Which of the following is NOT true regarding PCRs in attestation?

• A. PCRs store measured values.
• B. PCRs are extended during boot and runtime events.
• C. Attestation quotes sign PCR values to prove platform state.
• D. PCRs are used to store password hashes.

Answer: (D)

Platform Configuration Registers (PCRs) in attestation hold measurements that reflect the current state of the system. They aren’t a place to stash data; they’re updated by extending with new measurements, so each PCR value becomes a rolling hash that represents the sequence of measured events from boot through runtime. This design lets a verifier check what the platform looked like at a specific moment without needing to trust the machine itself.

Because of that, PCRs store measured values (or the hashed form of those measurements) and are actively extended during boot and runtime events, building a tamper-evident log of the platform state. Attestation quotes are generated to sign the PCR values, proving to a remote party what the platform state is at the moment of the quote.

Storing password hashes in PCRs is not how the system is designed to work. PCRs are meant to reflect measurements of firmware, bootloaders, kernels, and other components, not secrets. Password hashes belong in secure storage or protected vaults and are handled by authentication mechanisms, not by PCR-based measurements.