TPMSpy: Validation of Measured Boot Systems by Low-Level Tracing of TPM Usage
Researchers present TPMSpy, a platform-agnostic method validating TPM Measured Boot via low-level tracing, finding inconsistent Linux systemd measurements that break remote attestation and LUKS decryption.
An arXiv paper (2609.05011) introduces TPMSpy, a method that analyzes virtualized system–TPM interactions to independently reconstruct and validate TPM Event Logs without relying on the quoting mechanism, applicable to open and closed systems and demonstrated on Linux and Windows. A longitudinal analysis of Linux systems running systemd versions 245–258 (2020–2025) found wide divergence in Measured Boot usage, undocumented behavioral changes, and no common usage pattern. The authors report inconsistent measurement of user-space systemd services, which prevents reliable remote attestation and LUKS disk decryption on affected systems.