Measured boot is a startup process that records the firmware, bootloader, kernel, and other early boot components into TPM Platform Configuration Registers (PCRs). Each measurement extends the PCR values, creating a tamper-evident record of what ran during boot. Later software can compare those PCRs against expected values before releasing secrets or allowing access.
This matters because disk encryption, device attestation, and remote trust decisions often depend on the boot state being honest. If a system measures only part of the boot chain, an attacker who can modify an unmeasured stage may still satisfy the TPM policy and obtain keys or trusted access. Defenders use measured boot to bind secrets to a known-good platform state, but it only works when every security-relevant boot component is included and resealed after legitimate updates.