The first talk?

> Your SSH client being able to verify the server is running the BIOS the hardware provided, the same OS you installed from the available list of hardware provider approved choices, etc. is somewhat terrifying. For if your SSH client can do it, then so much more powerful (though, not all-powerful) entities can.

Maybe they can, but the TPM doesn't give them anything they didn't have before.

It is true that after boot the TPM can uniquely identify the software that is running. However the TPM doesn't magically "gather" this information. It is gathered by the software as it boots (CPU Boot code, BIOS, Boot Loader, kernel, ...) and given to the TPM as a series of hashes (SHA-1 for TPM 1.2) for each lump of code loaded. So there is no "new" information being created here - anyone with access to the system can run SHA-1 and come to the same result.

And in this case at least, if they have access to the TPM then they have access to entire system so they could do it themselves. This is because the TPM is no different to any other local device in that no one outside of the system access it any more than they can access the disk drives or clock. *I* can certainly choose to give someone access to the information in the TPM and that information could be used to verify whatever I want to let them verify regarding the software running, but this is no different to say me choosing to provide access to some of the content on my disk drives via a web server. But as it happens I don't have to provide any external access to the TPM for this ssh magic to work, so no new potential channels that might leak information need be created.

My SSH client verifies the host is unchanged by verifying the host key just as it does now, whatever information that host key reveals about my system is unchanged by the presence of the TPM. The only difference is the host key is "sealed" by the TPM, which effectively means it is encrypted by the TPM and the TPM will refuse to decrypt it if the software (BIOS, Boot loader, kernel, ssh daemon, and whatever else you think might be important) changes. It doesn't do that by "knowing" what the right software is. It does that by verifying the hashes it was given through the boot process match the hashes you gave it when you asked it to seal the ssh host key.