL provide an endpoint that complies with the TCG PC Client Platform
Firmware Profile (PFP) [1] and includes a TPM compliant with the TCG PC Client Platform TPM Profile (PTP)[2].
2. The platform manufacturer SHALL provide integrity-protected, non-by-passable authenticated platform
firmware updates, as necessary to conform to NIST-SP800-147 and NIST-SP800-193.
3. The platform manufacturer MAY provide hardware support for a dynamic RTM for post-boot-timemeasurements.
4. The platform manufacturer SHALL provide a RIM that complies with the TCG Reference Integrity Manifest
Specification [4] and the TCG PC Client Reference Integrity Manifest Specification [6].
5. The platform manufacturer SHOULD provide a platform certificate that complies with the TCG Platform
Certificate Profile Specification [3].

3.2 Platform Measurement and Assertion Baselines
Start of informative comment
A critical factor in a meaningful integrity measurement comparison scheme is establishing and maintaining, withconfidence, a known baseline of assertions, configuration and measurements with which a Verifier can makedecisions. The establishment of a baseline must consider two scenarios: platforms with platform firmware of unknownor questionable provenance, and platforms with a known and trusted (protected and signed) firmware. This section
describes the required and optional assertions, configurations and measurements that are contained in the Platform
Certificate and RIM Bundle provided by the platform manufacturer. The Platform Certificate provided by the platform
manufacturer to a Verifier includes an unambiguous reference to the endpoint TPM EK Certificate and a GUID and
URI for obtaining the RIM.

TCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED Page 11 © TCG 2021

TCG PC Client Platform Firmware Integrity Measurement Specification

An example scenario is as follows: a platform manufacturer generates the reference measurements based on the
manufactured endpoint, complete with code and configuration, and produces a RIM and a Platform Certificate. The
platform manufacturer delivers the endpoint and the Platform Certificate to a customer, who can take a snapshot of
the PCRs prior to any configuration or firmware change. The customer can verify the snapshot against the RIM toverify no changes were made after manufacturing and prior to their receipt of the endpoint. The customer can also
verify the assertions contained in the Platform Certificate and compare them to the configuration in the snapshot. The
customer can then make any firmware and configuration changes, interrogate the PCRs and take a new snapshot toestablish their baseline. This would result in a Support RIM reflecting the customer’s baseline, as defined in the TCG
Reference Integrity Manifest Specification [4].
If a Platform Certificate is not available, a platform manufacturer has other options to provide RIM bundles. The
bundles may be installed on the platform at manufacturing in the locations defined in [6]. The bundles may be provided
via a customer support channel, such as a website. The bundles might be included as part of a platform firmware
installation package. This specification does not provide normative guidance for the ways in which a platform
manufacturer provides RIM bundles.
End of informative comment

3.2.1 Definitions of Terms
Start of informative comment
NIST SP800-155 uses different terms than those used by TCG specifications such as the TCG Platform Certificate
Profile Specification. This specification aligns terminology with other relevant TCG specifications.
End of informative comment
Table 1 Glossary

FIM Specification

Description

FirmwarePlatform Firmware used to initialize the endpoint

Platform Assertions

See TCG Platform Certificate Specification

Platform Configuration

See TCG Platform Certificate Specification

Measurement

A hash of code or configuration extended into a TPM Platform Configuration
Register

Verifier

The entity that verifies a measurement against a reference

Reference Measurement

The reference measurements provided by the platform firmware provider

3.2.2 Platform Certificate
Start of informative comment
In SP800-155, Integrity Attributes are used for assessing confidence in firmware integrity measurements. Platform
manufacturers have various ways to convey Integrity Attributes to customers. The platform manufacturer may provide
this information in a Platform Certificate to the customer in an out-of-band channel (i.e., not delivered with the endpoint
itself, but through other means). The platform manufacturer may provide a tool to the customer to query the endpointand extract the Platform Certificate from a known location. Alternatively, the platform manufacturer may allow thecustomer to present a serial number to a managed online service, which then responds with the Platform Certificate
for the platform as it was delivered. Regardless of how the customer obtains the Platform Certificate for a particular
endpoint, the purpose of the certificate is to give the customer a means of assessing the validity of the assertions andmeasurements reported by the endpoint and developing a level of confidence in the reports it receives about theoverall health status of the endpoint beyond only the firmware measurements.
End of informative comment
TCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED Page 12 © TCG 2021

TCG PC Client Platform Firmware Integrity Measurement Specification

3.2.2.1 Platform Certificate Fields
The following sections describe the mandatory and optional elements for the Platform Certificate describing a PC
Client Platform. Elements that are required in the Platform Certificate Specification [3] that do not require further
refinement or definition are not restated in the FIM. Only those elements that require definition of values or that are
optional in the Platform Certification Specification [3] that can be made mandatory are detailed below.
3.2.2.1.1 Platform Serial Number
The Platform Serial Number SHALL be reported in the Platform Certificate. The Serial Number MAY be an asset
tag, service tag, or UID, but SHALL, in combination with the other information in the Platform Certificate, uniquely
identify the Platform in the context of the platform manufacturer’s product line or model.
3.2.2.1.2 Platform Firmware Assertions
Platform Firmware assertions are defined in the Platform Certificate Profile Section 3.1 [3]. These assertions arecaptured as part of the tBBSecurityAssertions attribute. These assertions, as defined below, SHALL bereported in the Platform Certificate, as specified by the TCG Platform Certificate Profile Specification [3]. The list
below is the minimum list and is not intended to restrict platform manufacturers from including additional assertions.
1. MeasurementRootType – The valid values are defined in the Platform Certificate Profile Specification. For a
PC Client Platform, the following values are permitted, and one SHALL be present:•

static (0) - If the platform instantiates the RTM as part of the early platform firmware POST, an
SRTM (Static Root of Trust for Measurement).

•

Hardware static (6)- “S-HCRTM” if the endpoint utilizes a hardware-based root of trust formeasurement (e.g. the platform firmware PEI code is measured by the RTM).

•

dynamic (1) - “DRTM” (Dynamic Root of Trust for Measurement) if the endpoint instantiates the
RTM after the platform firmware POST.

•

hybrid (3) - Both an SRTM and DRTM are supported.

NOTE: MeasurementRootType corresponds to the SP800-155 RTM attribute.
2. TCGPlatformSpecification – This attribute contains the platform class, version and revision of theplatform-specific specification and the structure is defined in the Platform Certificate Profile Specification.
•

For a PC Client Platform:▪

platformClass SHALL be set to 0x 01 (PC Client).

▪

Version SHALL correspond to the version and revision of the PC Client Platform Firmware
Profile version and revision with which the platform firmware complies.

3. PlatformFwSignatureVerification [3] - This attribute is an indication of the method by which
Platform Firmware signatures can be verified by the platform during boot. If Platform Firmware signature
verification is not supported, this assertion SHALL NOT be present. If Platform Firmware signature verification
is supported by the platform, the element SHALL be encoded as defined with at least one of the following values
present in the structure:platformFwSignatureVerification ::= BIT STRING {HardwareSRTM (0),SecureBoot (1)}
Where the assertions are defined as:•

HardwareSRTMAn H-CRTM is present and verifies the signature of the next stage of the initial

TCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED Page 13 © TCG 2021

TCG PC Client Platform Firmware Integrity Measurement Specificationboot block (IBB).
•

SecureBoot

UEFI Secure Boot is present.

4. PlatformFirmwareUpdateCompliance [4] - This assertion provides an indication that the type of platform
firmware update mechanism employed by the vendor verifies a signature in accordance with SP 800-147 or SP
800-193. A BIOS with an unreliable or nonexistent update mechanism may be held in suspicion. If the platform
firmware cannot be updated, this assertion SHALL NOT be present. If platform firmware can be updated, thisassertion SHALL be encoded as follows and SHALL contain at least one of the following values:
platformFirmwareUpdateCompliance ::= BIT STRING {sp800-147 (0),sp800-147B (1),(This option only applies to Server platforms)

sp800-193 (2)}Where the assertions are defined as:•

sp800-147 - Update complies with SP 800-147•

sp800-147B – Update complies with SP 800-147B•

sp800-193 - Update complies with SP 800-193

Start of informative comment:
The reliability of PlatformFirmwareUpdateCompliance attribute depends on the diligence exercised by theplatform firmware provider in providing the latest update of the platform firmware code and data. The presence ofa reliable update mechanism provides the end user with assurance that the platform firmware provider can safely
remediate their products against threats should the need arise.
End of informative comment
5. firmwareCapabilities [5] - This assertion provides an indication of the security capabilities provided by
the firmware. If an individual capability is not provided it SHALL be omitted. If none of the capabilities areprovided, this assertion SHALL be omitted.
firmwareCapabilities ::= BIT STRING {fwSetupAuthLocal (0),fwSetupAuthRemote (1),
SMMProtection (2),fwKernelDMAProtection (3)}Table 2 firmwareCapabilities

propertyName (UTF8 String)

Description

fwSetupAuthLocal

The Platform supports authentication by a physically present user for
platform firmware setup.

fwSetupAuthRemote

The Platform supports authentication by a remote entity for platform
firmware setup.

SMMProtection

The platform supports a Management Mode memory protection, forexample SMM protections, provided by the chipset and supported by

TCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED Page 14 © TCG 2021

TCG PC Client Platform Firmware Integrity Measurement Specification

the platform firmware.
fwKernelDMAProtection

The platform supports firmware-based protection against DMA
attacks via DMA capable peripheral devices such as PCI-e, USB-C,
and USB-4. This capability indicates that firmware supports UEFI
settings to allow kernel drivers utilize firmware protections (e.g.
disable busmastering) and hardware protections (e.g. IOMMU)
against DMA attacks. NOTE: as this capability requires IOMMU
support, the IOMMUSupport hardware capability is also set if thiscapability is set.

6. hardwareCapabilities [6] - This assertion provides an indication of the security capabilities provided by
the platform motherboard or components physically attached to the motherboard. If an individual capability is notprovided it SHALL be omitted. If none of the capabilities are provide, this assertion SHALL be omitted.
hardwareCapabilities ::= BIT STRING {IOMMUSupport (0),trustedExecutionEnvironment (1),physicalTamperProtection (2),physicalTamperDetection (3),firmwareFlashWP (4),externalDMASupport (5)}Table 3 hardwareCapabilities

propertyName (UTF8 String)

Description

IOMMUSupport

The platform provides an IOMMU to protect the platform from DMAbased attacks

trustedExecutionEnvironment

The platform contains a Trusted Execution Environment.

physicalTamperProtection

The platform supports a method of physical tamper protection, e.g. a
chassis lock.

physicalTamperDetection

The platform supports a method of physical tamper detection, e.g. a
chassis intrusion switch

firmwareFlashWP

The platform supports firmware flash write protection, for example
provided by the chipset or flash part.

externalDMASupport

The platform includes external ports capable of DMA, e.g. USB-C orUSB4.

3.2.2.1.3 Platform Properties
Start of informative comment:
The Platform Certificate Specification [3] defines platformProperties as an element of theplatformConfiguration attribute defined in the Platform Certificate Specification [3]. The platform OEM may use
this field to populate additional assertions of interest to the verifier. These assertions should be populated as Name,
Value pairs as defined in [3].

TCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED Page 15 © TCG 2021

TCG PC Client Platform Firmware Integrity Measurement Specification

End of informative comment

3.2.2.1.4 Platform Configuration
Start of Informative Comment
The Platform Certificate Specification [3] defines the ComponentIdentifier attribute as an optional element toincorporate components of interest in the Platform Certificate. Table 4 informatively defines the components of interestin a PC Client platform. Platform manufacturers may include additional components. If they do include additional
components, they should adhere to the elements defined in normative 1 below. The componentClass values aredefined in the TCG Component Class Registry and included here for convenience of the reader. The structure of this
attribute is defined in Section 3.1.8 of the Platform Certificate Profile Specification and contains mandatory andoptional elements.
When there is a mature solution for reporting and verifying this attribute, this section will be made mandatory.
End of Informative Comment
1. This attribute SHOULD be present as defined in Section 3.1.8 of the Platform Certification Profile Specification[3] .
a. If the componentIdentifier is included, the following individual elements SHALL be present:i. componentClass, componentManufacturer, and componentModel elements, andii. If the component is field replaceable, the fieldReplaceable element SHALL be present andTRUE.
iii. If the component has a serial number, the componentSerial element SHALL be populatedwith serial number.
1. If the component does not have a serial number, the element SHALL be populated withthe string “Unknown”.
b. If the componentIdentifier is included, the componentRevision element SHOULD be present:
c. Each element SHALL be populated as individual elements and SHALL not be concatenated with otherelements.
Start of informative comment:
Table 4 PC Client Component to OID List

Component

componentClass (UINT 32)

Description

CPU

00 01 00 02

Main CPU(s) – Note PC Client
platforms may not include a CPU
Serial Number, but should include a
CPU Model

Service Processor

00 01 00 00

Embedded Controllers

Memory (DRAM)

00 06 00 04

DRAM based memory

Memory (NVRAM)

00 06 00 1B

NV DIMM based memory,

TCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED Page 16 © TCG 2021

TCG PC Client Platform Firmware Integrity Measurement Specification

Motherboard

00 03 00 03

Main motherboard

Network Controller (LAN)00 09 00 02

Ethernet adapter

Network Controller (Wifi)

00 09 00 03

Wireless network adapter

Network Controller (BT)00 09 00 04

Bluetooth network adapter

Fixed Storage (HDD)

00 07 00 05

Hard disk-based storage

Fixed Storage (SSD)

00 07 00 03

Solid State-based storage

Fixed Storage (M.2)

00 07 00 04

M.2 form factor SSD or NVME drive

Removable Battery

00 0A 00 03

A removeable battery, e.g. for anotebook platform

Chassis – Desktop

00 02 00 02

A Desktop endpoint chassis

Chassis – Notebook

00 02 00 09

A Notebook endpoint chassis

End of informative comment

3.2.2.1.5 Platform Configuration URI
Start of informative comment
The PlatformConfigUri provides the location where a Verifier can find the PC Client RIM Bundle. Note, this field
does not contain the RIM Bundle. As defined in the TCG PC Client Reference Integrity Manifest Specification [6], aplatform manufacturer may place the bundles on the endpoint in the EFI partition. If placed in the EFI partition, it isrecommended to have the RIM Bundle be available should the Verifier require it, in the event of a hard-disk failure ora disk reimage which repartitions the hard-disk.
End of informative comment

1. The PlatformConfigUri element SHALL be present as defined in Section 3.1.9 of the Platform Certification
Profile Specification.
2. If a RIM is present on the platform, the element SHALL contain the path to the file, else the element SHALL
contain the location from which a RIM can be obtained.
3.2.2.2 Optional Storage of the Platform Certificate
Start of informative comment
The Platform Certificate may be stored on the endpoint. If the certificate is stored locally, the requirements in thissection apply.
End of informative comment
1. The Platform Cert SHALL use the following naming convention: <name of the tag creator> + <product name> +<product version> + <type>.cer Where “type” is Base or Delta.
2. The Platform Cert SHALL be stored using the DER format.
3. The Platform Cert SHALL be stored in the /boot/tcg/cert/platform/ directory or the \efi \tcg\cert\platform storagepath.

TCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED Page 17 © TCG 2021

TCG PC Client Platform Firmware Integrity Measurement Specification

3.2.2.3 Verification of the Platform Certificate
Start of informative comment
Platform Certificate verification necessitates the delivery of the platform manufacturer’s Root Certificate andcomparison of the elements in the certificate against the information obtainable from the platform. Some of theelements in the Certificate provide information which can be visually inspected, such as the manufacturer and themodel or the chassis type. Some of the elements provide information which may be verified by comparison withmeasurements, such as the presence of an S-HCRTM which would be captured as a measured event in PCR 0. The
set of properties cannot be verified programmatically, unless the capabilities are enabled. In that case, they can beverified by measured events in PCR 1. If the Platform Certificate contains component information, it is possible thisinformation can only be verified via platform manufacturer provided tools.
End of informative comment

3.2.3 Platform Firmware Integrity Measurements
Start of informative comment
The PFP [1] provides a definition of the measurements a platform must perform and the format of how themeasurements are required to be reported in a TCG Event Log. The TCG TPM Library Specification defines the basic
mechanisms a TPM provides to serve as an RTS and RTR. The TCG EFI Specification defines the interface thatfirmware provides to report measurements.
The properties and components defined in Section 3.2.2 are captured as part of measurements as defined in the PFP[1].
End of informative comment
1. A PC Client Platform compliant with this specification SHALL include a TCG_Sp800_155_PlatformId_Event2
structure in the TCG Event Log. Note: This event is defined in the PFP [1].

3.2.4 Platform Firmware Reference Integrity Manifest
Start of informative comment
The TCG Reference Integrity Manifest (RIM) Information Model Specification [4] defines an information model for aset of Reference Measurements for a platform. The platform manufacturer provides a Primary RIM for the version of
firmware shipped with the platform. For subsequent versions of the platform firmware, the platform manufacturer
provides Patch RIMs. The Primary RIM provided by the platform manufacturer may be delivered with the platform in
the EFS partition as defined in the TCG PC Client Reference Integrity Manifest (PCRIM) Information Model
Specification [6]. Alternatively, the Primary RIM may be delivered out-of-band, e.g. via the platform manufacturer’s
website. Patch RIMs may be delivered as part of the firmware update utility or may be provided via the same out-ofband mechanism.
End of informative comment

3.3 Platform Firmware Integrity Reporting
Start of informative comment
Reporting the Platform Firmware integrity values stored in the RTS is performed by an Attestation Client. The formatof the information provided by the reporting agent is defined in the TCG Trusted Attestation Protocol Information Modelfor TPM Families 1.2 and 2.0 and DICE Family 1.0 [5]. The Platform Firmware Integrity values may be signed by a
TPM Attestation Key (AK) as part of a TPM2_Quote. To cryptographically verify the integrity values are linked to aplatform, the AK might be linked to the TPM Endorsement Key (EK).
End of informative comment

3.3.1 Attestation Client
Start of informative comment

TCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED Page 18 © TCG 2021

TCG PC Client Platform Firmware Integrity Measurement Specification

The Attestation Client is responsible for extracting the measurements stored in the TPM PCRs and formatting themas defined in the TAP Information Model Specification [5]. The TAP specification also defines the methods ofattestation and the TPM commands required to implement them. The methods include the concepts of freshness,
identity and time-based elements.
End of informative comment

3.3.2 Endpoint Reports
Start of informative comment
Endpoint measurement reports may be generated and sent to a Verifier under multiple conditions: 1) on connection
to a network, 2) on request of the Verifier, or 3) on request of a service. The Attestation Client might include the ability
for a user or administrator to configure triggering events for measurement reporting. Report requests may be initiatedby a user, an Attestation Client based on configuration, a Verifier or a service. Under certain circumstances, it might
be advisable for an Attestation Client to ignore requests from unauthenticated services. See the TCG Trusted
Attestation Protocol Use Cases [5].
End of informative comment

3.4 Platform Firmware Integrity Measurement Collection and Transmission
3.4.1 Overview of Measurement Collection and Transmission
Start of informative comment
Firmware Integrity Measurements are collected by a Client as a TAP Attester, then may be transmitted from theendpoint to the Verifier.
Secure transmission of Integrity Measurements ensures that measurements are not disclosed in transit by malicious
parties. Further, proper selection of transmission protocols can maximize interoperability, freshness, and efficiency.
Integrity protection and freshness is provided by TPM based signatures over TPM Platform Configuration Registers(PCRs) using one of the techniques described in the TAP [5] document. This ensures that even if the Collection Agentor other software becomes compromised, the measurements cannot be falsified.
End of informative comment

3.5 Verifier
3.5.1 Overview
Start of informative comment
The Verifier appraises the state of the client (acting as an Attester) using the contents of the RIM, which contains
information about the client from the PCR values or Event Log provided by the platform manufacturer. The Event Log
and PCR values are passed from the client (i.e., the Attestor) using the protocols specified in the TAP [5] document.
If the Event Log is used, the verifier first validates its integrity using the relevant PCR values. The Verifier appraises
the Attester using a set of policies supplied by an administrator.
End of informative comment

TCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED Page 19 © TCG 2021

TCG PC Client Platform Firmware Integrity Measurement Specification

4 Normative References
Where a normative reference is undated, the latest available versions can be used.
[1] TCG PC Client Platform Firmware Profile (PFP) for TPM 2.0 Endpoints
https://trustedcomputinggroup.org/resource/pc-client-specific-platform-firmware-profile-specification/[2] TCG PC Client Platform TPM Profile (PTP) for TPM 2.0
https://trustedcomputinggroup.org/resource/pc-client-platform-tpm-profile-ptp-specification/[3] TCG Platform Certificate Profile Specification Version 1.1 Revision 19 or later
https://trustedcomputinggroup.org/resource/tcg-platform-certificate-profile/[4] TCG Reference Integrity Manifest Information Model Specification Version 1.00 Revision 0.14 or later
https://trustedcomputinggroup.org/resource/tcg-reference-integrity-manifest-rim-information-model/[5] TCG Trusted Attestation Protocol Information Model for TPM Families 1.2 and 2.0 and DICE Family 1.0
https://trustedcomputinggroup.org/resource/tcg-tap-information-model/[6] TCG PC Client Reference Integrity Manifest Specification Version 0.14 or later
https://trustedcomputinggroup.org/resource/tcg-pc-client-reference-integrity-manifest-specification/

TCG PC Client Platform Firmware Integrity Measurement Specification | Version 1.0 Revision 43 | Family 2.0 | 5/7/2021 | PUBLISHED Page 20 © TCG 2021