The way locking a TPM to firmware config works is that the TPM has several registers called PCRs that contain a hash value. Anything can send data to the TPM an

The way locking a TPM to firmware config works is that the TPM has several registers called PCRs that contain a hash value. Anything can send data to the TPM and have it update the hash value, and you can lock TPM keys to the PCRs such that you can only use the key when the PCRs you choose have a specific value. The TCG spec defines some of these PCRs to be sent certain information [0], but it's up to the firmware to send it, the TPM doesn't magically know what the state is. If there's even a single setting or nvram variable that you can change to gain code execution that isn't part of the data that's sent to the PCRs that the crypto key is locked to, it's game over. [0]: https://trustedcomputinggroup.org/wp-content/uploads/TCG-EFI-Platform-Specification.pdf https://trustedcomputinggroup.org/wp-content/uploads/TCG-EFI...