measured boot
also: trusted boot, trusted launch, secure measured boot
A security process that records cryptographic measurements of firmware, bootloader, and kernel components in a Trusted Platform Module (TPM) before they execute, allowing verification that a system hasn't been tampered with during startup.
Measured boot extends the chain of trust from the system firmware upward by having each boot component measure the next component before executing it. These measurements are stored as hash values in TPM Platform Configuration Registers (PCRs), creating an immutable record of what ran during boot.
This enables remote attestation, where a system can prove to a remote server that it booted cleanly without rootkits or firmware modifications. If any component was altered, the PCR values will differ from expected values.
Example: A laptop's UEFI firmware measures the bootloader into PCR[0], the bootloader measures the kernel into PCR[1], and so on. A cloud provider can then verify these PCR values match known-good baselines before allowing the system to access sensitive resources.
Measured boot is a foundation for technologies like Secure Boot, systemd-boot, and trusted boot solutions in enterprise environments, working alongside encryption keys stored in the TPM.