| Short form | Full words | In plain language |
|---|---|---|
| PCR | Platform Configuration Register | A special append-only slot in a security chip holding a fingerprint of software. |
| PCR0 | Platform Configuration Register 0 | The first slot — holds the fingerprint of the earliest code (firmware or enclave image). The anchor. |
| TPM | Trusted Platform Module | The security chip itself. |
| TCG | Trusted Computing Group | The industry body that writes the specifications. |
| CRTM | Code Root of Trust for Measurement (NIST: "Core") | The first immutable code that starts the fingerprint chain — platform firmware, not part of the TPM. |
| SRTM / DRTM | Static / Dynamic Root of Trust for Measurement | Trust from power-on (static) vs. re-started mid-run by a CPU instruction (dynamic). |
| UEFI / BIOS | Unified Extensible Firmware Interface / Basic Input-Output System | Two names for the core startup firmware. |
| EK / AK | Endorsement Key / Attestation Key | The chip's built-in identity key / the key it uses to sign reports. |
| Quote | — | The chip's signed report of its register values + a freshness nonce. |
| Nonce | Number used once | A fresh random challenge proving an answer is live, not replayed. |
| Enclave | — | A sealed, encrypted compartment the host owner can't see into. |
| NSM | Nitro Security Module | Amazon's hardware that signs an enclave's attestation document. |
| KMS | Key Management Service | Amazon's key vault; can release a key only to an attested enclave. |
| EIF | Enclave Image File | The packaged enclave; its fingerprint is Nitro's PCR0. |
| CBOR / COSE | Concise Binary Object Representation / CBOR Object Signing and Encryption | Compact binary data format / the standard way to sign it. |
| SGX | Software Guard Extensions (Intel) | Intel's per-program enclave technology. |
| TDX | Trust Domain Extensions (Intel) | Intel's whole-VM confidential computing. |
| SEV-SNP | Secure Encrypted Virtualization – Secure Nested Paging (AMD) | AMD's confidential VM technology. |
| CCA | Confidential Compute Architecture (Arm) | Arm's confidential computing design. |
| vTPM | virtual Trusted Platform Module | A software security chip running inside a protected VM. |
| RATS | Remote ATtestation procedureS | The internet standard naming the roles (attester, verifier, etc.). |
| EAT | Entity Attestation Token | A standard envelope of attestation facts. |
| CoRIM | Concise Reference Integrity Manifest | A standard file of known-good fingerprints (still a draft). |
| DICE | Device Identifier Composition Engine | Measured boot without a chip, for tiny devices. |
| SLSA | Supply-chain Levels for Software Artifacts | A framework for trustworthy build records. |
| TXT | Trusted Execution Technology (Intel) | Intel's dynamic-root-of-trust feature. |
| IMA | Integrity Measurement Architecture | Linux feature that fingerprints files at runtime. |
New chapters
The field guide is still being written. Put an address here to get an email when a chapter ships — that is all it is used for.