Re: [PATCH RFC 00/20] attestation: Add a common subsystem and TDX support

[James Bottomley]

On Wed, 2026-10-21 at 11:35 -0300, Jason Gunthorpe wrote:
> Maybe we can build a multiplexed scheme on the spare? I don't know.

Direct sharing of PCRs is certainly possible, but not in all
circumstances. To share a log, each logging entity must record entries
in such a way that the relying party can disentangle them with absolute
certainty.  The problem with the latter is that both the TCG and the
IMA log format have unmeasured (or advisory) log entries.  You can fool
a relying party trying to disentangle a combined log simply by
converting the advisory entry of one logging entity to being the
advisory entry of another and bingo, it disappears from the other log.

There are certainly ways around the problem by doing indirect sharing
(where the real PCR logs measured capsule entries for each virtual PCR
including the virtual PCR entry) but there are no standards for
attesting, or quoting, such a log.  Even if you look at our gold
standard for virtual PCRs: vTPMs, their quotes are only reliable if you
trust the entity provisioning and running the vTPM.  The closest we
come to having an autonomously attested vTPM is the SVSM-vTPM in SEV-
SNP which can give an attestation of the ephemeral EK tied to the
launch measurement of the enclave.

Regards,

James