google / google/go-attestation

Failed to replay PCR9 for event log verification on AMD fTPM

Open
#498 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
444
Forks
109
PR merge metrics
No merged PRs in 30d

Description

I tried the self test:

```
❯ sudo ./attest-tool self-test
FAIL
Error: state attestation failed: event log failed to verify: event log failed to verify: the following registers failed to replay: [9]
```

```
❯ sudo ./attest-tool info
Interface: 1
VendorInfo: 414d44
Manufacturer: AMD
```

I assume there must be another workaround for PCR9 on this platform, how can I help adding it?

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the failure with `sudo ./attest-tool self-test` on the reported AMD fTPM and use `sudo ./attest-tool info` to confirm the platform. Trace the event-log verification path for PCR9 and compare its replay behavior with the reported failure. Done means the self-test can verify the event log on this platform, with coverage for the relevant case.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.