Failed Attestation System Requirements

[SquallyTheGoat]

Call of Duty/RICOCHET Secure Attestation fails on OMEN 875-0xxx motherboard 84FD with the latest BIOS F.35. TPM 2.0 and Secure Boot are enabled and functional. Please escalate this to firmware engineering to determine whether F.35's TPM measured-boot/PCR7 implementation is incompatible with current Secure Attestation requirements.

• Product: OMEN by HP Obelisk Desktop 875-0xxx
• Product/SKU: 13Z92AA#ABA
• Motherboard: 84FD
• BIOS: F.35, 12/19/2023
• CPU: i5-9400F
• TPM: Intel 403.1.0.0
• UEFI: Yes
• Secure Boot: Yes
• TPM 2.0: Yes
• Call of Duty: Failed Attestation Status Applied

[NonSequitur777]

@SquallyTheGoat,

Welcome to our HP Community forum!

Look, from a user-to-user perspective, I think your request for a firmware-level investigation is technically reasonable, but I would temper expectations about the likely outcome.

The fact that Windows reports TPM 2.0 and Secure Boot as enabled does not necessarily mean that the platform will pass RICOCHET's current Secure Attestation requirements. Attestation can validate the platform's measured-boot state, including measurements associated with Secure Boot, rather than simply checking whether TPM and Secure Boot are present and enabled.

Your configuration is particularly interesting because you have:

• OMEN Obelisk 875-0xxx
• Motherboard/SSID 84FD
• BIOS F.35 dated December 19, 2023
• Intel Core i5-9400F
• TPM 2.0
• UEFI boot
• Secure Boot enabled

yet RICOCHET reports "Failed Attestation Status Applied."

I would therefore not characterize this as a conventional "enable TPM/Secure Boot" problem. Those prerequisites appear to be satisfied.

Before concluding that PCR 7 is specifically responsible, however, I would run the current Call of Duty Secure Attestation Wizard and capture its detailed failure information. If it identifies an attestation, measured-boot, PCR, or Secure Boot measurement problem, that would provide considerably stronger evidence for a firmware-level incompatibility.

For additional diagnostics, these commands are useful:

Confirm-SecureBootUEFI

Get-Tpm | Format-List *

tpmtool getdeviceinformation

How to Run These commands as Administrator:

1. Press the Windows Key on your keyboard.
2. Type PowerShell into the search bar.
3. Right-click on Windows PowerShell in the search results and select Run as administrator.
4. Click Yes if a User Account Control (UAC) prompt pops up.

What Each Command Does:

Once your elevated PowerShell window is open, you can copy and paste the commands one by one:

• Confirm-SecureBootUEFI
  • Result: Outputs True if Secure Boot is enabled, False if it is disabled, or throws an error if the system does not support UEFI.
• Get-Tpm | Format-List *
  • Result: Displays a comprehensive list of your TPM chip's status, including whether it is present, enabled, activated, and ready for use.
• tpmtool getdeviceinformation
  • Result: A built-in Windows diagnostic tool that outputs clean, detailed cryptographic information about your TPM version (e.g., 2.0) and manufacturer details.

I would also look at the relevant TPM-WMI and Secure Boot event logs around the time of the failed attestation.

If those checks show that TPM 2.0 and Secure Boot are functioning normally, but the platform nevertheless fails attestation, then your underlying theory is quite plausible: the 2023-era firmware implementation may simply not produce the measured-boot/attestation state expected by the current version of RICOCHET.

OK, please sit down: the difficult part is what happens next.

Because the 84FD OMEN Obelisk platform is considered a legacy system by HP and F.35 dates from December 2023, I would not assume that HP will produce a new BIOS to bring this platform into compliance with subsequently changed third-party gaming security requirements. An HP firmware-engineering escalation (if approved, which is also doubtful) can establish whether the behavior is a firmware limitation or incompatibility, but that does not necessarily mean HP will release a corrective BIOS.

In other words, if you think it is worth-it to pursue an escalation, you can do it primarily and at best to establish the cause, rather than with any realistic expectation that a new BIOS is forthcoming.  Sorry, it pains me to say this...

If the Secure Attestation Wizard demonstrates that the platform's TPM/Secure Boot configuration is otherwise healthy and the failure is genuinely attributable to the legacy firmware's attestation measurements, you may unfortunately be dealing with a platform limitation rather than a user-configurable problem. In that situation, repeatedly clearing the TPM, reinstalling Windows, or toggling Secure Boot is unlikely to solve it.

I would therefore document the attestation failure carefully, obtain the Wizard's exact diagnostic result, and ask HP to confirm whether BIOS F.35 on motherboard 84FD supports the measured-boot/attestation behavior required by current RICOCHET.

Kind Regards,

NonSequitur777