BitLocker Tpm And Recovery Password tests for AOAC devices with PCR 7
All platforms that implement a TPM must ensure invariance of PCRs 7, 11 across power cycles in the absence of changes to the platform’s static core root of trust for measurements (SRTM). Attaching a (non-bootable) USB to the platform or attaching the platform to a docking station should not cause changes to the SRTM.
Note |
---|
This test restarts the system multiple times to check whether PCRs are consistent. |
Test details
Associated requirements |
Device.DevFund.Firmware.UpdateDriverPackage |
Platforms |
Windows RT (ARM-based)
|
Expected run time |
~15 minutes |
Categories |
Basic |
Type |
Automated |
Running the test
Before you run the test, complete the test setup as described in the test requirements: WDTF System Fundamentals Testing Prerequisites. Also, check that TPM is on and ready for use by running tpm.msc (the Trusted Platform Module (TPM) Management snap-in). Secure boot should be enabled.
Troubleshooting
For troubleshooting information, see Troubleshooting System Fundamentals Testing.
If this test fails, review the test log from Windows Hardware Certification Kit (Windows HCK) Studio.
-
Make sure you can see fveapi.dll in %systemroot%\system32\.
-
Check test output directly from command prompt when the test runs or open te.wtl in the HCK Manager.
-
If a test script fails, check the BitLocker status:
-
Manage-bde –status [volume]
-
Manage-bde –status [volume]
-
Collect BitLocker event logs from event viewer at two locations:
-
Filter \Windows logs\System logs by event sources started with BitLocker
- Applications and Services Logs\Microsoft\Windows\BitLocker-API\Management
-
Filter \Windows logs\System logs by event sources started with BitLocker
-
Run tpm.msc to ensure that the TPM Status is ON and that ownership has been taken.
-
Check TCG logs
-
Collect TCG log (*.txt).
-
Compare multiple copies of the TCG log and see whether PCR [0, 2, 4, 11] are consistent across reboot and hibernate.
-
Collect TCG log (*.txt).
Note |
---|
If the BitLocker WHCK test results in a recovery event, the BitLocker recovery key is 48-zeros (0000-0000-0000-0000-0000-0000-0000-0000-0000-0000-0000-0000). |