feat: sealed TPM audit log — NV_Extend chain for hardware-rooted tamper-evident event log

[nielsweistra]

Problem

The audit log records events at the application layer, but there is no hardware-rooted, tamper-evident record of attestation events. An attacker with database access can truncate or alter the audit log without any indication that the TPM state diverges from the logged events.

Solution — Sealed TPM Audit Log (NV_Extend Mode)

Each attestation event extends a TPM NV index using TPM2_NV_Extend. The cumulative hash is cryptographically bound to the sequence of events — it is impossible to retroactively alter without physical access to the TPM.

Server-side Registry

The server maintains a TpmAuditLog table that mirrors the expected NV chain:

# models/tpm_audit.py
class TpmAuditLog(Base):
    id: uuid
    machine_id: uuid
    sequence_number: int     # monotonically increasing per machine
    event_type: str          # attest / enroll / revoke / mission_activate / wipe
    event_payload_hash: str  # SHA-384 of event data
    nv_extend_hash: str      # expected TPM NV value after this extend
    recorded_at: datetime

NV Extend Chain

Each event: nv_value[n] = SHA-384(nv_value[n-1] || event_hash[n])

This mirrors how PCR extend works, but on NV RAM (persistent across reboots, not cleared on TPM reset unless explicitly authorized).

Client writes

itl-tpm-register (Talos extension) calls TPM2_NV_Extend after:

• Successful attestation
• Phase delta applied
• Broadcast wipe received

Verification

GET /api/v1/forensics/audit/{machine_id}

Server returns the NV chain. Forensic operator can compare against physical TPM NV readout to detect any log tampering.

NV Index

ITL_TPM_AUDIT_NV_INDEX=0x01500001 (configurable, in owner handle space)

MITRE ATT&CK

• T1565 — Data Manipulation (mitigated: TPM NV chain detects any alteration)
• T1070 — Indicator Removal (mitigated: TPM NV is hardware-rooted)

Files

• New: models/tpm_audit.py
• New: services/tpm_audit_log.py — server-side NV chain computation
• New: routers/forensics.py (extend existing if created in feat: steganographic config watermarking — HMAC-SHA384 provenance tracking per delivery #40) — GET /forensics/audit/{machine_id}
• Extend: all event handlers to append audit records
• New env var: ITL_TPM_AUDIT_NV_INDEX=0x01500001
• Alembic migration: add_tpm_audit_log_table

Companion issue

• ITL.Talos.HardenedOS: itl-tpm-register TPM NV audit log writes (companion to this issue)

Dependencies

• Depends on feat: migrate from SQLite to PostgreSQL — prerequisite for append-only audit log (#10) and HA deployment #22 (PostgreSQL) for append-only DB role enforcement

Acceptance Criteria

• Every attestation event appends a row to TpmAuditLog
• NV chain hash correctly extends: nv[n] = SHA384(nv[n-1] || event_hash[n])
• GET /forensics/audit/{machine_id} returns full NV chain with sequence numbers
• Tampered row detectable: altering any row breaks the NV chain from that point
• Test: 5 events → chain has 5 entries; alter entry 3 → entries 3-5 chain mismatch