In remote attestation, what is typically exchanged to prove the platform state?

• A. PCR quotes or measurements.
• B. Passwords.
• C. Only public keys.
• D. Audit logs from the provider.

Answer: (A)

Remote attestation establishes trust by presenting the platform’s measured state, captured in the TPM’s PCRs, typically as a signed quote over those PCR values. The verifier uses this PCR-based quote (often including a nonce to prevent replay) to compare the actual measurements against known-good measurements for the boot sequence and software stack. This is what is exchanged to prove the state: the measurements or a PCR quote that attests to those measurements. Passwords don’t convey any hardware- or software-state information. Relying only on public keys doesn’t prove what the platform actually loaded or ran. Audit logs from the provider aren’t the cryptographic proof used in remote attestation, though they might serve as supplementary evidence.