--- title: Remote Attestation | daily.dev description: Remote attestation using TPMs allows organizations to cryptographically verify the exact boot state of every host in their fleet. By chaining measurements... canonical: https://daily.dev/posts/remote-attestation-ruafpolza twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Remote Attestation | daily.dev og:description: Remote attestation using TPMs allows organizations to cryptographically verify the exact boot state of every host in their fleet. By chaining measurements... og:url: https://daily.dev/posts/remote-attestation-ruafpolza og:image: https://api.daily.dev/og/posts/rUafpolZA.png og:image:alt: Remote Attestation og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Remote Attestation **[Hacker News](https://daily.dev/sources/hn)** · 8 min read · 0 upvotes · 0 comments ## Summary Remote attestation using TPMs allows organizations to cryptographically verify the exact boot state of every host in their fleet. By chaining measurements through PCRs (Platform Configuration Registers), each phase of boot measures the next, making it impossible to tamper with firmware, kernel, or init images without breaking the chain. The post explains the full key hierarchy: Endorsement Key (EK) proving TPM legitimacy, Attestation Key (AK) for signing TPM quotes, and LDevID for node identity. Practical outcomes include rejecting unattested hosts from mTLS-based networks, TPM-sealed root filesystems that become inoperable on bad boots, and schedulers that demand cryptographic proof before running workloads. The post also covers upgrade challenges with TPM sealing and the TPM2_PolicyAuthorize mechanism for authorizing new PCR values. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [A TPM-based combined remote attestation method for confidential computing](https://daily.dev/posts/a-tpm-based-combined-remote-attestation-method-for-confidential-computing-emqjmwgy7) · CNCF · 0 upvotes · 0 comments - [Your organization cannot meet the new NSA Zero Trust Implementation Guidelines. Here's how to do it.](https://daily.dev/posts/your-organization-cannot-meet-the-new-nsa-zero-trust-implementation-guidelines-here-s-how-to-do-it--n7swcrljn) · Smallstep · 0 upvotes · 0 comments - [Embedded TPM: Watch Out\!](https://daily.dev/posts/embedded-tpm-watch-out--qmcnrgicw) · Hackaday · 0 upvotes · 0 comments - [ACME device attestation, smallstep and pkcs11: attezt](https://daily.dev/posts/acme-device-attestation-smallstep-and-pkcs11-attezt-plykdqsyv) · Lobsters · 0 upvotes · 0 comments - [After Mythos: Identity Has to Anchor in Hardware](https://daily.dev/posts/after-mythos-identity-has-to-anchor-in-hardware-cc1hwkqsf) · Smallstep · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/remote-attestation-ruafpolza) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Remote Attestation","url":"https://daily.dev/posts/remote-attestation-ruafpolza","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/remote-attestation-ruafpolza"},"datePublished":"2026-07-09T07:50:02.818Z","dateModified":"2026-07-09T07:53:14.818Z","description":"Remote attestation using TPMs allows organizations to cryptographically verify the exact boot state of every host in their fleet. By chaining measurements...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/93c52ae2542704e801fa84541ffeac6c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/93c52ae2542704e801fa84541ffeac6c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/remote-attestation-ruafpolza","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Remote Attestation"}]} ```