SHA-1 TPMs not supported with 26.04

[CYB3RCA4T]

Hello! I have a quite old but capable machine where I don't have never firmware for my bios by now and the tpm chip only returns SHA-1 which I've found that for some reason it gives

MEASURED_BOOT
error with or detected from measurement log: invalid log spec

Is there any possible way to fix this?

[frederic-hoerni]

secboot requires a platform UEFI firmware that supports TPM Library Specification 2.0.

Your error indicates that this requirement is not met, based on the first event of the event log.

Example on a compatible platform:

sudo tpm2_eventlog /sys/kernel/security/tpm0/binary_bios_measurements
---
version: 1
events:
- EventNum: 0
  PCRIndex: 0
  EventType: EV_NO_ACTION
  Digest: "0000000000000000000000000000000000000000"
  EventSize: 33
  SpecID:
  - Signature: Spec ID Event03
    platformClass: 0
    specVersionMinor: 0
    specVersionMajor: 2
    specErrata: 105
    uintnSize: 2
    numberOfAlgorithms: 1
    Algorithms:
    - Algorithm[0]:
      algorithmId: sha256
      digestSize: 32
    vendorInfoSize: 0
- EventNum: 1
...

secboot expects the following:

• Signature: "Spec ID Event02" or "Spec ID Event03"
• specVersionMajor: 2

... and will raise the invalid log spec error if these are not met.

[CYB3RCA4T]

I do have TPM 2.0

[frederic-hoerni]

What is the first event (EventNum: 0) in /sys/kernel/security/tpm0/binary_bios_measurements?

[CYB3RCA4T]

The first event is:

PCRIndex: 0
EventType: EV_S_CRTM_VERSION
Digest: "b1ee6b1b54540474379e53d48c194fa13f827727"
EventSize: 12
Event: "560031002e00300038000000"

[frederic-hoerni]

Unfortunately, secboot relies on the first event being of type EV_NO_ACTION with the Specification ID Version
Event, as stated in https://trustedcomputinggroup.org/wp-content/uploads/TCG-PC-Client-Platform-Firmware-Profile-Version-1.06-Revision-52_pub-3.pdf:

3.3.4.1 PCR[0] – SRTM, POST BIOS, and Embedded Drivers
[...]
Entities that MUST be logged in the Event Log if the TPM is enabled:

1. The event type EV_NO_ACTION Specification ID Event. See Section 10.4.5.1 Specification ID Version
   Event. [...] This SHALL be the first event in the Event Log.

[CYB3RCA4T]

Hey! I've had time to look into this more, so I checked what's with my BIOS. It turns out because of the manufacturer's writing of my BIOS, it only produces the Specification_ID mentioned above, if it is actively using the SHA-256 mode, but for some reason even though my chip has capabilities of SHA-256, the bios uses SHA-1