TPMSpy Traces Measured Boot Across systemd 245-258 and Finds No Two Systems Measure the Same Things

arXiv 2609.05011·low signalXBlueskyLinkedInCopy link

arXiv 2609.05011 reconstructs and validates the TPM Event Log independently of the quoting mechanism by tracing virtualized system-to-TPM interactions, a platform-agnostic method that works on both open and closed systems and is demonstrated on Linux and Windows. A longitudinal analysis of systemd versions 245 through 258, covering 2020 to 2025, found wide divergence in Measured Boot usage with no single pattern emerging. It surfaces undocumented behavioral changes and inconsistent measurement of user-space systemd services, which is enough to break reliable remote attestation.