Re: [RFC PATCH -next] ima: Make tpm hash configurable

Ken Goldman
2023-08-29T14:11:02Z

On 8/17/2023 10:19 AM, Mimi Zohar wrote:
> Before we can introduce this sort of change, we would need to introduce
> an IMA measurement list version. Perhaps its time to define an IMA
> security critical-data record, which would include this and other
> information. The measurement list itself would need to include a
> version number.

FYI, the TCG specified UEFI event log has a standard first record. The
events themselves do not have a version number.

That first record is itself versioned, so it can change over time.

The record has various version numbers, a count of PCR banks, a mapping
from algorithm number to algorithm size, and a sized vendor specific area.