What it is
Every attested certificate issuance goes through three cryptographic checks. Together they prove the device’s firmware state, its hardware identity, and that the certificate key is bound to that hardware:1. Is the device in a good state?
A TPM Quote over PCRs, signed by the Attestation Key, is compared against the golden reference values in your attestation policy.
2. Is this the TPM we expect?
Credential Activation binds the AK to the manufacturer-issued Endorsement Key certificate. TigerTrust chain-checks the EK against the trusted TPM manufacturer root store.
3. Is the certificate key really in this TPM?
A TPM2_Certify of the signing key by the AK, plus a byte-for-byte match between the CSR public key and the attested TPM public area, proves the key cannot be elsewhere.
- Skip proof 1: an attacker with stolen credentials can request certificates from any machine.
- Skip proof 2: an attacker sends a self-generated AK and the quote is meaningless.
- Skip proof 3: an attacker gets a valid attestation from a real TPM, then substitutes their own key into the CSR.
When to use it
- Require hardware-bound certificates for IoT edge gateways and sensors.
- Ensure that certificates issued to fleet devices cannot be cloned to unauthorized hardware.
- Build a compliance record showing that every certificate’s private key is TPM-resident.
- Gate device certificate renewal on firmware state — renewed certificates are only issued to devices with expected PCR values.
Per-issuance flow
Agent requests a challenge nonce
The device agent calls TigerTrust for a fresh nonce tied to the device and the intended certificate.
Agent produces the evidence bundle inside the TPM
The agent reads PCR values, produces a signed TPM Quote over those PCRs using the Attestation Key, and runs TPM2_Certify to prove the signing key is resident in the same TPM. It also generates a CSR using that signing key.
Agent submits everything to TigerTrust
The nonce, PCR values, quote, certify info, bound public area, EK certificate, and CSR are sent together.
TigerTrust verifies every check
The verifier confirms the AK signature on the quote, nonce freshness, PCR digest binding, PCR value match against policy, key binding (certify + bound public area + CSR key match), and EK certificate chain to the manufacturer trust store.
Failure reason codes
| Failure code | Meaning |
|---|---|
quote_verify: AK signature invalid | AK did not sign the quoted TPM structure |
quote_verify: nonce mismatch | Replay attack or agent bug |
quote_verify: pcr digest does not match claimed PCR values | Agent provided incorrect PCR contents |
pcr_missing:<n> | Required PCR not included in the quote |
pcr_mismatch:<n> | PCR value differs from the policy expectation |
secure_boot_not_measured | PCR7 is zero or absent |
certify_verify: certify name digest does not match bound public area | Bound key does not correspond to the attested key |
certify_verify: bound public key modulus/exponent does not match | Attempted CSR-key substitution attack |
ek_chain: ... | EK certificate fails to chain to a trusted manufacturer root |
ek_manufacturer_not_allowed:<mfr> | EK signed by a manufacturer not in the policy allow-list |
nonce_expired / nonce_already_used / nonce_device_mismatch | Freshness violation |
pcr_mismatch fleet-wide after an unexpected firmware update.
Related
TPM enrollment
The one-time Credential Activation flow that binds an AK to a device.
TPM policies
Golden PCRs, required PCRs, EK allow-lists — the actual gating rules.
IoT devices
Device inventory, groups, and attestation history.