Storage Root Key or PCRs?

About this interactive

The trusted platform module is a separate chip that handles cryptography and verifies the machine as it boots. It protects keys with two mechanisms, and the lesson keeps them apart. The storage root key is created inside the chip (when ownership is taken, or from the TPM's storage seed) and never leaves it; clearing the TPM replaces it. You hand the TPM a key, it wraps it with the storage root key, and you can then store the wrapped key anywhere, because only this TPM can unwrap it. That stops someone from copying a key and using it on another computer. The platform configuration registers go further. They take measurements of the machine, its firmware, boot manager and settings, into a fingerprint, and bind key release to that fingerprint. So even moving the disk and the TPM together to a new machine fails, because the new machine measures differently. The same measurements give the TPM its platform-integrity check. To sort a card, ask whether it is about wrapping a key so only this chip can read it, or about the machine's measured state deciding whether a key is released.

What you'll learn

Explain the TPM's two core protections and tell apart the storage root key, which wraps keys so they cannot be read off the chip, from the platform configuration registers, which bind key release to the machine's measured state

Aligned to

CompTIA Security+

1.4 Explain the importance of using appropriate cryptographic solutions.

Key terms

Trusted Platform Module: Trusted Platform Module is a dedicated hardware security chip embedded in devices that provides a hardware root of trust for secure boot, cryptographic key storage, and platform attestation, protecting sensitive keys from software-level compromise.
Platform Configuration Registers: Registers within the TPM that store a measurable fingerprint of system hardware and software states, used to bind encryption keys to a specific machine configuration.
Full Disk Encryption: Full Disk Encryption is a method of encrypting all data on a storage device at the hardware or software level, ensuring that data remains inaccessible if the device is lost or stolen without the proper authentication credentials or decryption key.

Topics

Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →