On Wed, 2026-08-26 at 19:11 +0000, Singh, Jashandeep wrote: > From: Jashandeep Singh <[email protected]> > > ima_calc_boot_aggregate() selects a TPM PCR bank matching the > configured IMA hash algorithm, otherwise falling back to the SHA256 > bank or the SHA1 bank. > > A TPM 2.0 can be provisioned with only the SHA384 bank enabled, with no > SHA256 or SHA1 bank. None of the above then matched, selection failed > with > > ima: No suitable TPM algorithm for boot aggregate > > and the boot aggregate digest was left as zeros, as for TPM bypass, > making remote attestation impossible. > > Accept the SHA384 bank as a fallback. The configured IMA hash algorithm > is still matched first.
FYI, all enabled TPM banks are extended. Refer to the functions ima_pcr_extend() and tpm_pcr_extend(). The IMA measurement list contains file data hashes based on the IMA default hash algorithm. Similarly, the boot_aggregate hash is calculated using the IMA default hash algorithm. If you're seeing "ima: No suitable TPM algorithm for boot aggregate", it probably means no TPM banks are configured. Mimi
