PCR-20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 PCR-21: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 PCR-22: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 PCR-23: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Note that AEM will fail to unseal secrets as the PCRs are changed. To re-seal the secret you will have to perform the following steps after a successful boot with TrenchBoot: Re-seal the secret sudo anti-evil-maid-seal "". Reboot the machine and notice that the anti-evil-maid service no longer fails during boot. The secret should be displayed on the screen, indicating the machine boots correctly and unseals the secret. Summary It has been shown that TrenchBoot can be integrated to perform DRTM secure launch of Qubes OS in place of old tboot. Moreover, TrenchBoot is more extensible to other platforms like AMD. In the future, Anti Evil Maid will be available on both Intel and AMD platforms with both TPM 1.2 and TPM 2.0, thanks to TrenchBoot (which seemed to not be possible with tboot only). If you think we can help in improving the security of your firmware or you are looking for someone who can boost your product by leveraging advanced features of used hardware platform, feel free to book a call with us (calendly.com/3mdeb/c…-meeting) or drop us email to contact3mdebcom. If you are interested in similar content, feel free to sign up to our newsletter (newsletter.3mdeb.com/subscri…W6XnCeK6)