[Python] Recreating TPM (Trusted platform module) PCR 10 from Linux IMA (Integrity Measurement...

I created a VM on google cloud platform. After creating it, I edited /etc/default/grub file by adding additional kernel command line parameters so that I would enable IMA module:

GRUB_CMDLINE_LINUX_DEFAULT="quiet splash"
GRUB_CMDLINE_LINUX="ima_policy=\"tcb|appraise_tcb\" ima_appraise=log"


After that I updated grub with sudo update-grub command and I rebooted the system. My final goal was to write a python script for recreating TPM's register 10 value which IMA module uses by default. The goal was to recreate PCR10 SHA1 and SHA256 values using the IMA log file acii_runtime_measurements, however I am only able to recreate the SHA1 value.

Link to ascii_runtime_measurements: https://gist.github.com/jovan-djukic/3575a94025836013575fc2045ba8f649

TPM PCR10 sha1 value:

$ sudo tpm2_pcrread sha1:10
sha1:
10: 0x93C1F1AA03B913EABF5365FCD774A9B55D97445F


TPM PCR10 sha256 value:

$ sudo tpm2_pcrread sha256:10
sha256:
10: 0x24D0FAA8AC356D33A47DE336BC5E9BB6304F9530FC927984853E57A62DCEC382


Python script for recreating PCR10 SHA1 value:

import hashlib

pcr10 = bytes(20)
print(pcr10.hex())

golden_value = bytes.fromhex("93C1F1AA03B913EABF5365FCD774A9B55D97445F")

with open("ascii_runtime_measurements.txt", "r") as f:
for line in f:
parts = line.split()
if len(parts) < 5:
continue
if parts[0] != "10": # Ensure it's PCR 10
continue

digest_hex = parts[1]

if ( digest_hex == "0" * 40 ):
digest_hex = "f" * 40

digest = bytes.fromhex(digest_hex)

pcr10 = hashlib.sha1(pcr10 + digest).digest()

if(pcr10.hex() == golden_value.hex()):
print("HIT")

print("PCR 10:", pcr10.hex())


Python script for recreating PCR10 SHA256 value:

import hashlib

pcr10 = bytes(32)
print(pcr10.hex())

golden_value = bytes.fromhex("24D0FAA8AC356D33A47DE336BC5E9BB6304F9530FC927984853E57A62DCEC382")

with open("ascii_runtime_measurements.txt", "r") as f:
for line in f:
parts = [item.strip() for item in line.split()]
if len(parts) < 5:
continue
if parts[0] != "10":
continue

digest_hex = parts[3].split(":")[1].strip()

if ( digest_hex == "0" * 64 ):
digest_hex = "f" * 64

digest = bytes.fromhex(digest_hex)

pcr10 = hashlib.sha256(pcr10 + digest).digest()

if(pcr10.hex() == golden_value.hex()):
print("HIT")

print("PCR 10:", pcr10.hex())


Can anyone explain to me why the algorithm works for SHA1 value, but not for SHA256 value?

Continue reading...