TPM_VERIFYQUOTE(8)

💖 NAME 💖

tpm_verifyquote — bestie, this is the one that checks a TPM quote's signature and tells you if it's actually real ✨

🎀 SYNOPSIS 🎀

tpm_verifyquote [-hv] PUBKEY-FILE HASH-FILE NONCE-FILE [QUOTE-FILE]

🦋 DESCRIPTION 🦋

Okay so picture this: a TPM quote happened, a signature came out of it, and now somebody has to be the responsible friend who double-checks it. That's this program. 🌸

It verifies the signature that a TPM quote produced, and it'll find that quote in the file QUOTE-FILE — or, if you didn't hand it a QUOTE-FILE at all, it just reads the quote straight from standard input instead. No biggie. 💅

Then there's the supporting cast, and every single one of them matters:

• PUBKEY-FILE — this holds the public key that gets used to validate the signature. 🔑
• HASH-FILE — this holds the signed data, and here's the thing: that data was generated using the same key and the same Platform Configuration Registers that were used to generate the quote. Gotta match, fr fr.
• NONCE-FILE — this one holds the nonce that was used to generate the quote. One-time use, very main character, very exclusive. ⭐

And like, the part you cannot sleep on — the genuinely critical bit — is that the signed data includes the PCR composite hash, which is what lets you validate that the PCRs actually contain their expected values. So if that composite hash lines up, your PCRs are who they say they are. If it doesn't… 😭 you're gonna want to know that.

👑 Do not skip the HASH-FILE and do not skip the NONCE-FILE. Those aren't garnish, they're the whole point.

Now, the flags — there are exactly two, and they're the chill ones:

• -h — displays command usage info. Basically "how do I use this again?" 🙈
• -v — displays command version info. Basically "which version of this are we even running?" ✨

🌈 SEE ALSO 🌈

• tpm_quote_tools(8)
• tpm_mkaik(8)
• tpm_getpcrhash(8)
• tpm_getquote(8)

and that's the whole page, bestie, you ate it up 🫶 This lil icon of a manpage is from the Verify TPM Quote manual, version/date Oct 2010 — old enough to be vintage, still valid enough to verify your quotes. Periodt. 💖 🎀 🦋