Secure Boot vs Measured Boot: Signature Checks, TPM Measurements and Attestation Compared
Both mechanisms check the next piece of software at each boot stage, from power-on until the OS is running. Secure boot verifies the digital signature of the next stage and stops the boot if it is not properly signed. Measured boot computes a hash of the next stage and records it cumulatively in the TPM's PCRs (Platform Configuration Registers), without stopping anything. Secure boot prevents; measured boot records so the state can be checked and proven later. They are not alternatives and are often used together.
| Aspect | Secure boot | Measured boot |
|---|---|---|
| What it checks | The digital signature of the next software: whether the vendor's signature over the image hash verifies with a trusted key | The hash (measurement) of the next software: the value of what was actually loaded is recorded as is |
| When something is wrong | Stops the boot on the spot if verification fails (enforcement) | Lets the boot continue and only leaves a record (recording) |
| Root of trust | Immutable ROM boot code and the public key used for verification (often stored as its hash in eFuses to save space) | A small trusted piece of code that runs first and starts measuring, plus the TPM that holds the record |
| If software has been tampered with | The signature does not match, so it never runs; a modified bootloader or kernel cannot start | It boots anyway, but the PCR values differ from the expected ones, so checking the record reveals it later |
| What it needs | A verification public key on the device and a signing private key kept securely by the vendor; combined with anti-rollback so old versions cannot be reinstalled | TPM PCRs (which can only be extended, folding in a new measurement through a hash) and a record of each stage's measurements (the event log) |
| How the result is used | Prevents unauthorized software from starting on that device. To show others what booted, it is combined with measured boot or similar | Remote attestation (PCR values signed with a TPM key and presented to a server) and sealing (releasing secrets such as a disk-encryption key only when the PCRs hold the expected values) |
| Limits | It only tells whether code is signed by a trusted key, so it cannot tell an old but validly signed vulnerable version or a configuration change apart; it protects only the boot path | It cannot stop malicious code from running, and the record means something only when someone checks it; expected PCR values change with every software update and must be managed |
| Typical use | Smartphones, PCs and many embedded devices; shipped products also lock debug ports such as JTAG | PCs with a TPM, for disk encryption and device-health checks before network access; TPM-less microcontrollers use schemes such as DICE that derive keys from measurements for the same purpose |
Figures are typical orders of magnitude and vary by process generation and product.