Explain measured boot versus secure boot and how a TA verifies boot integrity.

• A. Secure boot blocks untrusted code via signature checks; Measured boot records boot measurements for post-boot attestation; TA verifies measurements to assess integrity.
• B. Secure boot blocks untrusted code via signature checks; measured boot stores cryptographic keys.
• C. Measured boot blocks untrusted code; secure boot records keys.
• D. TA uses only local attestation for boot integrity.

Answer: (A)

Boot integrity relies on two complementary ideas: secure boot and measured boot. Secure boot blocks untrusted code by verifying the digital signatures of firmware and bootloaders against a trusted root key, forming a trusted start to the system. Measured boot goes further by recording a sequence of measurements—hashes of each loading component—during the boot process and storing them in a tamper-evident way (typically in a TPM’s PCRs). After boot, the Trusted Agent uses those measurements to perform post-boot attestation, checking that the recorded values match known-good baselines and, if needed, presenting an attestation report to a verifier to prove the boot was intact. This combination lets the TA assess boot integrity with verifiable evidence.

The other options don’t fit: one misstates that measured boot stores cryptographic keys; another implies measured boot itself blocks untrusted code; another claims the TA uses only local attestation, whereas remote attestation is also commonly used to prove integrity to external parties.