Imported Upstream version 5.0.1

62 files changed, 3250 insertions, 1348 deletions

diff --git a/src/libpts/Makefile.am b/src/libpts/Makefile.am
index 3ff941794..8137493ab 100644
--- a/src/libpts/Makefile.am
+++ b/src/libpts/Makefile.am
@@ -9,6 +9,7 @@ libpts_la_SOURCES = \
 	libpts.h libpts.c \
 	pts/pts.h pts/pts.c \
 	pts/pts_error.h pts/pts_error.c \
+	pts/pts_pcr.h pts/pts_pcr.c \
 	pts/pts_proto_caps.h \
 	pts/pts_req_func_comp_evid.h \
 	pts/pts_simple_evid_final.h \
diff --git a/src/libpts/Makefile.in b/src/libpts/Makefile.in
index d317cfea1..0b6451bcc 100644
--- a/src/libpts/Makefile.in
+++ b/src/libpts/Makefile.in
@@ -51,6 +51,7 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
 mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
 CONFIG_CLEAN_FILES =
 CONFIG_CLEAN_VPATH_FILES =
 am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
@@ -77,8 +78,8 @@ am__base_list = \
 am__installdirs = "$(DESTDIR)$(ipseclibdir)"
 LTLIBRARIES = $(ipseclib_LTLIBRARIES)
 libpts_la_DEPENDENCIES = $(top_builddir)/src/libimcv/libimcv.la
-am_libpts_la_OBJECTS = libpts.lo pts.lo pts_error.lo pts_creds.lo \
-	pts_database.lo pts_dh_group.lo pts_file_meas.lo \
+am_libpts_la_OBJECTS = libpts.lo pts.lo pts_error.lo pts_pcr.lo \
+	pts_creds.lo pts_database.lo pts_dh_group.lo pts_file_meas.lo \
 	pts_file_meta.lo pts_file_type.lo pts_meas_algo.lo \
 	pts_component_manager.lo pts_comp_evidence.lo \
 	pts_comp_func_name.lo ita_comp_func_name.lo ita_comp_ima.lo \
@@ -96,7 +97,7 @@ am_libpts_la_OBJECTS = libpts.lo pts.lo pts_error.lo pts_creds.lo \
 	tcg_pts_attr_req_file_meas.lo tcg_pts_attr_file_meas.lo \
 	tcg_pts_attr_req_file_meta.lo tcg_pts_attr_unix_file_meta.lo
 libpts_la_OBJECTS = $(am_libpts_la_OBJECTS)
-DEFAULT_INCLUDES = -I.@am__isrc@
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
 depcomp = $(SHELL) $(top_srcdir)/depcomp
 am__depfiles_maybe = depfiles
 am__mv = mv -f
@@ -160,6 +161,7 @@ AUTOCONF = @AUTOCONF@
 AUTOHEADER = @AUTOHEADER@
 AUTOMAKE = @AUTOMAKE@
 AWK = @AWK@
+BFDLIB = @BFDLIB@
 BTLIB = @BTLIB@
 CC = @CC@
 CCDEPMODE = @CCDEPMODE@
@@ -254,11 +256,14 @@ build_os = @build_os@
 build_vendor = @build_vendor@
 builddir = @builddir@
 c_plugins = @c_plugins@
+charon_natt_port = @charon_natt_port@
+charon_plugins = @charon_plugins@
+charon_udp_port = @charon_udp_port@
 clearsilver_LIBS = @clearsilver_LIBS@
 datadir = @datadir@
 datarootdir = @datarootdir@
 dbusservicedir = @dbusservicedir@
-default_pkcs11 = @default_pkcs11@
+dev_headers = @dev_headers@
 docdir = @docdir@
 dvidir = @dvidir@
 exec_prefix = @exec_prefix@
@@ -275,11 +280,12 @@ imcvdir = @imcvdir@
 includedir = @includedir@
 infodir = @infodir@
 install_sh = @install_sh@
+ipsec_script = @ipsec_script@
+ipsec_script_upper = @ipsec_script_upper@
 ipsecdir = @ipsecdir@
 ipsecgroup = @ipsecgroup@
 ipseclibdir = @ipseclibdir@
 ipsecuser = @ipsecuser@
-libcharon_plugins = @libcharon_plugins@
 libdir = @libdir@
 libexecdir = @libexecdir@
 linux_headers = @linux_headers@
@@ -295,6 +301,7 @@ mkdir_p = @mkdir_p@
 nm_CFLAGS = @nm_CFLAGS@
 nm_LIBS = @nm_LIBS@
 nm_ca_dir = @nm_ca_dir@
+nm_plugins = @nm_plugins@
 oldincludedir = @oldincludedir@
 openac_plugins = @openac_plugins@
 p_plugins = @p_plugins@
@@ -304,7 +311,6 @@ pdfdir = @pdfdir@
 piddir = @piddir@
 pki_plugins = @pki_plugins@
 plugindir = @plugindir@
-pluto_plugins = @pluto_plugins@
 pool_plugins = @pool_plugins@
 prefix = @prefix@
 program_transform_name = @program_transform_name@
@@ -339,6 +345,7 @@ libpts_la_SOURCES = \
 	libpts.h libpts.c \
 	pts/pts.h pts/pts.c \
 	pts/pts_error.h pts/pts_error.c \
+	pts/pts_pcr.h pts/pts_pcr.c \
 	pts/pts_proto_caps.h \
 	pts/pts_req_func_comp_evid.h \
 	pts/pts_simple_evid_final.h \
@@ -469,6 +476,7 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pts_file_meta.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pts_file_type.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pts_meas_algo.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pts_pcr.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/tcg_attr.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/tcg_comp_func_name.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/tcg_pts_attr_aik.Plo@am__quote@
@@ -524,6 +532,13 @@ pts_error.lo: pts/pts_error.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o pts_error.lo `test -f 'pts/pts_error.c' || echo '$(srcdir)/'`pts/pts_error.c
 
+pts_pcr.lo: pts/pts_pcr.c
+@am__fastdepCC_TRUE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT pts_pcr.lo -MD -MP -MF $(DEPDIR)/pts_pcr.Tpo -c -o pts_pcr.lo `test -f 'pts/pts_pcr.c' || echo '$(srcdir)/'`pts/pts_pcr.c
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/pts_pcr.Tpo $(DEPDIR)/pts_pcr.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='pts/pts_pcr.c' object='pts_pcr.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o pts_pcr.lo `test -f 'pts/pts_pcr.c' || echo '$(srcdir)/'`pts/pts_pcr.c
+
 pts_creds.lo: pts/pts_creds.c
 @am__fastdepCC_TRUE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT pts_creds.lo -MD -MP -MF $(DEPDIR)/pts_creds.Tpo -c -o pts_creds.lo `test -f 'pts/pts_creds.c' || echo '$(srcdir)/'`pts/pts_creds.c
 @am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/pts_creds.Tpo $(DEPDIR)/pts_creds.Plo
diff --git a/src/libpts/plugins/imc_attestation/Makefile.in b/src/libpts/plugins/imc_attestation/Makefile.in
index 583d2dfee..4734379bf 100644
--- a/src/libpts/plugins/imc_attestation/Makefile.in
+++ b/src/libpts/plugins/imc_attestation/Makefile.in
@@ -49,6 +49,7 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
 mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
 CONFIG_CLEAN_FILES =
 CONFIG_CLEAN_VPATH_FILES =
 am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
@@ -84,7 +85,7 @@ imc_attestation_la_OBJECTS = $(am_imc_attestation_la_OBJECTS)
 imc_attestation_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
 	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
 	$(imc_attestation_la_LDFLAGS) $(LDFLAGS) -o $@
-DEFAULT_INCLUDES = -I.@am__isrc@
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
 depcomp = $(SHELL) $(top_srcdir)/depcomp
 am__depfiles_maybe = depfiles
 am__mv = mv -f
@@ -110,6 +111,7 @@ AUTOCONF = @AUTOCONF@
 AUTOHEADER = @AUTOHEADER@
 AUTOMAKE = @AUTOMAKE@
 AWK = @AWK@
+BFDLIB = @BFDLIB@
 BTLIB = @BTLIB@
 CC = @CC@
 CCDEPMODE = @CCDEPMODE@
@@ -204,11 +206,14 @@ build_os = @build_os@
 build_vendor = @build_vendor@
 builddir = @builddir@
 c_plugins = @c_plugins@
+charon_natt_port = @charon_natt_port@
+charon_plugins = @charon_plugins@
+charon_udp_port = @charon_udp_port@
 clearsilver_LIBS = @clearsilver_LIBS@
 datadir = @datadir@
 datarootdir = @datarootdir@
 dbusservicedir = @dbusservicedir@
-default_pkcs11 = @default_pkcs11@
+dev_headers = @dev_headers@
 docdir = @docdir@
 dvidir = @dvidir@
 exec_prefix = @exec_prefix@
@@ -225,11 +230,12 @@ imcvdir = @imcvdir@
 includedir = @includedir@
 infodir = @infodir@
 install_sh = @install_sh@
+ipsec_script = @ipsec_script@
+ipsec_script_upper = @ipsec_script_upper@
 ipsecdir = @ipsecdir@
 ipsecgroup = @ipsecgroup@
 ipseclibdir = @ipseclibdir@
 ipsecuser = @ipsecuser@
-libcharon_plugins = @libcharon_plugins@
 libdir = @libdir@
 libexecdir = @libexecdir@
 linux_headers = @linux_headers@
@@ -245,6 +251,7 @@ mkdir_p = @mkdir_p@
 nm_CFLAGS = @nm_CFLAGS@
 nm_LIBS = @nm_LIBS@
 nm_ca_dir = @nm_ca_dir@
+nm_plugins = @nm_plugins@
 oldincludedir = @oldincludedir@
 openac_plugins = @openac_plugins@
 p_plugins = @p_plugins@
@@ -254,7 +261,6 @@ pdfdir = @pdfdir@
 piddir = @piddir@
 pki_plugins = @pki_plugins@
 plugindir = @plugindir@
-pluto_plugins = @pluto_plugins@
 pool_plugins = @pool_plugins@
 prefix = @prefix@
 program_transform_name = @program_transform_name@
diff --git a/src/libpts/plugins/imc_attestation/imc_attestation.c b/src/libpts/plugins/imc_attestation/imc_attestation.c
index 4f77ba093..7cb2a0671 100644
--- a/src/libpts/plugins/imc_attestation/imc_attestation.c
+++ b/src/libpts/plugins/imc_attestation/imc_attestation.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -21,6 +21,7 @@
 #include <ietf/ietf_attr.h>
 #include <ietf/ietf_attr_pa_tnc_error.h>
 #include <ietf/ietf_attr_product_info.h>
+#include <ietf/ietf_attr_assess_result.h>
 
 #include <libpts.h>
 
@@ -108,9 +109,17 @@ TNC_Result TNC_IMC_NotifyConnectionChange(TNC_IMCID imc_id,
 		case TNC_CONNECTION_STATE_CREATE:
 			state = imc_attestation_state_create(connection_id);
 			return imc_attestation->create_state(imc_attestation, state);
+		case TNC_CONNECTION_STATE_HANDSHAKE:
+			if (imc_attestation->change_state(imc_attestation, connection_id,
+				new_state, &state) != TNC_RESULT_SUCCESS)
+			{
+				return TNC_RESULT_FATAL;
+			}
+			state->set_result(state, imc_id,
+							  TNC_IMV_EVALUATION_RESULT_DONT_KNOW);
+			return TNC_RESULT_SUCCESS;
 		case TNC_CONNECTION_STATE_DELETE:
 			return imc_attestation->delete_state(imc_attestation, connection_id);
-		case TNC_CONNECTION_STATE_HANDSHAKE:
 		case TNC_CONNECTION_STATE_ACCESS_ISOLATED:
 		case TNC_CONNECTION_STATE_ACCESS_NONE:
 		default:
@@ -149,17 +158,15 @@ TNC_Result TNC_IMC_BeginHandshake(TNC_IMCID imc_id,
 	platform_info = pts->get_platform_info(pts);
 	if (platform_info)
 	{
-		pa_tnc_msg_t *pa_tnc_msg;
+		linked_list_t *attr_list;
 		pa_tnc_attr_t *attr;
 
-		pa_tnc_msg = pa_tnc_msg_create();
+		attr_list = linked_list_create();
 		attr = ietf_attr_product_info_create(0, 0, platform_info);
-		pa_tnc_msg->add_attribute(pa_tnc_msg, attr);
-		pa_tnc_msg->build(pa_tnc_msg);
+		attr_list->insert_last(attr_list, attr);
 		result = imc_attestation->send_message(imc_attestation, connection_id,
-										FALSE, 0, TNC_IMVID_ANY,
-										pa_tnc_msg->get_encoding(pa_tnc_msg));
-		pa_tnc_msg->destroy(pa_tnc_msg);
+										FALSE, 0, TNC_IMVID_ANY, attr_list);
+		attr_list->destroy(attr_list);
 	}
 
 	return result;
@@ -176,11 +183,13 @@ static TNC_Result receive_message(TNC_IMCID imc_id,
 {
 	pa_tnc_msg_t *pa_tnc_msg;
 	pa_tnc_attr_t *attr;
+	pen_type_t type;
 	linked_list_t *attr_list;
 	imc_state_t *state;
 	imc_attestation_state_t *attestation_state;
 	enumerator_t *enumerator;
 	TNC_Result result;
+	TNC_UInt32 target_imc_id;
 
 	if (!imc_attestation)
 	{
@@ -204,6 +213,7 @@ static TNC_Result receive_message(TNC_IMCID imc_id,
 	{
 		return result;
 	}
+	target_imc_id = (dst_imc_id == TNC_IMCID_ANY) ? imc_id : dst_imc_id;
 	
 	/* preprocess any IETF standard error attributes */
 	result = pa_tnc_msg->process_ietf_std_errors(pa_tnc_msg) ?
@@ -215,30 +225,40 @@ static TNC_Result receive_message(TNC_IMCID imc_id,
 	enumerator = pa_tnc_msg->create_attribute_enumerator(pa_tnc_msg);
 	while (enumerator->enumerate(enumerator, &attr))
 	{
-		if (attr->get_vendor_id(attr) == PEN_IETF &&
-			attr->get_type(attr) == IETF_ATTR_PA_TNC_ERROR)
-		{
-			ietf_attr_pa_tnc_error_t *error_attr;
-			pen_t error_vendor_id;
-			pa_tnc_error_code_t error_code;
-			chunk_t msg_info;
+		type = attr->get_type(attr);
 
-			error_attr = (ietf_attr_pa_tnc_error_t*)attr;
-			error_vendor_id = error_attr->get_vendor_id(error_attr);
-
-			if (error_vendor_id == PEN_TCG)
+		if (type.vendor_id == PEN_IETF)
+		{
+			if (type.type == IETF_ATTR_PA_TNC_ERROR)
 			{
+				ietf_attr_pa_tnc_error_t *error_attr;
+				pen_type_t error_code;
+				chunk_t msg_info;
+
+				error_attr = (ietf_attr_pa_tnc_error_t*)attr;
 				error_code = error_attr->get_error_code(error_attr);
-				msg_info = error_attr->get_msg_info(error_attr);
 
-				DBG1(DBG_IMC, "received TCG-PTS error '%N'",
-					 pts_error_code_names, error_code);
-				DBG1(DBG_IMC, "error information: %B", &msg_info);
+				if (error_code.vendor_id == PEN_TCG)
+				{
+					msg_info = error_attr->get_msg_info(error_attr);
 
-				result = TNC_RESULT_FATAL;
+					DBG1(DBG_IMC, "received TCG-PTS error '%N'",
+						 pts_error_code_names, error_code.type);
+					DBG1(DBG_IMC, "error information: %B", &msg_info);
+
+					result = TNC_RESULT_FATAL;
+				}
+			}
+			else if (type.type == IETF_ATTR_ASSESSMENT_RESULT)
+			{
+				ietf_attr_assess_result_t *ietf_attr;
+
+				ietf_attr = (ietf_attr_assess_result_t*)attr;
+				state->set_result(state, target_imc_id,
+								  ietf_attr->get_result(ietf_attr));
 			}
 		}
-		else if (attr->get_vendor_id(attr) == PEN_TCG)
+		else if (type.vendor_id == PEN_TCG)
 		{
 			if (!imc_attestation_process(attr, attr_list, attestation_state,
 				supported_algorithms, supported_dh_groups))
@@ -253,23 +273,11 @@ static TNC_Result receive_message(TNC_IMCID imc_id,
 
 	if (result == TNC_RESULT_SUCCESS && attr_list->get_count(attr_list))
 	{
-		pa_tnc_msg = pa_tnc_msg_create();
-
-		enumerator = attr_list->create_enumerator(attr_list);
-		while (enumerator->enumerate(enumerator, &attr))
-		{
-			pa_tnc_msg->add_attribute(pa_tnc_msg, attr);
-		}
-		enumerator->destroy(enumerator);
-
-		pa_tnc_msg->build(pa_tnc_msg);
 		result = imc_attestation->send_message(imc_attestation, connection_id,
-										FALSE, 0, TNC_IMVID_ANY,
-										pa_tnc_msg->get_encoding(pa_tnc_msg));
-		pa_tnc_msg->destroy(pa_tnc_msg);
+										FALSE, 0, TNC_IMVID_ANY, attr_list);
 	}
-
 	attr_list->destroy(attr_list);
+
 	return result;
 }
 
diff --git a/src/libpts/plugins/imc_attestation/imc_attestation_process.c b/src/libpts/plugins/imc_attestation/imc_attestation_process.c
index b70c05370..bd2fa649d 100644
--- a/src/libpts/plugins/imc_attestation/imc_attestation_process.c
+++ b/src/libpts/plugins/imc_attestation/imc_attestation_process.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -23,7 +23,6 @@
 
 #include <ietf/ietf_attr_pa_tnc_error.h>
 
-#include <libpts.h>
 #include <pts/pts.h>
 
 #include <tcg/tcg_pts_attr_proto_caps.h>
@@ -57,10 +56,13 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
 	chunk_t attr_info;
 	pts_t *pts;
 	pts_error_code_t pts_error;
+	pen_type_t attr_type;
 	bool valid_path;
 
 	pts = attestation_state->get_pts(attestation_state);
-	switch (attr->get_type(attr))
+	attr_type = attr->get_type(attr);
+
+	switch (attr_type.type)
 	{
 		case TCG_PTS_REQ_PROTO_CAPS:
 		{
@@ -182,12 +184,12 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
 		case TCG_PTS_GET_TPM_VERSION_INFO:
 		{
 			chunk_t tpm_version_info, attr_info;
+			pen_type_t error_code = { PEN_TCG, TCG_PTS_TPM_VERS_NOT_SUPPORTED };
 
 			if (!pts->get_tpm_version_info(pts, &tpm_version_info))
 			{
 				attr_info = attr->get_value(attr);
-				attr = ietf_attr_pa_tnc_error_create(PEN_TCG,
-							TCG_PTS_TPM_VERS_NOT_SUPPORTED, attr_info);
+				attr = ietf_attr_pa_tnc_error_create(error_code, attr_info);
 				attr_list->insert_last(attr_list, attr);
 				break;
 			}
@@ -221,6 +223,7 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
 			bool is_directory;
 			u_int32_t delimiter;
 			pts_file_meas_t *measurements;
+			pen_type_t error_code;
 
 			attr_info = attr->get_value(attr);
 			attr_cast = (tcg_pts_attr_req_file_meas_t*)attr;
@@ -232,8 +235,8 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
 
 			if (valid_path && pts_error)
 			{
-				attr = ietf_attr_pa_tnc_error_create(PEN_TCG,
-										pts_error, attr_info);
+				error_code = pen_type_create(PEN_TCG, pts_error);
+				attr = ietf_attr_pa_tnc_error_create(error_code, attr_info);
 				attr_list->insert_last(attr_list, attr);
 				break;
 			}
@@ -244,8 +247,9 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
 
 			if (delimiter != SOLIDUS_UTF && delimiter != REVERSE_SOLIDUS_UTF)
 			{
-				attr = ietf_attr_pa_tnc_error_create(PEN_TCG,
-										TCG_PTS_INVALID_DELIMITER, attr_info);
+				error_code = pen_type_create(PEN_TCG,
+											 TCG_PTS_INVALID_DELIMITER);
+				attr = ietf_attr_pa_tnc_error_create(error_code, attr_info);
 				attr_list->insert_last(attr_list, attr);
 				break;
 			}
@@ -254,8 +258,9 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
 			DBG2(DBG_IMC, "measurement request %d for %s '%s'",
 				 request_id, is_directory ? "directory" : "file",
 				 pathname);
-			measurements = pts->do_measurements(pts, request_id,
-									pathname, is_directory);
+			measurements = pts_file_meas_create_from_path(request_id,
+										pathname, is_directory, TRUE,
+										pts->get_meas_algorithm(pts));
 			if (!measurements)
 			{
 				/* TODO handle error codes from measurements */
@@ -273,6 +278,7 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
 			bool is_directory;
 			u_int8_t delimiter;
 			pts_file_meta_t *metadata;
+			pen_type_t error_code;
 
 			attr_info = attr->get_value(attr);
 			attr_cast = (tcg_pts_attr_req_file_meta_t*)attr;
@@ -283,8 +289,8 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
 			valid_path = pts->is_path_valid(pts, pathname, &pts_error);
 			if (valid_path && pts_error)
 			{
-				attr = ietf_attr_pa_tnc_error_create(PEN_TCG,
-										pts_error, attr_info);
+				error_code = pen_type_create(PEN_TCG, pts_error);
+				attr = ietf_attr_pa_tnc_error_create(error_code, attr_info);
 				attr_list->insert_last(attr_list, attr);
 				break;
 			}
@@ -294,8 +300,9 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
 			}
 			if (delimiter != SOLIDUS_UTF && delimiter != REVERSE_SOLIDUS_UTF)
 			{
-				attr = ietf_attr_pa_tnc_error_create(PEN_TCG,
-										TCG_PTS_INVALID_DELIMITER, attr_info);
+				error_code = pen_type_create(PEN_TCG,
+											 TCG_PTS_INVALID_DELIMITER);
+				attr = ietf_attr_pa_tnc_error_create(error_code, attr_info);
 				attr_list->insert_last(attr_list, attr);
 				break;
 			}
@@ -323,6 +330,7 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
 			pts_comp_func_name_t *name;
 			pts_comp_evidence_t *evid;
 			pts_component_t *comp;
+			pen_type_t error_code;
 			u_int32_t depth;
 			u_int8_t flags;
 			status_t status;
@@ -342,32 +350,36 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
 
 				if (flags & PTS_REQ_FUNC_COMP_EVID_TTC)
 				{
-					attr = ietf_attr_pa_tnc_error_create(PEN_TCG,
-											TCG_PTS_UNABLE_DET_TTC, attr_info);
+					error_code = pen_type_create(PEN_TCG,
+												 TCG_PTS_UNABLE_DET_TTC); 
+					attr = ietf_attr_pa_tnc_error_create(error_code, attr_info);
 					attr_list->insert_last(attr_list, attr);
 					break;
 				}
 				if (flags & PTS_REQ_FUNC_COMP_EVID_VER &&
 					!(negotiated_caps & PTS_PROTO_CAPS_V))
 				{
-					attr = ietf_attr_pa_tnc_error_create(PEN_TCG,
-										TCG_PTS_UNABLE_LOCAL_VAL, attr_info);
+					error_code = pen_type_create(PEN_TCG,
+												 TCG_PTS_UNABLE_LOCAL_VAL);
+					attr = ietf_attr_pa_tnc_error_create(error_code, attr_info);
 					attr_list->insert_last(attr_list, attr);
 					break;
 				}
 				if (flags & PTS_REQ_FUNC_COMP_EVID_CURR &&
 					!(negotiated_caps & PTS_PROTO_CAPS_C))
 				{
-					attr = ietf_attr_pa_tnc_error_create(PEN_TCG,
-										TCG_PTS_UNABLE_CUR_EVID, attr_info);
+					error_code = pen_type_create(PEN_TCG,
+												 TCG_PTS_UNABLE_CUR_EVID);
+					attr = ietf_attr_pa_tnc_error_create(error_code, attr_info);
 					attr_list->insert_last(attr_list, attr);
 					break;
 				}
 				if (flags & PTS_REQ_FUNC_COMP_EVID_PCR &&
 					!(negotiated_caps & PTS_PROTO_CAPS_T))
 				{
-					attr = ietf_attr_pa_tnc_error_create(PEN_TCG,
-										TCG_PTS_UNABLE_DET_PCR, attr_info);
+					error_code = pen_type_create(PEN_TCG,
+												 TCG_PTS_UNABLE_DET_PCR);
+					attr = ietf_attr_pa_tnc_error_create(error_code, attr_info);
 					attr_list->insert_last(attr_list, attr);
 					break;
 				}
@@ -377,17 +389,19 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
 								  "support sub component measurements");
 					return FALSE;
 				}
-				comp = pts_components->create(pts_components, name, depth, NULL);
+				comp = attestation_state->create_component(attestation_state,
+														   name, depth);
 				if (!comp)
 				{
 					DBG2(DBG_IMC, "    not registered: no evidence provided");
 					continue;
 				}
 
-				/* do the component evidence measurement[s] */
+				/* do the component evidence measurement[s] and cache them */
 				do
 				{
-					status = comp->measure(comp, pts, &evid);
+					status = comp->measure(comp, name->get_qualifier(name),
+										   pts, &evid);
 					if (status == FAILED)
 					{
 						break;
@@ -395,7 +409,6 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
 					attestation_state->add_evidence(attestation_state, evid);
 				}
 				while (status == NEED_MORE);
-				comp->destroy(comp);
 			}
 			e->destroy(e);
 			break;
@@ -408,12 +421,9 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
 			chunk_t pcr_composite, quote_sig;
 			bool use_quote2;
 
-			/* Send buffered Simple Component Evidences */
+			/* Send cached Component Evidence entries */
 			while (attestation_state->next_evidence(attestation_state, &evid))
 			{
-				pts->select_pcr(pts, evid->get_extended_pcr(evid));
-
-				/* Send Simple Component Evidence */
 				attr = tcg_pts_attr_simple_comp_evid_create(evid);
 				attr_list->insert_last(attr_list, attr);
 			}
diff --git a/src/libpts/plugins/imc_attestation/imc_attestation_state.c b/src/libpts/plugins/imc_attestation/imc_attestation_state.c
index 72a55f60e..8ebabafa2 100644
--- a/src/libpts/plugins/imc_attestation/imc_attestation_state.c
+++ b/src/libpts/plugins/imc_attestation/imc_attestation_state.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -15,10 +15,15 @@
 
 #include "imc_attestation_state.h"
 
+#include <libpts.h>
+
+#include <tncif_names.h>
+
 #include <utils/linked_list.h>
 #include <debug.h>
 
 typedef struct private_imc_attestation_state_t private_imc_attestation_state_t;
+typedef struct func_comp_t func_comp_t;
 
 /**
  * Private data of an imc_attestation_state_t object.
@@ -41,6 +46,11 @@ struct private_imc_attestation_state_t {
 	TNC_ConnectionState state;
 
 	/**
+	 * Assessment/Evaluation Result
+	 */
+	TNC_IMV_Evaluation_Result result;
+
+	/**
 	 * Does the TNCCS connection support long message types?
 	 */
 	bool has_long;
@@ -51,12 +61,22 @@ struct private_imc_attestation_state_t {
 	bool has_excl;
 
 	/**
+	 * Maximum PA-TNC message size for this TNCCS connection
+	 */
+	u_int32_t max_msg_len;
+
+	/**
 	 * PTS object
 	 */
 	pts_t *pts;
 
 	/**
-	 * PTS Component Evidence list
+	 * List of Functional Components
+	 */
+	linked_list_t *components;
+
+	/**
+	 * Functional Component Evidence cache list
 	 */
 	linked_list_t *list;
 
@@ -87,18 +107,52 @@ METHOD(imc_state_t, set_flags, void,
 	this->has_excl = has_excl;
 }
 
+METHOD(imc_state_t, set_max_msg_len, void,
+	private_imc_attestation_state_t *this, u_int32_t max_msg_len)
+{
+	this->max_msg_len = max_msg_len;
+}
+
+METHOD(imc_state_t, get_max_msg_len, u_int32_t,
+	private_imc_attestation_state_t *this)
+{
+	return this->max_msg_len;
+}
+
 METHOD(imc_state_t, change_state, void,
 	private_imc_attestation_state_t *this, TNC_ConnectionState new_state)
 {
 	this->state = new_state;
 }
 
+METHOD(imc_state_t, set_result, void,
+	private_imc_attestation_state_t *this, TNC_IMCID id,
+	TNC_IMV_Evaluation_Result result)
+{
+	DBG1(DBG_IMC, "set assessment result for IMC %u to '%N'",
+		 id, TNC_IMV_Evaluation_Result_names, result);
+	this->result = result;
+}
+
+METHOD(imc_state_t, get_result, bool,
+	private_imc_attestation_state_t *this, TNC_IMCID id,
+	TNC_IMV_Evaluation_Result *result)
+{
+	if (result)
+	{
+		*result = this->result;
+	}
+	return this->result != TNC_IMV_EVALUATION_RESULT_DONT_KNOW;
+}
 
 METHOD(imc_state_t, destroy, void,
 	private_imc_attestation_state_t *this)
 {
 	this->pts->destroy(this->pts);
-	this->list->destroy_offset(this->list, offsetof(pts_comp_evidence_t, destroy));
+	this->components->destroy_offset(this->components,
+							offsetof(pts_component_t, destroy));
+	this->list->destroy_offset(this->list,
+							offsetof(pts_comp_evidence_t, destroy));
 	free(this);
 }
 
@@ -108,10 +162,42 @@ METHOD(imc_attestation_state_t, get_pts, pts_t*,
 	return this->pts;
 }
 
+METHOD(imc_attestation_state_t, create_component, pts_component_t*,
+	private_imc_attestation_state_t *this, pts_comp_func_name_t *name,
+	u_int32_t depth)
+{
+	enumerator_t *enumerator;
+	pts_component_t *component;
+	bool found = FALSE;
+
+	enumerator = this->components->create_enumerator(this->components);
+	while (enumerator->enumerate(enumerator, &component))
+	{
+		if (name->equals(name, component->get_comp_func_name(component)))
+		{
+			found = TRUE;
+			break;
+		}
+	}
+	enumerator->destroy(enumerator);
+
+	if (!found)
+	{
+		component = pts_components->create(pts_components, name, depth, NULL);
+		if (!component)
+		{
+			return NULL;
+		}
+		this->components->insert_last(this->components, component);
+
+	}
+	return component;
+}
+
 METHOD(imc_attestation_state_t, add_evidence, void,
-	private_imc_attestation_state_t *this, pts_comp_evidence_t *evidence)
+	private_imc_attestation_state_t *this, pts_comp_evidence_t *evid)
 {
-	this->list->insert_last(this->list, evidence);
+	this->list->insert_last(this->list, evid);
 }
 
 METHOD(imc_attestation_state_t, next_evidence, bool,
@@ -135,16 +221,23 @@ imc_state_t *imc_attestation_state_create(TNC_ConnectionID connection_id)
 				.has_long = _has_long,
 				.has_excl = _has_excl,
 				.set_flags = _set_flags,
+				.set_max_msg_len = _set_max_msg_len,
+				.get_max_msg_len = _get_max_msg_len,
 				.change_state = _change_state,
+				.set_result = _set_result,
+				.get_result = _get_result,
 				.destroy = _destroy,
 			},
 			.get_pts = _get_pts,
+			.create_component = _create_component,
 			.add_evidence = _add_evidence,
 			.next_evidence = _next_evidence,
 		},
 		.connection_id = connection_id,
 		.state = TNC_CONNECTION_STATE_CREATE,
+		.result = TNC_IMV_EVALUATION_RESULT_DONT_KNOW,
 		.pts = pts_create(TRUE),
+		.components = linked_list_create(),
 		.list = linked_list_create(),
 	);
 
diff --git a/src/libpts/plugins/imc_attestation/imc_attestation_state.h b/src/libpts/plugins/imc_attestation/imc_attestation_state.h
index 22b0bba23..e4fca71bb 100644
--- a/src/libpts/plugins/imc_attestation/imc_attestation_state.h
+++ b/src/libpts/plugins/imc_attestation/imc_attestation_state.h
@@ -24,6 +24,7 @@
 
 #include <imc/imc_state.h>
 #include <pts/pts.h>
+#include <pts/components/pts_component.h>
 #include <pts/components/pts_comp_evidence.h>
 #include <library.h>
 
@@ -47,14 +48,24 @@ struct imc_attestation_state_t {
 	pts_t* (*get_pts)(imc_attestation_state_t *this);
 
 	/**
-	 * Add an entry to the Component Evidence list
+	 * Create and add an entry to the list of Functional Components
 	 *
-	 * @param entry				Component Evidence entry
+	 * @param name				Component Functional Name
+	 * @param depth				Sub-component Depth
+	 * @return					created functional component instance or NULL
 	 */
-	void (*add_evidence)(imc_attestation_state_t *this, pts_comp_evidence_t *entry);
+	pts_component_t* (*create_component)(imc_attestation_state_t *this,
+							 pts_comp_func_name_t *name, u_int32_t depth);
 
 	/**
-	 * Removes next Component Evidence entry from list and returns it
+	 * Add an entry to the Component Evidence cache list
+	 *
+	 * @param evid				Component Evidence entry
+	 */
+	void (*add_evidence)(imc_attestation_state_t *this, pts_comp_evidence_t *evid);
+
+	/**
+	 * Removes next entry from the Component Evidence cache list and returns it
 	 *
 	 * @param evid				Next Component Evidence entry
 	 * @return					TRUE if next entry is available
diff --git a/src/libpts/plugins/imv_attestation/Makefile.am b/src/libpts/plugins/imv_attestation/Makefile.am
index a550a3552..5e7465195 100644
--- a/src/libpts/plugins/imv_attestation/Makefile.am
+++ b/src/libpts/plugins/imv_attestation/Makefile.am
@@ -31,3 +31,5 @@ attest_LDADD = \
 	$(top_builddir)/src/libpts/libpts.la \
 	$(top_builddir)/src/libstrongswan/libstrongswan.la
 attest.o :	$(top_builddir)/config.status
+
+EXTRA_DIST = build-database.sh
diff --git a/src/libpts/plugins/imv_attestation/Makefile.in b/src/libpts/plugins/imv_attestation/Makefile.in
index 989a173b5..afb4abed7 100644
--- a/src/libpts/plugins/imv_attestation/Makefile.in
+++ b/src/libpts/plugins/imv_attestation/Makefile.in
@@ -51,6 +51,7 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
 mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
 CONFIG_CLEAN_FILES =
 CONFIG_CLEAN_VPATH_FILES =
 am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
@@ -94,7 +95,7 @@ attest_OBJECTS = $(am_attest_OBJECTS)
 attest_DEPENDENCIES = $(top_builddir)/src/libimcv/libimcv.la \
 	$(top_builddir)/src/libpts/libpts.la \
 	$(top_builddir)/src/libstrongswan/libstrongswan.la
-DEFAULT_INCLUDES = -I.@am__isrc@
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
 depcomp = $(SHELL) $(top_srcdir)/depcomp
 am__depfiles_maybe = depfiles
 am__mv = mv -f
@@ -120,6 +121,7 @@ AUTOCONF = @AUTOCONF@
 AUTOHEADER = @AUTOHEADER@
 AUTOMAKE = @AUTOMAKE@
 AWK = @AWK@
+BFDLIB = @BFDLIB@
 BTLIB = @BTLIB@
 CC = @CC@
 CCDEPMODE = @CCDEPMODE@
@@ -214,11 +216,14 @@ build_os = @build_os@
 build_vendor = @build_vendor@
 builddir = @builddir@
 c_plugins = @c_plugins@
+charon_natt_port = @charon_natt_port@
+charon_plugins = @charon_plugins@
+charon_udp_port = @charon_udp_port@
 clearsilver_LIBS = @clearsilver_LIBS@
 datadir = @datadir@
 datarootdir = @datarootdir@
 dbusservicedir = @dbusservicedir@
-default_pkcs11 = @default_pkcs11@
+dev_headers = @dev_headers@
 docdir = @docdir@
 dvidir = @dvidir@
 exec_prefix = @exec_prefix@
@@ -235,11 +240,12 @@ imcvdir = @imcvdir@
 includedir = @includedir@
 infodir = @infodir@
 install_sh = @install_sh@
+ipsec_script = @ipsec_script@
+ipsec_script_upper = @ipsec_script_upper@
 ipsecdir = @ipsecdir@
 ipsecgroup = @ipsecgroup@
 ipseclibdir = @ipseclibdir@
 ipsecuser = @ipsecuser@
-libcharon_plugins = @libcharon_plugins@
 libdir = @libdir@
 libexecdir = @libexecdir@
 linux_headers = @linux_headers@
@@ -255,6 +261,7 @@ mkdir_p = @mkdir_p@
 nm_CFLAGS = @nm_CFLAGS@
 nm_LIBS = @nm_LIBS@
 nm_ca_dir = @nm_ca_dir@
+nm_plugins = @nm_plugins@
 oldincludedir = @oldincludedir@
 openac_plugins = @openac_plugins@
 p_plugins = @p_plugins@
@@ -264,7 +271,6 @@ pdfdir = @pdfdir@
 piddir = @piddir@
 pki_plugins = @pki_plugins@
 plugindir = @plugindir@
-pluto_plugins = @pluto_plugins@
 pool_plugins = @pool_plugins@
 prefix = @prefix@
 program_transform_name = @program_transform_name@
@@ -321,6 +327,7 @@ attest_LDADD = \
 	$(top_builddir)/src/libpts/libpts.la \
 	$(top_builddir)/src/libstrongswan/libstrongswan.la
 
+EXTRA_DIST = build-database.sh
 all: all-am
 
 .SUFFIXES:
diff --git a/src/libpts/plugins/imv_attestation/attest.c b/src/libpts/plugins/imv_attestation/attest.c
index 9200820e8..a202d128f 100644
--- a/src/libpts/plugins/imv_attestation/attest.c
+++ b/src/libpts/plugins/imv_attestation/attest.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Andreas Steffen
+ * Copyright (C) 2011-2012 Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -34,7 +34,7 @@
 /**
  * global debug output variables
  */
-static int debug_level = 2;
+static int debug_level = 1;
 static bool stderr_quiet = TRUE;
 
 /**
@@ -131,9 +131,14 @@ static void do_args(int argc, char *argv[])
 			{ "directory", required_argument, NULL, 'D' },
 			{ "dir", required_argument, NULL, 'D' },
 			{ "file", required_argument, NULL, 'F' },
+			{ "sha1-ima", no_argument, NULL, 'I' },
 			{ "key", required_argument, NULL, 'K' },
 			{ "owner", required_argument, NULL, 'O' },
 			{ "product", required_argument, NULL, 'P' },
+			{ "relative", no_argument, NULL, 'R' },
+			{ "rel", no_argument, NULL, 'R' },
+			{ "sequence", required_argument, NULL, 'S' },
+			{ "seq", required_argument, NULL, 'S' },
 			{ "sha1", no_argument, NULL, '1' },
 			{ "sha256", no_argument, NULL, '2' },
 			{ "sha384", no_argument, NULL, '3' },
@@ -232,6 +237,9 @@ static void do_args(int argc, char *argv[])
 					exit(EXIT_FAILURE);
 				}
 				continue;
+			case 'I':
+				attest->set_algo(attest, PTS_MEAS_ALGO_SHA1_IMA);
+				continue;
 			case 'K':
 			{
 				chunk_t aik;
@@ -252,6 +260,12 @@ static void do_args(int argc, char *argv[])
 					exit(EXIT_FAILURE);
 				}
 				continue;
+			case 'R':
+				attest->set_relative(attest);
+				continue;
+			case 'S':
+				attest->set_sequence(attest, atoi(optarg));
+				continue;
 			case '1':
 				attest->set_algo(attest, PTS_MEAS_ALGO_SHA1);
 				continue;
diff --git a/src/libpts/plugins/imv_attestation/attest_db.c b/src/libpts/plugins/imv_attestation/attest_db.c
index 88d19eee1..55afbf701 100644
--- a/src/libpts/plugins/imv_attestation/attest_db.c
+++ b/src/libpts/plugins/imv_attestation/attest_db.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Andreas Steffen
+ * Copyright (C) 2011-2012 Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -16,8 +16,14 @@
 #include "attest_db.h"
 
 #include "libpts.h"
+#include "pts/pts_meas_algo.h"
+#include "pts/pts_file_meas.h"
 #include "pts/components/pts_comp_func_name.h"
 
+#include <libgen.h>
+
+#define IMA_MAX_NAME_LEN	255
+
 typedef struct private_attest_db_t private_attest_db_t;
 
 /**
@@ -106,6 +112,16 @@ struct private_attest_db_t {
 	bool product_set;
 
 	/**
+	 * TRUE if relative filenames are to be used
+	 */
+	bool relative;
+
+	/**
+	 * Sequence number for ordering entries
+	 */
+	int seq_no;
+
+	/**
 	 * File measurement hash algorithm
 	 */
 	pts_meas_algorithms_t algo;
@@ -175,7 +191,7 @@ METHOD(attest_db_t, set_component, bool,
 	e = this->db->query(this->db,
 					   "SELECT id FROM components "
 					   "WHERE vendor_id = ? AND name = ? AND qualifier = ?",
-						DB_INT, vid, DB_INT, name, DB_INT, qualifier, DB_INT);
+						DB_UINT, vid, DB_INT, name, DB_INT, qualifier, DB_INT);
 	if (e)
 	{
 		if (e->enumerate(e, &this->cid))
@@ -231,7 +247,7 @@ METHOD(attest_db_t, set_cid, bool,
 
 	e = this->db->query(this->db, "SELECT vendor_id, name, qualifier "
 								  "FROM components WHERE id = ?",
-						DB_INT, cid, DB_INT, DB_INT, DB_INT);
+						DB_UINT, cid, DB_INT, DB_INT, DB_INT);
 	if (e)
 	{
 		if (e->enumerate(e, &vid, &name, &qualifier))
@@ -252,6 +268,7 @@ METHOD(attest_db_t, set_directory, bool,
 	private_attest_db_t *this, char *dir, bool create)
 {
 	enumerator_t *e;
+	size_t len;
 
 	if (this->dir_set)
 	{
@@ -259,6 +276,13 @@ METHOD(attest_db_t, set_directory, bool,
 		return FALSE;
 	}
 	free(this->dir);
+
+	/* remove trailing '/' character */
+	len = strlen(dir);
+	if (len && dir[len-1] == '/')
+	{
+		dir[len-1] = '\0';
+	}
 	this->dir = strdup(dir);
 
 	e = this->db->query(this->db,
@@ -308,7 +332,7 @@ METHOD(attest_db_t, set_did, bool,
 	this->did = did;
 
 	e = this->db->query(this->db, "SELECT path FROM files WHERE id = ?",
-						DB_INT, did, DB_TEXT);
+						DB_UINT, did, DB_TEXT);
 	if (e)
 	{
 		if (e->enumerate(e, &dir))
@@ -330,6 +354,7 @@ METHOD(attest_db_t, set_file, bool,
 	private_attest_db_t *this, char *file, bool create)
 {
 	enumerator_t *e;
+	char *filename;
 
 	if (this->file_set)
 	{
@@ -337,9 +362,10 @@ METHOD(attest_db_t, set_file, bool,
 		return FALSE;
 	}
 	this->file = strdup(file);
+	filename = this->relative ? basename(file) : file;
 
 	e = this->db->query(this->db, "SELECT id FROM files WHERE path = ?",
-						DB_TEXT, file, DB_INT);
+						DB_TEXT, filename, DB_INT);
 	if (e)
 	{
 		if (e->enumerate(e, &this->fid))
@@ -362,9 +388,9 @@ METHOD(attest_db_t, set_file, bool,
 	/* Add a new database entry */
 	this->file_set = this->db->execute(this->db, &this->fid,
 								"INSERT INTO files (type, path) VALUES (0, ?)",
-								DB_TEXT, file) == 1;
+								DB_TEXT, filename) == 1;
 
-	printf("file '%s' %sinserted into database\n", file,
+	printf("file '%s' %sinserted into database\n", filename,
 		   this->file_set ? "" : "could not be ");
 
 	return this->file_set;
@@ -384,7 +410,7 @@ METHOD(attest_db_t, set_fid, bool,
 	this->fid = fid;
 
 	e = this->db->query(this->db, "SELECT path FROM files WHERE id = ?",
-						DB_INT, fid, DB_TEXT);
+						DB_UINT, fid, DB_TEXT);
 	if (e)
 	{
 		if (e->enumerate(e, &file))
@@ -468,7 +494,7 @@ METHOD(attest_db_t, set_kid, bool,
 	this->kid = kid;
 
 	e = this->db->query(this->db, "SELECT keyid, owner FROM keys WHERE id = ?",
-						DB_INT, kid, DB_BLOB, DB_TEXT);
+						DB_UINT, kid, DB_BLOB, DB_TEXT);
 	if (e)
 	{
 		if (e->enumerate(e, &key, &owner))
@@ -545,7 +571,7 @@ METHOD(attest_db_t, set_pid, bool,
 	this->pid = pid;
 
 	e = this->db->query(this->db, "SELECT name FROM products WHERE id = ?",
-						DB_INT, pid, DB_TEXT);
+						DB_UINT, pid, DB_TEXT);
 	if (e)
 	{
 		if (e->enumerate(e, &product))
@@ -568,6 +594,18 @@ METHOD(attest_db_t, set_algo, void,
 	this->algo = algo;
 }
 
+METHOD(attest_db_t, set_relative, void,
+	private_attest_db_t *this)
+{
+	this->relative = TRUE;
+}
+
+METHOD(attest_db_t, set_sequence, void,
+	private_attest_db_t *this, int seq_no)
+{
+	this->seq_no = seq_no;
+}
+
 METHOD(attest_db_t, set_owner, void,
 	private_attest_db_t *this, char *owner)
 {
@@ -580,16 +618,29 @@ METHOD(attest_db_t, list_components, void,
 {
 	enumerator_t *e;
 	pts_comp_func_name_t *cfn;
-	int cid, vid, name, qualifier, count = 0;
+	int seq_no, cid, vid, name, qualifier, count = 0;
 
 	if (this->kid)
 	{
 		e = this->db->query(this->db,
-				"SELECT c.id, c.vendor_id, c.name, c.qualifier "
+				"SELECT kc.seq_no, c.id, c.vendor_id, c.name, c.qualifier "
 				"FROM components AS c "
 				"JOIN key_component AS kc ON c.id = kc.component "
-				"WHERE kc.key = ? ORDER BY c.vendor_id, c.name, c.qualifier",
-				DB_INT, this->kid, DB_INT, DB_INT, DB_INT, DB_INT);
+				"WHERE kc.key = ? ORDER BY kc.seq_no",
+				DB_UINT, this->kid, DB_INT, DB_INT, DB_INT, DB_INT, DB_INT);
+		if (e)
+		{
+			while (e->enumerate(e,  &cid, &seq_no, &vid, &name, &qualifier))
+			{
+				cfn   = pts_comp_func_name_create(vid, name, qualifier);
+				printf("%4d: #%-2d %s\n", seq_no, cid, print_cfn(cfn));
+				cfn->destroy(cfn);
+				count++;
+			}
+			e->destroy(e);
+			printf("%d component%s found for key %#B\n", count,
+				  (count == 1) ? "" : "s", &this->key);
+		}
 	}
 	else
 	{
@@ -597,24 +648,18 @@ METHOD(attest_db_t, list_components, void,
 				"SELECT id, vendor_id, name, qualifier FROM components "
 				"ORDER BY vendor_id, name, qualifier",
 				DB_INT, DB_INT, DB_INT, DB_INT);
-	}
-	if (e)
-	{
-		while (e->enumerate(e, &cid, &vid, &name, &qualifier))
-		{
-			cfn   = pts_comp_func_name_create(vid, name, qualifier);
-			printf("%3d: %s\n", cid, print_cfn(cfn));
-			cfn->destroy(cfn);
-			count++;
-		}
-		e->destroy(e);
-
-		printf("%d component%s found", count, (count == 1) ? "" : "s");
-		if (this->key_set)
+		if (e)
 		{
-			printf(" for key %#B", &this->key);
+			while (e->enumerate(e,  &cid, &vid, &name, &qualifier))
+			{
+				cfn   = pts_comp_func_name_create(vid, name, qualifier);
+				printf("%4d: %s\n", cid, print_cfn(cfn));
+				cfn->destroy(cfn);
+				count++;
+			}
+			e->destroy(e);
+			printf("%d component%s found\n", count, (count == 1) ? "" : "s");
 		}
-		printf("\n");
 	}
 }
 
@@ -632,12 +677,12 @@ METHOD(attest_db_t, list_keys, void,
 				"SELECT k.id, k.keyid, k.owner FROM keys AS k "
 				"JOIN key_component AS kc ON k.id = kc.key "
 				"WHERE kc.component = ? ORDER BY k.keyid",
-				DB_INT, this->cid, DB_INT, DB_BLOB, DB_TEXT);
+				DB_UINT, this->cid, DB_INT, DB_BLOB, DB_TEXT);
 		if (e)
 		{
 			while (e->enumerate(e, &kid, &keyid, &owner))
 			{
-				printf("%3d: %#B '%s'\n", kid, &keyid, owner);
+				printf("%4d: %#B '%s'\n", kid, &keyid, owner);
 				count++;
 			}
 			e->destroy(e);
@@ -652,7 +697,7 @@ METHOD(attest_db_t, list_keys, void,
 		{
 			while (e->enumerate(e, &kid, &keyid, &owner))
 			{
-				printf("%3d: %#B '%s'\n", kid, &keyid, owner);
+				printf("%4d: %#B '%s'\n", kid, &keyid, owner);
 				count++;
 			}
 			e->destroy(e);
@@ -681,13 +726,13 @@ METHOD(attest_db_t, list_files, void,
 				"FROM files AS f "
 				"JOIN product_file AS pf ON f.id = pf.file "
 				"WHERE pf.product = ? ORDER BY f.path",
-				DB_INT, this->pid, DB_INT, DB_INT, DB_TEXT, DB_INT, DB_INT);
+				DB_UINT, this->pid, DB_INT, DB_INT, DB_TEXT, DB_INT, DB_INT);
 		if (e)
 		{
 			while (e->enumerate(e, &fid, &type, &file, &meas, &meta))
 			{
 				type = (type < 0 || type > 2) ? 0 : type;
-				printf("%3d: |%s%s| %s %s\n", fid, meas ? "M":" ", meta ? "T":" ",
+				printf("%4d: |%s%s| %s %s\n", fid, meas ? "M":" ", meta ? "T":" ",
 											  file_type[type], file);
 				count++;
 			}
@@ -705,7 +750,7 @@ METHOD(attest_db_t, list_files, void,
 			while (e->enumerate(e, &fid, &type, &file))
 			{
 				type = (type < 0 || type > 2) ? 0 : type;
-				printf("%3d: %s %s\n", fid, file_type[type], file);
+				printf("%4d: %s %s\n", fid, file_type[type], file);
 				count++;
 			}
 			e->destroy(e);
@@ -734,12 +779,12 @@ METHOD(attest_db_t, list_products, void,
 				"FROM products AS p "
 				"JOIN product_file AS pf ON p.id = pf.product "
 				"WHERE pf.file = ? ORDER BY p.name",
-				DB_INT, this->fid, DB_INT, DB_TEXT, DB_INT, DB_INT);
+				DB_UINT, this->fid, DB_INT, DB_TEXT, DB_INT, DB_INT);
 		if (e)
 		{
 			while (e->enumerate(e, &pid, &product, &meas, &meta))
 			{
-				printf("%3d: |%s%s| %s\n", pid, meas ? "M":" ", meta ? "T":" ",
+				printf("%4d: |%s%s| %s\n", pid, meas ? "M":" ", meta ? "T":" ",
 										   product);
 				count++;
 			}
@@ -755,7 +800,7 @@ METHOD(attest_db_t, list_products, void,
 		{
 			while (e->enumerate(e, &pid, &product))
 			{
-				printf("%3d: %s\n", pid, product);
+				printf("%4d: %s\n", pid, product);
 				count++;
 			}
 			e->destroy(e);
@@ -785,7 +830,7 @@ static void get_directory(private_attest_db_t *this, int did, char **directory)
 	{
 		e = this->db->query(this->db,
 				"SELECT path from files WHERE id = ?",
-				DB_INT, did, DB_TEXT);
+				DB_UINT, did, DB_TEXT);
 		if (e)
 		{
 			if (e->enumerate(e, &dir))
@@ -826,17 +871,17 @@ METHOD(attest_db_t, list_hashes, void,
 			{
 				if (this->fid != fid_old)
 				{
-					printf("%3d: %s%s%s\n", this->fid, this->dir,
+					printf("%4d: %s%s%s\n", this->fid, this->dir,
 						   slash(this->dir, this->file) ? "/" : "", this->file);
 					fid_old = this->fid;
 				}
-				printf("     %#B\n", &hash);
+				printf("      %#B\n", &hash);
 				count++;
 			}
 			e->destroy(e);
 
 			printf("%d %N value%s found for product '%s'\n", count,
-				   hash_algorithm_names, pts_meas_algo_to_hash(this->algo),
+				   pts_meas_algorithm_names, this->algo,
 				   (count == 1) ? "" : "s", this->product);
 		}
 	}
@@ -848,7 +893,7 @@ METHOD(attest_db_t, list_hashes, void,
 				"JOIN files AS f ON f.id = fh.file "
 				"WHERE fh.algo = ? AND fh.product = ? "
 				"ORDER BY fh.directory, f.path",
-				DB_INT, this->algo, DB_INT, this->pid,
+				DB_INT, this->algo, DB_UINT, this->pid,
 				DB_INT, DB_TEXT, DB_BLOB, DB_INT);
 		if (e)
 		{
@@ -860,18 +905,18 @@ METHOD(attest_db_t, list_hashes, void,
 					{
 						get_directory(this, did, &dir);
 					}
-					printf("%3d: %s%s%s\n", fid,
+					printf("%4d: %s%s%s\n", fid,
 						   dir, slash(dir, file) ? "/" : "", file);
 					fid_old = fid;
 					did_old = did;
 				}
-				printf("     %#B\n", &hash);
+				printf("      %#B\n", &hash);
 				count++;
 			}
 			e->destroy(e);
 
 			printf("%d %N value%s found for product '%s'\n", count,
-				   hash_algorithm_names, pts_meas_algo_to_hash(this->algo),
+				   pts_meas_algorithm_names, this->algo,
 				   (count == 1) ? "" : "s", this->product);
 		}
 	}
@@ -883,7 +928,7 @@ METHOD(attest_db_t, list_hashes, void,
 				"JOIN products AS p ON p.id = fh.product "
 				"WHERE fh.algo = ? AND fh.file = ? AND fh.directory = ?"
 				"ORDER BY p.name",
-				DB_INT, this->algo, DB_INT, this->fid, DB_INT, this->did,
+				DB_INT, this->algo, DB_UINT, this->fid, DB_UINT, this->did,
 				DB_TEXT, DB_BLOB, DB_INT);
 		if (e)
 		{
@@ -895,7 +940,7 @@ METHOD(attest_db_t, list_hashes, void,
 			e->destroy(e);
 
 			printf("%d %N value%s found for file '%s%s%s'\n",
-				   count, hash_algorithm_names, pts_meas_algo_to_hash(this->algo),
+				   count, pts_meas_algorithm_names, this->algo,
 				   (count == 1) ? "" : "s", this->dir,
 				   slash(this->dir, this->file) ? "/" : "", this->file);
 		}
@@ -922,17 +967,17 @@ METHOD(attest_db_t, list_hashes, void,
 						get_directory(this, did, &dir);
 						did_old = did;
 					}
-					printf("%3d: %s%s%s\n", fid,
+					printf("%4d: %s%s%s\n", fid,
 						   dir, slash(dir, file) ? "/" : "", file);
 					fid_old = fid;
 				}
-				printf("     %#B '%s'\n", &hash, product);
+				printf("      %#B '%s'\n", &hash, product);
 				count++;
 			}
 			e->destroy(e);
 
-			printf("%d %N value%s found\n", count, hash_algorithm_names,
-				   pts_meas_algo_to_hash(this->algo), (count == 1) ? "" : "s");
+			printf("%d %N value%s found\n", count, pts_meas_algorithm_names,
+				   this->algo, (count == 1) ? "" : "s");
 		}
 	}
 	free(dir);
@@ -956,7 +1001,7 @@ METHOD(attest_db_t, list_measurements, void,
 				"JOIN keys AS k ON k.id = ch.key "
 				"WHERE ch.algo = ? AND ch.key = ? AND ch.component = ? "
 				"ORDER BY seq_no",
-				DB_INT, this->algo, DB_INT, this->kid, DB_INT, this->cid,
+				DB_INT, this->algo, DB_UINT, this->kid, DB_UINT, this->cid,
 				DB_INT, DB_INT, DB_BLOB, DB_TEXT);
 		if (e)
 		{
@@ -964,16 +1009,16 @@ METHOD(attest_db_t, list_measurements, void,
 			{
 				if (this->kid != kid_old)
 				{
-					printf("%3d: %#B '%s'\n", this->kid, &this->key, owner);
+					printf("%4d: %#B '%s'\n", this->kid, &this->key, owner);
 					kid_old = this->kid;
 				}
-				printf("%5d %02d %#B\n", seq_no, pcr, &hash);
+				printf("%7d %02d %#B\n", seq_no, pcr, &hash);
 				count++;
 			}
 			e->destroy(e);
 
 			printf("%d %N value%s found for component '%s'\n", count,
-				   hash_algorithm_names, pts_meas_algo_to_hash(this->algo),
+				   pts_meas_algorithm_names, this->algo,
 				   (count == 1) ? "" : "s", print_cfn(this->cfn));
 		}
 	}
@@ -985,7 +1030,7 @@ METHOD(attest_db_t, list_measurements, void,
 				"JOIN keys AS k ON k.id = ch.key "
 				"WHERE ch.algo = ? AND ch.component = ? "
 				"ORDER BY keyid, seq_no",
-				DB_INT, this->algo, DB_INT, this->cid,
+				DB_INT, this->algo, DB_UINT, this->cid,
 				DB_INT, DB_INT, DB_BLOB, DB_INT, DB_BLOB, DB_TEXT);
 		if (e)
 		{
@@ -993,16 +1038,16 @@ METHOD(attest_db_t, list_measurements, void,
 			{
 				if (kid != kid_old)
 				{
-					printf("%3d: %#B '%s'\n", kid, &keyid, owner);
+					printf("%4d: %#B '%s'\n", kid, &keyid, owner);
 					kid_old = kid;
 				}
-				printf("%5d %02d %#B\n", seq_no, pcr, &hash);
+				printf("%7d %02d %#B\n", seq_no, pcr, &hash);
 				count++;
 			}
 			e->destroy(e);
 
 			printf("%d %N value%s found for component '%s'\n", count,
-				   hash_algorithm_names, pts_meas_algo_to_hash(this->algo),
+				   pts_meas_algorithm_names, this->algo,
 				   (count == 1) ? "" : "s", print_cfn(this->cfn));
 		}
 
@@ -1016,7 +1061,7 @@ METHOD(attest_db_t, list_measurements, void,
 				"JOIN components AS c ON c.id = ch.component "
 				"WHERE ch.algo = ? AND ch.key = ? "
 				"ORDER BY vendor_id, name, qualifier, seq_no",
-				DB_INT, this->algo, DB_INT, this->kid, DB_INT, DB_INT, DB_BLOB,
+				DB_INT, this->algo, DB_UINT, this->kid, DB_INT, DB_INT, DB_BLOB,
 				DB_INT, DB_INT, DB_INT, DB_INT);
 		if (e)
 		{
@@ -1026,7 +1071,7 @@ METHOD(attest_db_t, list_measurements, void,
 				if (cid != cid_old)
 				{
 					cfn = pts_comp_func_name_create(vid, name, qualifier);
-					printf("%3d: %s\n", cid, print_cfn(cfn));
+					printf("%4d: %s\n", cid, print_cfn(cfn));
 					cfn->destroy(cfn);
 					cid_old = cid;
 				}
@@ -1036,25 +1081,189 @@ METHOD(attest_db_t, list_measurements, void,
 			e->destroy(e);
 
 			printf("%d %N value%s found for key %#B '%s'\n", count,
-				   hash_algorithm_names, pts_meas_algo_to_hash(this->algo),
+				   pts_meas_algorithm_names, this->algo,
 				   (count == 1) ? "" : "s", &this->key, this->owner);
 		}
 	}
 }
 
+bool insert_file_hash(private_attest_db_t *this, pts_meas_algorithms_t algo,
+					  chunk_t measurement, int fid, int did, bool ima,
+					  int *hashes_added)
+{
+	enumerator_t *e;
+	chunk_t hash;
+	char *label;
+
+	label = "could not be created";
+
+	e = this->db->query(this->db,
+		"SELECT hash FROM file_hashes WHERE algo = ? "
+		"AND file = ? AND directory = ? AND product = ? and key = 0",
+		DB_INT, algo, DB_UINT, fid, DB_UINT, did, DB_UINT, this->pid, DB_BLOB);
+	if (!e)
+	{
+		printf("file_hashes query failed\n");
+		return FALSE;
+	}
+	if (e->enumerate(e, &hash))
+	{
+		label = chunk_equals(measurement, hash) ?
+				"exists and equals" : "exists and differs";
+	}
+	else
+	{
+		if (this->db->execute(this->db, NULL,
+			"INSERT INTO file_hashes "
+			"(file, directory, product, key, algo, hash) "
+			"VALUES (?, ?, ?, 0, ?, ?)",
+			DB_UINT, fid, DB_UINT, did, DB_UINT, this->pid,
+			DB_INT, algo, DB_BLOB, measurement) == 1)
+		{
+			label = "created";
+			(*hashes_added)++;
+		}
+	}
+	e->destroy(e);
+
+	printf("     %#B - %s%s\n", &measurement, ima ? "ima - " : "", label);
+	return TRUE;
+}
+
 METHOD(attest_db_t, add, bool,
 	private_attest_db_t *this)
 {
 	bool success = FALSE;
 
+	/* add key/component pair */
 	if (this->kid && this->cid)
 	{
 		success = this->db->execute(this->db, NULL,
-					"INSERT INTO key_component (key, component) VALUES (?, ?)",
-					DB_UINT, this->kid, DB_UINT, this->cid) == 1;
+					"INSERT INTO key_component (key, component, seq_no) "
+					"VALUES (?, ?, ?)",
+					DB_UINT, this->kid, DB_UINT, this->cid,
+					DB_UINT, this->seq_no) == 1;
 
-		printf("key/component pair (%d/%d) %sinserted into database\n",
-				this->kid, this->cid, success ? "" : "could not be ");
+		printf("key/component pair (%d/%d) %sinserted into database at "
+			   "position %d\n", this->kid, this->cid,
+			    success ? "" : "could not be ", this->seq_no);
+
+		return success;
+	}
+
+	/* add directory or file measurement for a given product */
+	if ((this->did || this->fid) && this->pid)
+	{
+		char *pathname, *filename, *label;
+		char ima_buffer[IMA_MAX_NAME_LEN + 1];
+		chunk_t measurement, ima_template;
+		pts_file_meas_t *measurements;
+		hasher_t *hasher = NULL;
+		bool ima = FALSE;
+		int fid, did;
+		int files_added = 0, hashes_added = 0, ima_hashes_added = 0;
+		enumerator_t *enumerator, *e;
+
+		if (this->algo == PTS_MEAS_ALGO_SHA1_IMA)
+		{
+			ima = TRUE;
+			this->algo = PTS_MEAS_ALGO_SHA1;
+			hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
+			if (!hasher)
+			{
+				printf("could not create hasher\n");
+				return FALSE;
+			}
+		}
+
+		pathname = this->did ? this->dir : this->file;
+		measurements = pts_file_meas_create_from_path(0, pathname, this->did,
+												this->relative, this->algo);
+		if (!measurements)
+		{
+			printf("file measurement failed\n");
+			DESTROY_IF(hasher);
+			return FALSE;
+		}
+		if (this->fid && this->relative)
+		{
+			set_directory(this, dirname(pathname), TRUE);
+		}
+		did = this->relative ? this->did : 0;
+
+		enumerator = measurements->create_enumerator(measurements);
+		while (enumerator->enumerate(enumerator, &filename, &measurement))
+		{
+			/* retrieve or create filename */
+			label = "could not be created";
+
+			e = this->db->query(this->db,
+				"SELECT id FROM files WHERE path = ?",
+				DB_TEXT, filename, DB_INT);
+			if (!e)
+			{
+				printf("files query failed\n");
+				break;
+			}
+			if (e->enumerate(e, &fid))
+			{
+				label = "exists";
+			}
+			else
+			{
+				if (this->db->execute(this->db, &fid,
+					"INSERT INTO files (type, path) VALUES (0, ?)",
+					DB_TEXT, filename) == 1)
+				{
+					label = "created";
+					files_added++;
+				}
+			}
+			e->destroy(e);
+
+			printf("%4d: %s - %s\n", fid, filename, label);
+
+			/* compute file measurement hash */
+			if (!insert_file_hash(this, this->algo, measurement,
+								  fid, did, FALSE, &hashes_added))
+			{
+				break;
+			}
+
+			if (!ima)
+			{
+				continue;
+			}
+
+			/* compute IMA template hash */
+			strncpy(ima_buffer, filename, IMA_MAX_NAME_LEN);
+			ima_buffer[IMA_MAX_NAME_LEN] = '\0';
+			ima_template = chunk_create(ima_buffer, sizeof(ima_buffer));
+			if (!hasher->get_hash(hasher, measurement, NULL) ||
+				!hasher->get_hash(hasher, ima_template, measurement.ptr))
+			{
+				printf("could not compute IMA template hash\n");
+				break;
+			}
+			if (!insert_file_hash(this, PTS_MEAS_ALGO_SHA1_IMA, measurement,
+								  fid, did, TRUE, &ima_hashes_added))
+			{
+				break;
+			}
+		}
+		enumerator->destroy(enumerator);
+
+		printf("%d measurements, added %d new files, %d new file hashes",
+			    measurements->get_file_count(measurements),
+			    files_added, hashes_added);
+		if (ima)
+		{
+			printf(" , %d new ima hashes", ima_hashes_added);
+			hasher->destroy(hasher);
+		}
+		printf("\n");
+		measurements->destroy(measurements);
+		success = TRUE;
 	}
 	return success;
 }
@@ -1064,12 +1273,42 @@ METHOD(attest_db_t, delete, bool,
 {
 	bool success;
 
+	/* delete a file measurement hash for a given product */
+	if (this->algo && this->pid && this->fid)
+	{
+		success = this->db->execute(this->db, NULL,
+								"DELETE FROM file_hashes "
+								"WHERE algo = ? AND product = ? "
+								"AND file = ? AND directory = ?",
+								DB_UINT, this->algo, DB_UINT, this->pid,
+								DB_UINT, this->fid, DB_UINT, this->did) > 0;
+
+		printf("%4d: %s%s%s\n", this->fid, this->dir, this->did ? "/":"",
+								this->file);
+		printf("%N value for product '%s' %sdeleted from database\n",
+				pts_meas_algorithm_names, this->algo, this->product,
+				success ? "" : "could not be ");
+
+		return success;
+	}
+
+	/* delete product/file entries */
 	if (this->pid && (this->fid || this->did))
 	{
-		printf("deletion of product/file entries not supported yet\n");
-		return FALSE;
+		success = this->db->execute(this->db, NULL,
+							"DELETE FROM product_file "
+							"WHERE product = ? AND file = ?",
+							DB_UINT, this->pid,
+							DB_UINT, this->fid ? this->fid : this->did) > 0;
+
+		printf("product/file pair (%d/%d) %sdeleted from database\n",
+				this->pid, this->fid ? this->fid : this->did,
+				success ? "" : "could not be ");
+
+		return success;
 	}
 
+	/* delete key/component pair */
 	if (this->kid && this->cid)
 	{
 		success = this->db->execute(this->db, NULL,
@@ -1173,6 +1412,8 @@ attest_db_t *attest_db_create(char *uri)
 			.set_product = _set_product,
 			.set_pid = _set_pid,
 			.set_algo = _set_algo,
+			.set_relative = _set_relative,
+			.set_sequence = _set_sequence,
 			.set_owner = _set_owner,
 			.list_products = _list_products,
 			.list_files = _list_files,
@@ -1185,7 +1426,6 @@ attest_db_t *attest_db_create(char *uri)
 			.destroy = _destroy,
 		},
 		.dir = strdup(""),
-		.algo = PTS_MEAS_ALGO_SHA256,
 		.db = lib->db->create(lib->db, uri),
 	);
 
diff --git a/src/libpts/plugins/imv_attestation/attest_db.h b/src/libpts/plugins/imv_attestation/attest_db.h
index 9c9a9dcba..e32a368d8 100644
--- a/src/libpts/plugins/imv_attestation/attest_db.h
+++ b/src/libpts/plugins/imv_attestation/attest_db.h
@@ -126,6 +126,21 @@ struct attest_db_t {
 	void (*set_algo)(attest_db_t *this, pts_meas_algorithms_t algo);
 
 	/**
+	 * Set that the IMA-specific SHA-1 template hash be computed
+	 */
+	void (*set_ima)(attest_db_t *this);
+
+	/**
+	 * Set that relative filenames are to be used
+	 */
+	void (*set_relative)(attest_db_t *this);
+
+	/**
+	 * Set the sequence number
+	 */
+	void (*set_sequence)(attest_db_t *this, int seq_no);
+
+	/**
 	 * Set owner [user/host] of an AIK
 	 *
 	 * @param owner			user/host name
diff --git a/src/libpts/plugins/imv_attestation/attest_usage.c b/src/libpts/plugins/imv_attestation/attest_usage.c
index e58f821e0..f7040f7ad 100644
--- a/src/libpts/plugins/imv_attestation/attest_usage.c
+++ b/src/libpts/plugins/imv_attestation/attest_usage.c
@@ -40,7 +40,7 @@ Usage:\n\
     Show a list of measurement hashes for a given software product or\n\
     its primary key as an optional selector.\n\
   \n\
-  ipsec attest --hashes [--sha1|--sha256|--sha384] [--file <path>|--fid <id>]\n\
+  ipsec attest --hashes [--sha1|--sha1-ima|--sha256|--sha384] [--file <path>|--fid <id>]\n\
     Show a list of measurement hashes for a given file or\n\
     its primary key as an optional selector.\n\
   \n\
@@ -52,11 +52,11 @@ Usage:\n\
     Show a list of AIK key digests with a component or\n\
     its primary key as an optional selector.\n\
   \n\
-  ipsec attest --measurements [--sha1|--sha256|--sha384] [--component <cfn>|--cid <id>]\n\
+  ipsec attest --measurements --sha1|--sha256|--sha384 [--component <cfn>|--cid <id>]\n\
     Show a list of component measurements for a given component or\n\
     its primary key as an optional selector.\n\
   \n\
-  ipsec attest --measurements [--sha1|--sha256|--sha384] [--key <digest>|--kid <id>|--aik <path>]\n\
+  ipsec attest --measurements --sha1|--sha256|--sha384 [--key <digest>|--kid <id>|--aik <path>]\n\
     Show a list of component measurements for a given AIK or\n\
     its primary key as an optional selector.\n\
   \n\
@@ -67,14 +67,31 @@ Usage:\n\
   ipsec attest --add [--owner <name>] --key <digest>|--aik <path>\n\
     Add an AIK public key digest entry preceded by an optional owner name\n\
   \n\
+  ipsec attest --add --product <name>|--pid <id> --sha1|--sha1-ima|--sha256|--sha384\n\
+              [--relative|--rel] --dir <path>|--file <path>\n\
+    Add hashes of a single file or all files in a directory under absolute or relative filenames\n\
+  \n\
+  ipsec attest --add --key <digest|--kid <id> --component <cfn>|--cid <id> --sequence <no>|--seq <no>\n\
+    Add an ordered key/component entry\n\
+  \n\
   ipsec attest --del --file <path>|--fid <id>|--dir <path>|--did <id>\n\
     Delete a file or directory entry referenced either by value or primary key\n\
   \n\
   ipsec attest --del --product <name>|--pid <id>|--component <cfn>|--cid <id>\n\
     Delete a product or component entry referenced either by value or primary key\n\
   \n\
+  ipsec attest --del --product <name>|--pid <id> --file <path>|--fid <id>|--dir <path>|--did <id>\n\
+    Delete a product/file entry referenced either by value or primary key\n\
+  \n\
   ipsec attest --del --key <digest>|--kid <id>|--aik <path>\n\
     Delete an AIK entry referenced either by value or primary key\n\
+  \n\
+  ipsec attest --del --key <digest|--kid <id> --component <cfn>|--cid <id>\n\
+    Delete a key/component entry\n\
+  \n\
+  ipsec attest --del --product <name>|--pid <id> --sha1|--sha1-ima|--sha256|--sha384\n\
+               [--dir <path>|--did <id>] --file <path>|--fid <id>\n\
+    Delete a file hash given an absolute or relative filename\n\
   \n");
 }
 
diff --git a/src/libpts/plugins/imv_attestation/build-database.sh b/src/libpts/plugins/imv_attestation/build-database.sh
new file mode 100755
index 000000000..a89258e1d
--- /dev/null
+++ b/src/libpts/plugins/imv_attestation/build-database.sh
@@ -0,0 +1,221 @@
+#!/bin/sh
+
+p="Ubuntu 12.04.1 LTS i686"
+
+ipsec attest --add --product "$p" --sha1-ima --dir  /sbin 
+ipsec attest --add --product "$p" --sha1-ima --dir  /usr/sbin
+ipsec attest --add --product "$p" --sha1-ima --dir  /bin
+ipsec attest --add --product "$p" --sha1-ima --dir  /usr/bin
+ipsec attest --add --product "$p" --sha1-ima --dir  /etc/acpi
+ipsec attest --add --product "$p" --sha1-ima --file /etc/init.d/rc
+ipsec attest --add --product "$p" --sha1-ima --file /etc/init.d/rcS
+ipsec attest --add --product "$p" --sha1-ima --dir  /etc/network/if-post-down.d
+ipsec attest --add --product "$p" --sha1-ima --dir  /etc/network/if-pre-up.d
+ipsec attest --add --product "$p" --sha1-ima --dir  /etc/network/if-up.d
+ipsec attest --add --product "$p" --sha1-ima --file /etc/NetworkManager/dispatcher.d/01ifupdown
+ipsec attest --add --product "$p" --sha1-ima --dir  /etc/ppp/ip-down.d
+ipsec attest --add --product "$p" --sha1-ima --dir  /etc/rc2.d
+ipsec attest --add --product "$p" --sha1-ima --dir  /etc/rcS.d
+ipsec attest --add --product "$p" --sha1-ima --file /etc/rc.local
+ipsec attest --add --product "$p" --sha1-ima --dir  /etc/resolvconf/update.d
+ipsec attest --add --product "$p" --sha1-ima --file /etc/resolvconf/update-libc.d/avahi-daemon
+ipsec attest --add --product "$p" --sha1-ima --dir  /etc/update-motd.d
+ipsec attest --add --product "$p" --sha1-ima --file /lib/crda/setregdomain
+ipsec attest --add --product "$p" --sha1-ima --file /lib/init/apparmor-profile-load
+ipsec attest --add --product "$p" --sha1-ima --file /lib/resolvconf/list-records
+ipsec attest --add --product "$p" --sha1-ima --dir  /lib/udev
+ipsec attest --add --product "$p" --sha1-ima --file /lib/ufw/ufw-init
+ipsec attest --add --product "$p" --sha1-ima --file /opt/Adobe/Reader9/Reader/intellinux/bin/acroread
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/accountsservice/accounts-daemon
+ipsec attest --add --product "$p" --sha1-ima --dir  /usr/lib/apt/methods
+ipsec attest --add --product "$p" --sha1-ima --dir  /usr/lib/at-spi2-core
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/avahi/avahi-daemon-check-dns.sh
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/bamf/bamfdaemon
+ipsec attest --add --product "$p" --sha1-ima --dir  /usr/lib/ConsoleKit
+ipsec attest --add --product "$p" --sha1-ima --dir  /usr/lib/ConsoleKit/run-seat.d
+ipsec attest --add --product "$p" --sha1-ima --dir  /usr/lib/ConsoleKit/run-session.d
+ipsec attest --add --product "$p" --sha1-ima --dir  /usr/lib/cups/notifier
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/dconf/dconf-service
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/dbus-1.0/dbus-daemon-launch-helper
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/deja-dup/deja-dup/deja-dup-monitor
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/evolution/3.2/evolution-alarm-notify
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/firefox/firefox
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/firefox/plugin-container
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/gcc/i686-linux-gnu/4.6/cc1
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/gcc/i686-linux-gnu/4.6/collect2
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/geoclue/geoclue-master
+ipsec attest --add --product "$p" --sha1-ima --dir  /usr/lib/git-core
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/gnome-desktop3/check_gl_texture_size
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/gnome-disk-utility/gdu-notification-daemon
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/gnome-online-accounts/goa-daemon
+ipsec attest --add --product "$p" --sha1-ima --dir  /usr/lib/gnome-settings-daemon
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/gnome-user-share/gnome-user-share
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/gnome-screensaver/gnome-screensaver-dialog
+ipsec attest --add --product "$p" --sha1-ima --dir  /usr/lib/gvfs
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/gvfs//gvfs-fuse-daemon
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/i386-linux-gnu/colord/colord
+ipsec attest --add --product "$p" --sha1-ima --dir  /usr/lib/i386-linux-gnu/gconf
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/indicator-application/indicator-application-service
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/indicator-appmenu/hud-service
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/indicator-datetime/indicator-datetime-service
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/indicator-messages/indicator-messages-service
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/indicator-printers/indicator-printers-service
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/indicator-session/indicator-session-service
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/indicator-sound/indicator-sound-service
+ipsec attest --add --product "$p" --sha1-ima --dir  /usr/lib/lightdm
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/NetworkManager/nm-dhcp-client.action
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/NetworkManager/nm-dispatcher.action
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/notify-osd/notify-osd
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/nux/unity_support_test
+ipsec attest --add --product "$p" --sha1-ima --dir  /usr/lib/pm-utils/power.d
+ipsec attest --add --product "$p" --sha1-ima --dir  /usr/lib/pm-utils/sleep.d
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/policykit-1/polkitd
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/pulseaudio/pulse/gconf-helper
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/rtkit/rtkit-daemon
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/system-service/system-service-d
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/telepathy/mission-control-5
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/thunderbird/thunderbird
+ipsec attest --add --product "$p" --sha1-ima --dir  /usr/lib/ubuntuone-client
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/ubuntu-geoip/ubuntu-geoip-provider
+ipsec attest --add --product "$p" --sha1-ima --dir  /usr/lib/ubuntu-sso-client
+ipsec attest --add --product "$p" --sha1-ima --dir  /usr/lib/udisks
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/unity/unity-panel-service
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/unity-lens-applications/unity-applications-daemon
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/unity-lens-files/unity-files-daemon
+ipsec attest --add --product "$p" --sha1-ima --dir /usr/lib/unity-lens-music
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/unity-lens-video/unity-lens-video
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/unity-scope-video-remote/unity-scope-video-remote
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/update-manager/release-upgrade-motd
+ipsec attest --add --product "$p" --sha1-ima --dir  /usr/lib/update-notifier
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/upower/upowerd
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/libvte-2.90-9/gnome-pty-helper
+ipsec attest --add --product "$p" --sha1-ima --file /usr/lib/zeitgeist/zeitgeist-fts
+ipsec attest --add --product "$p" --sha1-ima --file /usr/share/apport/apport
+ipsec attest --add --product "$p" --sha1-ima --file /usr/share/apport/apport-checkreports
+ipsec attest --add --product "$p" --sha1-ima --file /usr/share/apport/apport-gtk
+ipsec attest --add --product "$p" --sha1-ima --dir  /usr/share/language-tools
+ipsec attest --add --product "$p" --sha1-ima --file /usr/share/virtualbox/VBoxCreateUSBNode.sh
+ipsec attest --add --product "$p" --sha1-ima --relative --file /etc/ld.so.cache
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /lib
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /lib/i386-linux-gnu
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /lib/i386-linux-gnu/security
+for file in `find /lib/modules/3.2.21ima/kernel -name *.ko`
+do
+ipsec attest --add --product "$p" --sha1-ima --relative --file $file
+done
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /lib/plymouth
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /lib/plymouth/renderers
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /lib/security
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /opt/Adobe/Reader9/Reader/intellinux/lib
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/apache2/modules
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/compiz
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/compizconfig/backends/
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/enchant
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/evolution/3.2/libemiscwidgets.so.0.0.0
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/evolution/3.2/libeutil.so.0.0.0
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/evolution/3.2/libgnomecanvas.so.0.0.0
+for file in /usr/lib/firefox/*.so
+do
+ipsec attest --add --product "$p" --sha1-ima --relative --file $file
+done
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/firefox/components/libbrowsercomps.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/firefox/components/libdbusservice.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/firefox/components/libmozgnome.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/firefox-addons/extensions/globalmenu@ubuntu.com/components/libglobalmenu.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/firefox-addons/plugins/nppdf.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/flashplugin-installer/libflashplayer.so
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/gedit/plugins
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/gnome-bluetooth
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/gnome-settings-daemon-3.0
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/gtk-2.0/2.10.0/menuproxies
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/gtk-3.0/3.0.0/menuproxies
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/gtk-3.0/3.0.0/theming-engines
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/alsa-lib
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/dri
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/gconf/2
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/gconv
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/gio/modules
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/gtk-2.0/modules
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/gtk-2.0/2.10.0/engines
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/gtk-2.0/2.10.0/immodules
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/gtk-3.0/modules
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/gtk-3.0/3.0.0/immodules
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/gvfs
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/libcanberra-0.28
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/mesa
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/mit-krb5
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/openssl-1.0.0/engines
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/pango/1.6.0/modules
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/pkcs11
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/polkit-1/extensions
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/nss
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/sane
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/i386-linux-gnu/sse2
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/indicators3/7
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/indicator-messages/status-providers/1
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/libpeas-1.0/loaders
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/man-db/libman-2.6.1.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/man-db/libmandb-2.6.1.so
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/mission-control-plugins.0
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/ModemManager
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/nautilus/extensions-3.0
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/NetworkManager/libnm-settings-plugin-ifupdown.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/perl/5.14.2/auto/File/Glob/Glob.so
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/pulse-1.1/modules
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/python2.7/lib-dynload
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/apt_inst.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/apt_pkg.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/cairo/_cairo.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/dbus/mainloop/qt.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/_dbus_bindings.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/_dbus_glib_bindings.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/duplicity/_librsync.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/gi/_gi.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/gi/_gobject/_gobject.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/gi/_glib/_glib.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/glib/_glib.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/gobject/_gobject.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/gtk-2.0/atk.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/gtk-2.0/gtk/_gtk.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/gtk-2.0/gio/_gio.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/gtk-2.0/gio/unix.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/gtk-2.0/pango.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/gtk-2.0/pangocairo.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/gtk-2.0/pynotify/_pynotify.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/OpenSSL/crypto.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/OpenSSL/rand.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/OpenSSL/SSL.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/PyQt4/QtCore.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/simplejson/_speedups.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/sip.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/twisted/internet/_sigchld.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/twisted/python/_initgroups.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/xapian/_xapian.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/python2.7/dist-packages/zope/interface/_zope_interface_coptimizations.so
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/rsyslog
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/sane
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/sse2
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/sudo
+for file in /usr/lib/thunderbird/*.so
+do
+ipsec attest --add --product "$p" --sha1-ima --relative --file $file
+done
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/thunderbird/components/libdbusservice.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/thunderbird/components/libmozgnome.so
+ipsec attest --add --product "$p" --sha1-ima --relative --file /usr/lib/thunderbird-addons/extensions/globalmenu@ubuntu.com/components/libglobalmenu.so
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/xorg/modules
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/xorg/modules/drivers
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/xorg/modules/extensions
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/lib/xorg/modules/input
+ipsec attest --add --product "$p" --sha1-ima --relative --dir  /usr/share/fonts/truetype/ubuntu-font-family
+ipsec attest --del --product "$p" --sha1                --file /lib/resolvconf/list-records
+ipsec attest --del --product "$p" --sha1-ima            --file /lib/resolvconf/list-records
+ipsec attest --del --product "$p" --sha1                --file /usr/bin/lsb_release
+ipsec attest --del --product "$p" --sha1-ima            --file /usr/bin/lsb_release
+ipsec attest --del --product "$p" --sha1                --file /usr/share/language-tools/language-options
+ipsec attest --del --product "$p" --sha1-ima            --file /usr/share/language-tools/language-options
+
diff --git a/src/libpts/plugins/imv_attestation/data.sql b/src/libpts/plugins/imv_attestation/data.sql
index e6e03627a..b1646b724 100644
--- a/src/libpts/plugins/imv_attestation/data.sql
+++ b/src/libpts/plugins/imv_attestation/data.sql
@@ -42,6 +42,18 @@ INSERT INTO products (
  'Ubuntu 11.10 i686'
 );
 
+INSERT INTO products (
+  name
+) VALUES (
+ 'Ubuntu 12.04 LTS i686'
+);
+
+INSERT INTO products (
+  name
+) VALUES (
+ 'Ubuntu 12.04.1 LTS i686'
+);
+
 /* Files */
 
 INSERT INTO files (			/* 1 */
@@ -83,7 +95,7 @@ INSERT INTO files (
 INSERT INTO files (
   type, path
 ) VALUES (
-  1, '/lib/xtables/'
+  1, '/lib/xtables'
 );
 
 INSERT INTO files (
@@ -176,6 +188,19 @@ INSERT INTO files (
   0, '/etc/tnc_config'
 );
 
+INSERT INTO files (
+  type, path
+) VALUES (
+  0, '/lib/libxtables.so.7'
+);
+
+INSERT INTO files (
+  type, path
+) VALUES (
+  0, '/sbin/xtables-multi'
+);
+
+
 /* Product-File */
 
 INSERT INTO product_file (
@@ -388,6 +413,48 @@ INSERT INTO product_file (
   7, 22, 1
 );
 
+INSERT INTO product_file (
+  product, file, measurement
+) VALUES (
+  8, 1, 1
+);
+
+INSERT INTO product_file (
+  product, file, measurement
+) VALUES (
+  8, 7, 1
+);
+
+INSERT INTO product_file (
+  product, file, metadata
+) VALUES (
+  8, 22, 1
+);
+
+INSERT INTO product_file (
+  product, file, measurement
+) VALUES (
+  8, 23, 1
+);
+
+INSERT INTO product_file (
+  product, file, measurement
+) VALUES (
+  8, 24, 1
+);
+
+INSERT INTO product_file (
+  product, file, measurement
+) VALUES (
+  9, 1, 1
+);
+
+INSERT INTO product_file (
+  product, file, metadata
+) VALUES (
+  9, 22, 1
+);
+
 /* File Hashes */
 
 INSERT INTO file_hashes (
@@ -429,6 +496,42 @@ INSERT INTO file_hashes (
 INSERT INTO file_hashes (
   file, product, algo, hash
 ) VALUES (
+  1, 8, 32768, X'9c3ed3179990c0ffb3a65b75a09b61faa4aca907'
+);
+
+INSERT INTO file_hashes (
+  file, product, algo, hash
+) VALUES (
+  1, 8, 16384, X'af474dd532c9f2d85c12368334eda3609a7c6287e08940f078547ab0f2871c94'
+);
+
+INSERT INTO file_hashes (
+  file, product, algo, hash
+) VALUES (
+  1, 8, 8192, X'a23fa7034dabdce2d10f2893d52b21d14fe24c6ae4c8570fb6c7190228046e4c064c4d29d736cd84ca42a3d9abf9bfde'
+);
+
+INSERT INTO file_hashes (
+  file, product, algo, hash
+) VALUES (
+  1, 9, 32768, X'9c3ed3179990c0ffb3a65b75a09b61faa4aca907'
+);
+
+INSERT INTO file_hashes (
+  file, product, algo, hash
+) VALUES (
+  1, 9, 16384, X'af474dd532c9f2d85c12368334eda3609a7c6287e08940f078547ab0f2871c94'
+);
+
+INSERT INTO file_hashes (
+  file, product, algo, hash
+) VALUES (
+  1, 9, 8192, X'a23fa7034dabdce2d10f2893d52b21d14fe24c6ae4c8570fb6c7190228046e4c064c4d29d736cd84ca42a3d9abf9bfde'
+);
+
+INSERT INTO file_hashes (
+  file, product, algo, hash
+) VALUES (
   2, 2, 32768, X'2a4047437e6fb346e2d854fc415e16b80e75bf6b'
 );
 
@@ -736,6 +839,24 @@ INSERT INTO file_hashes (
 INSERT INTO file_hashes (
   file, directory, product, algo, hash
 ) VALUES (
+  8, 7, 8, 32768, X'a93f870078b69ba530e6335eaee698908b12078f'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  8, 7, 8, 16384, X'0c31c1f41a57f4b15fafeb541de475e6da88380c911bb606b35413fda8428006'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  8, 7, 8, 8192, X'bb8fc7073691910d315621de176be64316923782df8d836b384414fd9a3d293be5bea51811ee6ef68a497f12384bba42'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
   8, 21, 6, 32768, X'010873de0d682a26e1c6795dd4992248cc47cdd1'
 );
 
@@ -808,6 +929,24 @@ INSERT INTO file_hashes (
 INSERT INTO file_hashes (
   file, directory, product, algo, hash
 ) VALUES (
+  9, 7, 8, 32768, X'225836cb243c3502d90c92c3eb54310403303270'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  9, 7, 8, 16384, X'7862ed16eeb35d2f10e6d416a6fcbe8000ba1bbc2daddd15f43b375686308d7d'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  9, 7, 8, 8192, X'd4b6b939d0fdcd84bbc66fbf9bd044a61de823b4acb52e0ead7ae7f955d9b2d6399da1f673eadbb4792b819923e5e845'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
   9, 21, 6, 32768, X'e1df4f3949b09c25e15b9c9b7088a60d683903a8'
 );
 
@@ -862,6 +1001,24 @@ INSERT INTO file_hashes (
 INSERT INTO file_hashes (
   file, directory, product, algo, hash
 ) VALUES (
+  10, 7, 8, 32768, X'008374e704c81351c333a214f4ee2d89e996f344'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  10, 7, 8, 16384, X'0e28034f99a3e0cdffa64bf126858afb48ee25b5cbfc70bbcd997bab7ef1e056'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  10, 7, 8, 8192, X'b6e01ba0706e48ce37abef3fbc59a45fd50c7abd3bb7950b1d892bc4a0db3f9784f573d74ef51376267183d26513d1d0'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
   10, 21, 6, 32768, X'87df2d01b85d8354819b431bae0a0a65bfc5d2db'
 );
 
@@ -916,6 +1073,24 @@ INSERT INTO file_hashes (
 INSERT INTO file_hashes (
   file, directory, product, algo, hash
 ) VALUES (
+  11, 7, 8, 32768, X'105fc70c5ecde30ebe841ac0a229b77b6d5f3d8a'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  11, 7, 8, 16384, X'e4cdc17b835eabe06d719bccada0e59d3ee5eb3759ca75eb9c037166e8dafd30'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  11, 7, 8, 8192, X'a9f6a18ff6f85208583e0b3fdd2fdafc4575baf5d973c7a831ce74d8bb5a24b8ae8e4504ddefa4a2c2b91f31cd68edea'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
   12, 7, 1, 32768, X'6c0b2df4fc4c9122b5762ae140d53fdd1cf9e89b'
 );
 
@@ -952,6 +1127,24 @@ INSERT INTO file_hashes (
 INSERT INTO file_hashes (
   file, directory, product, algo, hash
 ) VALUES (
+  12, 7, 8, 32768, X'a9d8ea0203810d269b3ef3d974fed2ac4d486bae'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  12, 7, 8, 16384, X'c071aedaa6f66f8ab45ce037d72bbc42fb1894ac69ab689ad21ce6ff0c1c5d6a'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  12, 7, 8, 8192, X'1612eb51a3be3fcba24808326e29967b6f798c5140aefc8279601c5f5600030148fd01e8fbe737fba9c3972832e67601'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
   13, 7, 1, 32768, X'e2f7b92abda769f82796f57a29801870585dcea3'
 );
 
@@ -988,6 +1181,24 @@ INSERT INTO file_hashes (
 INSERT INTO file_hashes (
   file, directory, product, algo, hash
 ) VALUES (
+  13, 7, 8, 32768, X'da655441bf10f7dc32978474c77903f2f9120cc4'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  13, 7, 8, 16384, X'ec6a4bb332af51cf60cc30ce95197a8c89d42e6135d6e0d4e1d9e4bcc88e838c'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  13, 7, 8, 8192, X'135a84e988f219d5bcd7cb4e7ada6f9239c0164a0021262be0c4f9c00d8bece341aa88e0e35011b195c737e438225f4b'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
   14, 7, 1, 32768, X'160d2b04d11eb225fb148615b699081869e15b6c'
 );
 
@@ -1024,6 +1235,24 @@ INSERT INTO file_hashes (
 INSERT INTO file_hashes (
   file, directory, product, algo, hash
 ) VALUES (
+  14, 7, 8, 32768, X'7b401b741cc32bcc86c3eac43059c9dd26e99a40'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  14, 7, 8, 16384, X'9a7cf37befecc40b494f9176bb887dd478e72c750fed8d540e5d7bbf4b5f2765'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  14, 7, 8, 8192, X'161c2f502f10a72ef159b6308219c38cb13387e21645e4357e6934d7afc62727cd76fd518dc6f676e2db47125eb9a2f6'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
   15, 7, 1, 32768, X'5a0d07ab036603a76759e5f61f7d04f2d3c056cc'
 );
 
@@ -1060,6 +1289,24 @@ INSERT INTO file_hashes (
 INSERT INTO file_hashes (
   file, directory, product, algo, hash
 ) VALUES (
+  15, 7, 8, 32768, X'129f6ecfb596fd751e33209b2ad2a28f2d243fdc'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  15, 7, 8, 16384, X'2fd1e8874b2faf18973881af54bd3e1fd21aaa8ee181313919569715885e69bc'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  15, 7, 8, 8192, X'3862f52ec823474ccfffeb6ead7c6a18b132057018704cb2fa05b08aaee3a1abfaf0eb4c826348f427dfbbb5b3e56647'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
   16, 7, 1, 32768, X'd6c8dfbaae7ab28b5cef2626a2af3f99a6ea4365'
 );
 
@@ -1094,6 +1341,24 @@ INSERT INTO file_hashes (
 );
 
 INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  16, 7, 8, 32768, X'2b686cd8359dea842cfdcacf39d22f5e0e6d06f2'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  16, 7, 8, 16384, X'e14fb3f87b9539108e023660f2d7b4fc728b0622a85de89bdc1fe20162f200a3'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  16, 7, 8, 8192, X'6f55292ad4061b0575dca0a3e6abe5f86d5288e0b860e6f76715bd5c9df8b5f751bc547d3147e9da12593b56a3f83252'
+);
+
+INSERT INTO file_hashes (
   file, product, algo, hash
 ) VALUES (
   17, 1, 32768, X'8a7c41167bc0fcc1dec8329a868ba265c23857f5'
@@ -1186,6 +1451,24 @@ INSERT INTO file_hashes (
 INSERT INTO file_hashes (
   file, directory, product, algo, hash
 ) VALUES (
+  18, 7, 8, 32768, X'9ff04217b3b40cb328440e40b6dc1c283f9f71ec'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  18, 7, 8, 16384, X'76de3b5b8df6d685e522aeea01d79ac457808437c02d40eb2e6ff06098057d41'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  18, 7, 8, 8192, X'ca1c0f6e3516f82a40cbaaea84dd42a8c97cea6b729dc07343f18a5d1b898a94e861b0dfb574c3efad64c363bb07ebf5'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
   19, 7, 1, 32768, X'd537d437f058136eb3d7be517dbe7647b623c619'
 );
 
@@ -1222,6 +1505,24 @@ INSERT INTO file_hashes (
 INSERT INTO file_hashes (
   file, directory, product, algo, hash
 ) VALUES (
+  19, 7, 8, 32768, X'b3d6df204cc27f59704c19ab501172892a9c7c5d'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  19, 7, 8, 16384, X'9168ba26a67a3daf0ad3ea956d88358235ebb968b95f91bd110eab34ba75e4f8'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  19, 7, 8, 8192, X'e3a69702f9d07ea6e1f7cb85157f3d76d7e7dc577fd48ca7f6cf8f917ca7e5015e0f7dd463e1229aebf18aabcfd39cc3'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
   20, 7, 1, 32768, X'f9e3531abb67a020cf667d46ca823675dd0a0dd4'
 );
 
@@ -1255,6 +1556,60 @@ INSERT INTO file_hashes (
   20, 7, 7, 8192, X'84200bd318bb022915150842ddf4002e061ef593604ad0d07021dc662cc40bfa749cce084ddf25d0e5137f6380f613d8'
 );
 
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  20, 7, 8, 32768, X'8696176c12bf8291b6b9989ec5c94c3fdf26b14f'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  20, 7, 8, 16384, X'e7b5896d1dbe17f501f20424e8ed7d2de14d79e984e0c0a032ea70ca2f44e83a'
+);
+
+INSERT INTO file_hashes (
+  file, directory, product, algo, hash
+) VALUES (
+  20, 7, 8, 8192, X'0d87fb31cf84b57b5b872af0b5e65610df929e48877f5ea199c073da6087c7a0e4b4c186545f654bb5db94284fde6274'
+);
+
+INSERT INTO file_hashes (
+  file, product, algo, hash
+) VALUES (
+  23, 8, 32768, X'a67433717c2b9e2a9293f15a88456efbf7998a84'
+);
+
+INSERT INTO file_hashes (
+  file, product, algo, hash
+) VALUES (
+  23, 8, 16384, X'1453d3ceaea4043cecd34f1eb24e0fbbe9fe04978077d06a0f728de849e71365'
+);
+
+INSERT INTO file_hashes (
+  file, product, algo, hash
+) VALUES (
+  23, 8, 8192, X'abd1134f68a2daf92183aeae372f970cb076164468d4df08b8cb53743cae0867c17231e8f087e3367b6ec6905eb03c16'
+);
+
+INSERT INTO file_hashes (
+  file, product, algo, hash
+) VALUES (
+  24, 8, 32768, X'bc3f9d1edeb00192c5c040a53823b58642ed8f41'
+);
+
+INSERT INTO file_hashes (
+  file, product, algo, hash
+) VALUES (
+  24, 8, 16384, X'78f76b5c274705d09cd73cfad04791b8009c56d00849a00613909a659dc9ac63'
+);
+
+INSERT INTO file_hashes (
+  file, product, algo, hash
+) VALUES (
+  24, 8, 8192, X'52cea5a859d0a1e06ffa8c1fc4f7b8dffde2de99915d660b2d3756315efdd873bee67ba3732f2c1ec692c38a8780cd72'
+);
+
 /* AIKs */
 
 INSERT INTO keys (
@@ -1280,7 +1635,13 @@ INSERT INTO components (
 INSERT INTO components (
   vendor_id, name, qualifier
 ) VALUES (
-  36906, 3, 33  /* ITA IMA */
+  36906, 3, 33  /* ITA IMA - Trusted Platform */
+);
+
+INSERT INTO components (
+  vendor_id, name, qualifier
+) VALUES (
+  36906, 3, 34  /* ITA IMA - Operating System */
 );
 
 /* AIK Component */
@@ -1288,18 +1649,18 @@ INSERT INTO components (
 INSERT INTO key_component (
   key, component, depth, seq_no
 ) VALUES (
-  2, 2, 0, 1
+  1, 3, 0, 1
 );
 
 INSERT INTO key_component (
   key, component, depth, seq_no
 ) VALUES (
-  1, 3, 0, 1
+  1, 2, 0, 2
 );
 
 INSERT INTO key_component (
   key, component, depth, seq_no
 ) VALUES (
-  1, 2, 0, 2
+  1, 4, 0, 3
 );
 
diff --git a/src/libpts/plugins/imv_attestation/imv_attestation.c b/src/libpts/plugins/imv_attestation/imv_attestation.c
index 51069b02d..201496e8a 100644
--- a/src/libpts/plugins/imv_attestation/imv_attestation.c
+++ b/src/libpts/plugins/imv_attestation/imv_attestation.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -168,13 +168,10 @@ TNC_Result TNC_IMV_NotifyConnectionChange(TNC_IMVID imv_id,
 
 static TNC_Result send_message(TNC_ConnectionID connection_id)
 {
-	pa_tnc_msg_t *msg;
-	pa_tnc_attr_t *attr;
+	linked_list_t *attr_list;
 	imv_state_t *state;
 	imv_attestation_state_t *attestation_state;
 	TNC_Result result;
-	linked_list_t *attr_list;
-	enumerator_t *enumerator;
 
 	if (!imv_attestation->get_state(imv_attestation, connection_id, &state))
 	{
@@ -188,21 +185,8 @@ static TNC_Result send_message(TNC_ConnectionID connection_id)
 	{
 		if (attr_list->get_count(attr_list))
 		{
-			msg = pa_tnc_msg_create();
-
-			/* move PA-TNC attributes to PA-TNC message */
-			enumerator = attr_list->create_enumerator(attr_list);
-			while (enumerator->enumerate(enumerator, &attr))
-			{
-				msg->add_attribute(msg, attr);
-			}
-			enumerator->destroy(enumerator);
-
-			msg->build(msg);
 			result = imv_attestation->send_message(imv_attestation,
-							connection_id, FALSE, 0, TNC_IMCID_ANY,
-							msg->get_encoding(msg));
-			msg->destroy(msg);
+							connection_id, FALSE, 0, TNC_IMCID_ANY,	attr_list);
 		}
 		else
 		{
@@ -230,6 +214,7 @@ static TNC_Result receive_message(TNC_IMVID imv_id,
 {
 	pa_tnc_msg_t *pa_tnc_msg;
 	pa_tnc_attr_t *attr;
+	pen_type_t type;
 	linked_list_t *attr_list;
 	imv_state_t *state;
 	imv_attestation_state_t *attestation_state;
@@ -271,31 +256,31 @@ static TNC_Result receive_message(TNC_IMVID imv_id,
 	enumerator = pa_tnc_msg->create_attribute_enumerator(pa_tnc_msg);
 	while (enumerator->enumerate(enumerator, &attr))
 	{
-		if (attr->get_vendor_id(attr) == PEN_IETF)
+		type = attr->get_type(attr);
+
+		if (type.vendor_id == PEN_IETF)
 		{
-			if (attr->get_type(attr) == IETF_ATTR_PA_TNC_ERROR)
+			if (type.type == IETF_ATTR_PA_TNC_ERROR)
 			{
 				ietf_attr_pa_tnc_error_t *error_attr;
-				pen_t error_vendor_id;
-				pa_tnc_error_code_t error_code;
+				pen_type_t error_code;
 				chunk_t msg_info;
 
 				error_attr = (ietf_attr_pa_tnc_error_t*)attr;
-				error_vendor_id = error_attr->get_vendor_id(error_attr);
+				error_code = error_attr->get_error_code(error_attr);
 
-				if (error_vendor_id == PEN_TCG)
+				if (error_code.vendor_id == PEN_TCG)
 				{
-					error_code = error_attr->get_error_code(error_attr);
 					msg_info = error_attr->get_msg_info(error_attr);
 
 					DBG1(DBG_IMV, "received TCG-PTS error '%N'",
-						 pts_error_code_names, error_code);
+						 pts_error_code_names, error_code.type);
 					DBG1(DBG_IMV, "error information: %B", &msg_info);
 
 					result = TNC_RESULT_FATAL;
 				}
 			}
-			else if (attr->get_type(attr) == IETF_ATTR_PRODUCT_INFORMATION)
+			else if (type.type == IETF_ATTR_PRODUCT_INFORMATION)
 			{
 				ietf_attr_product_info_t *attr_cast;
 				char *platform_info;
@@ -305,7 +290,7 @@ static TNC_Result receive_message(TNC_IMVID imv_id,
 				pts->set_platform_info(pts, platform_info);
 			}
 		}
-		else if (attr->get_vendor_id(attr) == PEN_TCG)
+		else if (type.vendor_id == PEN_TCG)
 		{
 			if (!imv_attestation_process(attr, attr_list, attestation_state,
 				supported_algorithms,supported_dh_groups, pts_db, pts_credmgr))
@@ -325,29 +310,14 @@ static TNC_Result receive_message(TNC_IMVID imv_id,
 								TNC_IMV_ACTION_RECOMMENDATION_ISOLATE,
 								TNC_IMV_EVALUATION_RESULT_ERROR);
 		return imv_attestation->provide_recommendation(imv_attestation,
-													   connection_id);
+													   connection_id, src_imc_id);
 	}
 
 	if (attr_list->get_count(attr_list))
 	{
-		pa_tnc_msg = pa_tnc_msg_create();
-
-		/* move PA-TNC attributes to PA-TNC message */
-		enumerator = attr_list->create_enumerator(attr_list);
-		while (enumerator->enumerate(enumerator, &attr))
-		{
-			pa_tnc_msg->add_attribute(pa_tnc_msg, attr);
-		}
-		enumerator->destroy(enumerator);
-
-		pa_tnc_msg->build(pa_tnc_msg);
 		result = imv_attestation->send_message(imv_attestation, connection_id,
-										FALSE, 0, TNC_IMCID_ANY,
-										pa_tnc_msg->get_encoding(pa_tnc_msg));
-		
-		pa_tnc_msg->destroy(pa_tnc_msg);
+										FALSE, 0, TNC_IMCID_ANY, attr_list);
 		attr_list->destroy(attr_list);
-		
 		return result;
 	}
 	attr_list->destroy(attr_list);
@@ -360,7 +330,7 @@ static TNC_Result receive_message(TNC_IMVID imv_id,
 								TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION,
 								TNC_IMV_EVALUATION_RESULT_ERROR);
 		return imv_attestation->provide_recommendation(imv_attestation,
-													   connection_id);
+													   connection_id, src_imc_id);
 	}
 
 	if (attestation_state->get_handshake_state(attestation_state) ==
@@ -372,12 +342,6 @@ static TNC_Result receive_message(TNC_IMVID imv_id,
 				attestation_state->get_file_meas_request_count(attestation_state));
 			attestation_state->set_measurement_error(attestation_state);
 		}
-		if (attestation_state->get_component_count(attestation_state))
-		{
-			DBG1(DBG_IMV, "failure due to %d components waiting for evidence",
-				 attestation_state->get_component_count(attestation_state));
-			attestation_state->set_measurement_error(attestation_state);
-		}
 		if (attestation_state->get_measurement_error(attestation_state))
 		{
 			state->set_recommendation(state,
@@ -391,7 +355,7 @@ static TNC_Result receive_message(TNC_IMVID imv_id,
 								TNC_IMV_EVALUATION_RESULT_COMPLIANT);
 		}
 		return imv_attestation->provide_recommendation(imv_attestation,
-													   connection_id);
+													   connection_id, src_imc_id);
 	}
 
 	return result;
@@ -446,7 +410,7 @@ TNC_Result TNC_IMV_SolicitRecommendation(TNC_IMVID imv_id,
 		return TNC_RESULT_NOT_INITIALIZED;
 	}
 	return imv_attestation->provide_recommendation(imv_attestation,
-												   connection_id);
+												   connection_id, TNC_IMCID_ANY);
 }
 
 /**
diff --git a/src/libpts/plugins/imv_attestation/imv_attestation_build.c b/src/libpts/plugins/imv_attestation/imv_attestation_build.c
index 4f2cc1e95..23195d6e3 100644
--- a/src/libpts/plugins/imv_attestation/imv_attestation_build.c
+++ b/src/libpts/plugins/imv_attestation/imv_attestation_build.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -16,7 +16,6 @@
 #include "imv_attestation_build.h"
 #include "imv_attestation_state.h"
 
-#include <libpts.h>
 #include <tcg/tcg_pts_attr_proto_caps.h>
 #include <tcg/tcg_pts_attr_meas_algo.h>
 #include <tcg/tcg_pts_attr_dh_nonce_params_req.h>
@@ -198,7 +197,13 @@ bool imv_attestation_build(linked_list_t *attr_list,
 				attr_list->insert_last(attr_list, attr);
 			}
 			enumerator->destroy(enumerator);
-			break;
+
+			/* do we have any file metadata or measurement requests? */
+			if (attr_list->get_count(attr_list))
+			{
+				break;
+			}
+			/* fall through to next state */
 		}
 		case IMV_ATTESTATION_STATE_COMP_EVID:
 		{
@@ -252,15 +257,15 @@ bool imv_attestation_build(linked_list_t *attr_list,
 				comp_name = pts_comp_func_name_create(vid, name, qualifier);
 				comp_name->log(comp_name, "  ");
 
-				comp = pts_components->create(pts_components, comp_name,
-											  depth, pts_db);
+				comp = attestation_state->create_component(attestation_state,
+													comp_name, depth, pts_db);
 				if (!comp)
 				{
-					DBG2(DBG_IMV, "    not registered: removed from request");
+					DBG2(DBG_IMV, "    not registered or duplicate"
+								  " - removed from request");
 					comp_name->destroy(comp_name);
 					continue;
 				}
-				attestation_state->add_component(attestation_state, comp);
 				if (first_component)
 				{
 					attr = tcg_pts_attr_req_func_comp_evid_create();
@@ -290,8 +295,11 @@ bool imv_attestation_build(linked_list_t *attr_list,
 			break;
 		}
 		case IMV_ATTESTATION_STATE_EVID_FINAL:
-			attestation_state->set_handshake_state(attestation_state,
+			if (attestation_state->components_finalized(attestation_state))
+			{
+				attestation_state->set_handshake_state(attestation_state,
 										IMV_ATTESTATION_STATE_END);
+			}
 			break;
 		case IMV_ATTESTATION_STATE_END:
 			break;
diff --git a/src/libpts/plugins/imv_attestation/imv_attestation_process.c b/src/libpts/plugins/imv_attestation/imv_attestation_process.c
index a742b6697..37e9ac77a 100644
--- a/src/libpts/plugins/imv_attestation/imv_attestation_process.c
+++ b/src/libpts/plugins/imv_attestation/imv_attestation_process.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -41,11 +41,13 @@ bool imv_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
 							 pts_database_t *pts_db,
 							 credential_manager_t *pts_credmgr)
 {
+	pen_type_t attr_type;
 	pts_t *pts;
-
+	
 	pts = attestation_state->get_pts(attestation_state);
- 
-	switch (attr->get_type(attr))
+	attr_type = attr->get_type(attr);
+
+	switch (attr_type.type)
 	{
 		case TCG_PTS_PROTO_CAPS:
 		{
@@ -169,7 +171,7 @@ bool imv_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
 							KEY_ANY, aik->get_issuer(aik), FALSE);
 				while (e->enumerate(e, &issuer))
 				{
-					if (aik->issued_by(aik, issuer))
+					if (aik->issued_by(aik, issuer, NULL))
 					{
 						trusted = TRUE;
 						break;
@@ -216,22 +218,29 @@ bool imv_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
 			DBG1(DBG_IMV, "measurement request %d returned %d file%s:",
 				 request_id, file_count, (file_count == 1) ? "":"s");
 
-			if (!attestation_state->check_off_file_meas_request(attestation_state,
-				request_id, &file_id, &is_dir))
+			if (request_id)
 			{
-				DBG1(DBG_IMV, "  no entry found for file measurement request %d",
-					 request_id);
-				break;
-			}
+				if (!attestation_state->check_off_file_meas_request(
+					attestation_state, request_id, &file_id, &is_dir))
+				{
+					DBG1(DBG_IMV, "  no entry found for file measurement "
+								  "request %d", request_id);
+					break;
+				}
 
-			/* check hashes from database against measurements */
-			e_hash = pts_db->create_file_hash_enumerator(pts_db,
-							platform_info, algo, file_id, is_dir);
-			if (!measurements->verify(measurements, e_hash, is_dir))
+				/* check hashes from database against measurements */
+				e_hash = pts_db->create_file_hash_enumerator(pts_db,
+								platform_info, algo, file_id, is_dir);
+				if (!measurements->verify(measurements, e_hash, is_dir))
+				{
+					attestation_state->set_measurement_error(attestation_state);
+				}
+				e_hash->destroy(e_hash);
+			}
+			else
 			{
-				attestation_state->set_measurement_error(attestation_state);
+				measurements->check(measurements, pts_db, platform_info, algo);
 			}
-			e_hash->destroy(e_hash);
 			break;
 		}
 		case TCG_PTS_UNIX_FILE_META:
@@ -276,34 +285,22 @@ bool imv_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
 			pts_comp_evidence_t *evidence;
 			pts_component_t *comp;
 			u_int32_t depth;
-			status_t status;
 
 			attr_cast = (tcg_pts_attr_simple_comp_evid_t*)attr;
 			evidence = attr_cast->get_comp_evidence(attr_cast);
 			name = evidence->get_comp_func_name(evidence, &depth);
 
-			comp = attestation_state->check_off_component(attestation_state, name);
+			comp = attestation_state->get_component(attestation_state, name);
 			if (!comp)
 			{
 				DBG1(DBG_IMV, "  no entry found for component evidence request");
 				break;
 			}
-			status = comp->verify(comp, pts, evidence);
-			
-			switch (status)
+			if (comp->verify(comp, name->get_qualifier(name), pts,
+							 evidence) != SUCCESS)
 			{
-				default:
-				case FAILED:
-					attestation_state->set_measurement_error(attestation_state);
-					comp->destroy(comp);
-					break;
-				case SUCCESS:
-					name->log(name, "  successfully measured ");
-					comp->destroy(comp);
-					break;
-				case NEED_MORE:
-					/* re-enter component into list */
-					attestation_state->add_component(attestation_state, comp);
+				attestation_state->set_measurement_error(attestation_state);
+				name->log(name, "  measurement mismatch for ");
 			}
 			break;
 		}
@@ -353,8 +350,11 @@ bool imv_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
 				DBG2(DBG_IMV, "TPM Quote Info signature verification successful");
 				free(quote_info.ptr);
 
-				/* Finalize any pending measurement registrations */
-				attestation_state->check_off_registrations(attestation_state);
+				/**
+				 * Finalize any pending measurement registrations and check
+				 * if all expected component measurements were received
+				 */
+				attestation_state->finalize_components(attestation_state);
 			}
 
 			if (attr_cast->get_evid_sig(attr_cast, &evid_sig))
diff --git a/src/libpts/plugins/imv_attestation/imv_attestation_state.c b/src/libpts/plugins/imv_attestation/imv_attestation_state.c
index a58fd3ec3..1dbc88309 100644
--- a/src/libpts/plugins/imv_attestation/imv_attestation_state.c
+++ b/src/libpts/plugins/imv_attestation/imv_attestation_state.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -15,21 +15,15 @@
 
 #include "imv_attestation_state.h"
 
+#include <libpts.h>
+
 #include <utils/lexparser.h>
 #include <utils/linked_list.h>
 #include <debug.h>
 
 typedef struct private_imv_attestation_state_t private_imv_attestation_state_t;
 typedef struct file_meas_request_t file_meas_request_t;
-
-/**
- * PTS File/Directory Measurement request entry
- */
-struct file_meas_request_t {
-	u_int16_t id;
-	int file_id;
-	bool is_dir;
-};
+typedef struct func_comp_t func_comp_t;
 
 /**
  * Private data of an imv_attestation_state_t object.
@@ -62,6 +56,11 @@ struct private_imv_attestation_state_t {
 	bool has_excl;
 
 	/**
+	 * Maximum PA-TNC message size for this TNCCS connection
+	 */
+	u_int32_t max_msg_len;
+
+	/**
 	 * IMV Attestation handshake state
 	 */
 	imv_attestation_handshake_state_t handshake_state;
@@ -103,6 +102,32 @@ struct private_imv_attestation_state_t {
 
 };
 
+/**
+ * PTS File/Directory Measurement request entry
+ */
+struct file_meas_request_t {
+	u_int16_t id;
+	int file_id;
+	bool is_dir;
+};
+
+/**
+ * PTS Functional Component entry
+ */
+struct func_comp_t {
+	pts_component_t *comp;
+	u_int8_t qualifier;
+};
+
+/**
+ * Frees a func_comp_t object
+ */
+static void free_func_comp(func_comp_t *this)
+{
+	this->comp->destroy(this->comp);
+	free(this);
+}
+
 typedef struct entry_t entry_t;
 
 /**
@@ -150,6 +175,18 @@ METHOD(imv_state_t, set_flags, void,
 	this->has_excl = has_excl;
 }
 
+METHOD(imv_state_t, set_max_msg_len, void,
+	private_imv_attestation_state_t *this, u_int32_t max_msg_len)
+{
+	this->max_msg_len = max_msg_len;
+}
+
+METHOD(imv_state_t, get_max_msg_len, u_int32_t,
+	private_imv_attestation_state_t *this)
+{
+	return this->max_msg_len;
+}
+
 METHOD(imv_state_t, change_state, void,
 	private_imv_attestation_state_t *this, TNC_ConnectionState new_state)
 {
@@ -220,8 +257,7 @@ METHOD(imv_state_t, destroy, void,
 	private_imv_attestation_state_t *this)
 {
 	this->file_meas_requests->destroy_function(this->file_meas_requests, free);
-	this->components->destroy_offset(this->components,
-									 offsetof(pts_component_t, destroy));
+	this->components->destroy_function(this->components, (void *)free_func_comp);
 	this->pts->destroy(this->pts);
 	free(this);
 }
@@ -290,54 +326,74 @@ METHOD(imv_attestation_state_t, get_file_meas_request_count, int,
 	return this->file_meas_requests->get_count(this->file_meas_requests);
 }
 
-METHOD(imv_attestation_state_t, add_component, void,
-	private_imv_attestation_state_t *this, pts_component_t *entry)
-{
-	this->components->insert_last(this->components, entry);
-}
-
-METHOD(imv_attestation_state_t, check_off_component, pts_component_t*,
-	private_imv_attestation_state_t *this, pts_comp_func_name_t *name)
+METHOD(imv_attestation_state_t, create_component, pts_component_t*,
+	private_imv_attestation_state_t *this, pts_comp_func_name_t *name,
+	u_int32_t depth, pts_database_t *pts_db)
 {
 	enumerator_t *enumerator;
-	pts_component_t *entry, *found = NULL;
+	func_comp_t *entry, *new_entry;
+	pts_component_t *component;
+	bool found = FALSE;
 
 	enumerator = this->components->create_enumerator(this->components);
 	while (enumerator->enumerate(enumerator, &entry))
 	{
-		if (name->equals(name, entry->get_comp_func_name(entry)))
+		if (name->equals(name, entry->comp->get_comp_func_name(entry->comp)))
 		{
-			found = entry;
-			this->components->remove_at(this->components, enumerator);
+			found = TRUE;
 			break;
 		}
 	}
 	enumerator->destroy(enumerator);
-	return found;
+
+	if (found)
+	{
+		if (name->get_qualifier(name) == entry->qualifier)
+		{
+			/* duplicate entry */
+			return NULL;
+		}
+		new_entry = malloc_thing(func_comp_t);
+		new_entry->qualifier = name->get_qualifier(name);
+		new_entry->comp = entry->comp->get_ref(entry->comp);
+		this->components->insert_last(this->components, new_entry);
+		return entry->comp;
+	}
+	else
+	{
+		component = pts_components->create(pts_components, name, depth, pts_db);
+		if (!component)
+		{
+			/* unsupported component */
+			return NULL;
+		}
+		new_entry = malloc_thing(func_comp_t);
+		new_entry->qualifier = name->get_qualifier(name);
+		new_entry->comp = component;
+		this->components->insert_last(this->components, new_entry);
+		return component;
+	}
 }
 
-METHOD(imv_attestation_state_t, check_off_registrations, void,
-	private_imv_attestation_state_t *this)
+METHOD(imv_attestation_state_t, get_component, pts_component_t*,
+	private_imv_attestation_state_t *this, pts_comp_func_name_t *name)
 {
 	enumerator_t *enumerator;
-	pts_component_t *entry;
+	func_comp_t *entry;
+	pts_component_t *found = NULL;
 
 	enumerator = this->components->create_enumerator(this->components);
 	while (enumerator->enumerate(enumerator, &entry))
 	{
-		if (entry->check_off_registrations(entry))
+		if (name->equals(name, entry->comp->get_comp_func_name(entry->comp)) &&
+			name->get_qualifier(name) == entry->qualifier)
 		{
-			this->components->remove_at(this->components, enumerator);
-			entry->destroy(entry);
+			found = entry->comp;
+			break;
 		}
 	}
 	enumerator->destroy(enumerator);
-}
-
-METHOD(imv_attestation_state_t, get_component_count, int,
-	private_imv_attestation_state_t *this)
-{
-	return this->components->get_count(this->components);
+	return found;
 }
 
 METHOD(imv_attestation_state_t, get_measurement_error, bool,
@@ -352,6 +408,28 @@ METHOD(imv_attestation_state_t, set_measurement_error, void,
 	this->measurement_error = TRUE;
 }
 
+METHOD(imv_attestation_state_t, finalize_components, void,
+	private_imv_attestation_state_t *this)
+{
+	func_comp_t *entry;
+
+	while (this->components->remove_last(this->components,
+										(void**)&entry) == SUCCESS)
+	{
+		if (!entry->comp->finalize(entry->comp, entry->qualifier))
+		{
+			_set_measurement_error(this);
+		}
+		free_func_comp(entry);
+	}
+}
+
+METHOD(imv_attestation_state_t, components_finalized, bool,
+	private_imv_attestation_state_t *this)
+{
+	return this->components->get_count(this->components) == 0;
+}
+
 /**
  * Described in header.
  */
@@ -367,6 +445,8 @@ imv_state_t *imv_attestation_state_create(TNC_ConnectionID connection_id)
 				.has_long = _has_long,
 				.has_excl = _has_excl,
 				.set_flags = _set_flags,
+				.set_max_msg_len = _set_max_msg_len,
+				.get_max_msg_len = _get_max_msg_len,
 				.change_state = _change_state,
 				.get_recommendation = _get_recommendation,
 				.set_recommendation = _set_recommendation,
@@ -379,10 +459,10 @@ imv_state_t *imv_attestation_state_create(TNC_ConnectionID connection_id)
 			.add_file_meas_request = _add_file_meas_request,
 			.check_off_file_meas_request = _check_off_file_meas_request,
 			.get_file_meas_request_count = _get_file_meas_request_count,
-			.add_component = _add_component,
-			.check_off_component = _check_off_component,
-			.check_off_registrations = _check_off_registrations,
-			.get_component_count = _get_component_count,
+			.create_component = _create_component,
+			.get_component = _get_component,
+			.finalize_components = _finalize_components,
+			.components_finalized = _components_finalized,
 			.get_measurement_error = _get_measurement_error,
 			.set_measurement_error = _set_measurement_error,
 		},
diff --git a/src/libpts/plugins/imv_attestation/imv_attestation_state.h b/src/libpts/plugins/imv_attestation/imv_attestation_state.h
index 0e2c04da4..901d4b19d 100644
--- a/src/libpts/plugins/imv_attestation/imv_attestation_state.h
+++ b/src/libpts/plugins/imv_attestation/imv_attestation_state.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -24,6 +24,7 @@
 
 #include <imv/imv_state.h>
 #include <pts/pts.h>
+#include <pts/pts_database.h>
 #include <pts/components/pts_component.h>
 #include <library.h>
 
@@ -105,32 +106,37 @@ struct imv_attestation_state_t {
 										u_int16_t id, int *file_id, bool *is_dir);
 
 	/**
-	 * Add an entry to the list of Functional Components waiting for evidence
+	 * Create and add an entry to the list of Functional Components
 	 *
-	 * @param entry				Functional Component
+	 * @param name				Component Functional Name
+	 * @param depth				Sub-component Depth
+	 * @param pts_db			PTS measurement database
+	 * @return					created functional component instance or NULL
 	 */
-	void (*add_component)(imv_attestation_state_t *this, pts_component_t *entry);
+	pts_component_t* (*create_component)(imv_attestation_state_t *this,
+										 pts_comp_func_name_t *name,
+										 u_int32_t depth,
+										 pts_database_t *pts_db);
 
 	/**
-	 * Returns the number of Functional Component waiting for evidence
-	 *
-	 * @return					Number of waiting Functional Components
-	 */
-	int (*get_component_count)(imv_attestation_state_t *this);
-
-	/**
-	 * Check for presence of Functional Component and remove and return it
+	 * Get a Functional Component with a given name
 	 *
 	 * @param name			 	Name of the requested Functional Component
 	 * @return					Functional Component if found, NULL otherwise
 	 */
-	pts_component_t* (*check_off_component)(imv_attestation_state_t *this,
-											pts_comp_func_name_t *name);
+	pts_component_t* (*get_component)(imv_attestation_state_t *this,
+									  pts_comp_func_name_t *name);
 
 	/**
 	 * Tell the Functional Components to finalize any measurement registrations
+	 * and to check if all expected measurements were received
+	 */
+	void (*finalize_components)(imv_attestation_state_t *this);
+
+	/**
+	 * Have the Functional Component measurements been finalized?
 	 */
-	void (*check_off_registrations)(imv_attestation_state_t *this);
+	bool (*components_finalized)(imv_attestation_state_t *this);
 
 	/**
 	 * Indicates if a file measurement error occurred
diff --git a/src/libpts/plugins/imv_attestation/tables.sql b/src/libpts/plugins/imv_attestation/tables.sql
index 703557a07..42553bef0 100644
--- a/src/libpts/plugins/imv_attestation/tables.sql
+++ b/src/libpts/plugins/imv_attestation/tables.sql
@@ -6,6 +6,10 @@ CREATE TABLE files (
   type INTEGER NOT NULL,
   path TEXT NOT NULL
 );
+DROP INDEX IF EXISTS files_path;
+CREATE INDEX files_path ON files (
+  path
+);
 
 DROP TABLE IF EXISTS products;
 CREATE TABLE products (
@@ -31,6 +35,7 @@ CREATE TABLE file_hashes (
   file INTEGER NOT NULL,
   directory INTEGER DEFAULT 0,
   product INTEGER NOT NULL,
+  key INTEGER DEFAULT 0,
   algo INTEGER NOT NULL,
   hash BLOB NOT NULL,
   PRIMARY KEY(file, directory, product, algo)
diff --git a/src/libpts/pts/components/ita/ita_comp_ima.c b/src/libpts/pts/components/ita/ita_comp_ima.c
index a7da76651..a59732428 100644
--- a/src/libpts/pts/components/ita/ita_comp_ima.c
+++ b/src/libpts/pts/components/ita/ita_comp_ima.c
@@ -1,6 +1,5 @@
 /*
- * Copyright (C) 2011 Andreas Steffen
- *
+ * Copyright (C) 2011-2012 Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -18,6 +17,7 @@
 #include "ita_comp_func_name.h"
 
 #include "libpts.h"
+#include "pts/pts_pcr.h"
 #include "pts/components/pts_component.h"
 
 #include <debug.h>
@@ -29,11 +29,25 @@
 #include <fcntl.h>
 #include <errno.h>
 
-#define IMA_SECURITY_DIR			"/sys/kernel/security/tpm0/"
-#define IMA_BIOS_MEASUREMENT_PATH	IMA_SECURITY_DIR "binary_bios_measurements"
-#define IMA_PCR_MAX					16
+#define SECURITY_DIR				"/sys/kernel/security/"
+#define IMA_BIOS_MEASUREMENTS		SECURITY_DIR "tpm0/binary_bios_measurements"
+#define IMA_RUNTIME_MEASUREMENTS	SECURITY_DIR "ima/binary_runtime_measurements"
+#define IMA_PCR						10
+#define IMA_TYPE_LEN				3
+#define IMA_FILENAME_LEN_MAX	255
 
 typedef struct pts_ita_comp_ima_t pts_ita_comp_ima_t;
+typedef struct bios_entry_t bios_entry_t;
+typedef struct ima_entry_t ima_entry_t;
+typedef enum ima_state_t ima_state_t;
+
+enum ima_state_t {
+	IMA_STATE_INIT,
+	IMA_STATE_BIOS,
+	IMA_STATE_BOOT_AGGREGATE,
+	IMA_STATE_RUNTIME,
+	IMA_STATE_END
+};
 
 /**
  * Private data of a pts_ita_comp_ima_t object.
@@ -67,52 +81,101 @@ struct pts_ita_comp_ima_t {
 	pts_database_t *pts_db;
 
 	/**
-	 * Primary key for Component Functional Name database entry
+	 * Primary key for AIK database entry
 	 */
-	int cid;
+	int kid;
 
 	/**
-	 * Primary key for AIK database entry
+	 * Primary key for IMA BIOS Component Functional Name database entry
 	 */
-	int kid;
+	int bios_cid;
+
+	/**
+	 * Primary key for IMA Runtime Component Functional Name database entry
+	 */
+	int ima_cid;
 
 	/**
-	 * Component is registering measurements 
+	 * Component is registering IMA BIOS measurements 
 	 */
-	bool is_registering;
+	bool is_bios_registering;
+
+	/**
+	 * Component is registering IMA boot aggregate measurement 
+	 */
+	bool is_ima_registering;
+
+	/**
+	 * Measurement sequence number
+	 */
+	int seq_no;
 
 	/**
-     * IMA BIOS measurement time
+	 * Expected IMA BIOS measurement count
 	 */
-	time_t bios_measurement_time;
+	int bios_count;
 
 	/**
      * IMA BIOS measurements
 	 */
-	linked_list_t *list;
+	linked_list_t *bios_list;
 
 	/**
-	 * Expected measurement count
+     * IMA runtime file measurements
+	 */
+	linked_list_t *ima_list;
+
+	/**
+	 * Whether to send pcr_before and pcr_after info
+	 */
+	bool pcr_info;
+
+	/**
+	 * IMA measurement time
+	 */
+	time_t measurement_time;
+
+	/**
+	 * IMA state machine
+	 */
+	ima_state_t state;
+
+	/**
+	 * Total number of component measurements
 	 */
 	int count;
 
 	/**
-	 * Measurement sequence number
+	 * Number of successful component measurements
 	 */
-	int seq_no;
+	int count_ok;
 
 	/**
-	 * Shadow PCR registers
+	 * Number of unknown component measurements
 	 */
-	chunk_t pcrs[IMA_PCR_MAX];
-};
+	int count_unknown;
 
-typedef struct entry_t entry_t;
+	/**
+	 * Number of differing component measurements
+	 */
+	int count_differ;
+
+	/**
+	 * Number of failed component measurements
+	 */
+	int count_failed;
+
+	/**
+	 * Reference count
+	 */
+	refcount_t ref;
+
+};
 
 /**
- * Linux IMA measurement entry
+ * Linux IMA BIOS measurement entry
  */
-struct entry_t {
+struct bios_entry_t {
 
 	/**
 	 * PCR register
@@ -126,21 +189,48 @@ struct entry_t {
 };
 
 /**
- * Free an entry_t object
+ * Linux IMA runtime file measurement entry
+ */
+struct ima_entry_t {
+
+	/**
+	 * SHA1 measurement hash
+	 */
+	chunk_t measurement;
+
+	/**
+	 * absolute path of executable files or basename of dynamic libraries
+	 */
+	char *filename;
+};
+
+/**
+ * Free a bios_entry_t object
+ */
+static void free_bios_entry(bios_entry_t *this)
+{
+	free(this->measurement.ptr);
+	free(this);
+}
+
+/**
+ * Free an ima_entry_t object
  */
-static void free_entry(entry_t *this)
+static void free_ima_entry(ima_entry_t *this)
 {
 	free(this->measurement.ptr);
+	free(this->filename);
 	free(this);
 }
 
 /**
  * Load a PCR measurement file and determine the creation date
  */
-static bool load_measurements(char *file, linked_list_t *list, time_t *created)
+static bool load_bios_measurements(char *file, linked_list_t *list,
+								   time_t *created)
 {
 	u_int32_t pcr, num, len;
-	entry_t *entry;
+	bios_entry_t *entry;
 	struct stat st;
 	ssize_t res;
 	int fd;
@@ -148,13 +238,13 @@ static bool load_measurements(char *file, linked_list_t *list, time_t *created)
 	fd = open(file, O_RDONLY);
 	if (fd == -1)
 	{
-		DBG1(DBG_PTS, "  opening '%s' failed: %s", file, strerror(errno));
+		DBG1(DBG_PTS, "opening '%s' failed: %s", file, strerror(errno));
 		return FALSE;
 	}
 
 	if (fstat(fd, &st) == -1)
 	{
-		DBG1(DBG_PTS, "  getting statistics of '%s' failed: %s", file,
+		DBG1(DBG_PTS, "getting statistics of '%s' failed: %s", file,
 			 strerror(errno));
 		close(fd);
 		return FALSE;
@@ -167,12 +257,12 @@ static bool load_measurements(char *file, linked_list_t *list, time_t *created)
 		if (res == 0)
 		{
 			DBG2(DBG_PTS, "loaded bios measurements '%s' (%d entries)",
-						   file, list->get_count(list));
+				 file, list->get_count(list));
 			close(fd);
 			return TRUE;
 		}
 
-		entry = malloc_thing(entry_t);
+		entry = malloc_thing(bios_entry_t);
 		entry->pcr = pcr;
 		entry->measurement = chunk_alloc(HASH_SIZE_SHA1);
 
@@ -199,12 +289,188 @@ static bool load_measurements(char *file, linked_list_t *list, time_t *created)
 		list->insert_last(list, entry);
 	}
 
-	DBG1(DBG_PTS, "loading bios measurements '%s' failed: %s",
-				   file, strerror(errno));
+	DBG1(DBG_PTS, "loading bios measurements '%s' failed: %s", file,
+		 strerror(errno));
+	close(fd);
+	return FALSE;
+}
+
+/**
+ * Load an IMA runtime measurement file and determine the creation and
+ * update dates
+ */
+static bool load_runtime_measurements(char *file, linked_list_t *list,
+									 time_t *created)
+{
+	u_int32_t pcr, len;
+	ima_entry_t *entry;
+	char type[IMA_TYPE_LEN];
+	struct stat st;
+	ssize_t res;
+	int fd;
+
+	fd = open(file, O_RDONLY);
+	if (fd == -1)
+	{
+		DBG1(DBG_PTS, "opening '%s' failed: %s", file, strerror(errno));
+		return TRUE;
+	}
+
+	if (fstat(fd, &st) == -1)
+	{
+		DBG1(DBG_PTS, "getting statistics of '%s' failed: %s", file,
+			 strerror(errno));
+		close(fd);
+		return FALSE;
+	}
+	*created = st.st_ctime;
+
+	while (TRUE)
+	{
+		res = read(fd, &pcr, 4);
+		if (res == 0)
+		{
+			DBG2(DBG_PTS, "loaded ima measurements '%s' (%d entries)",
+				 file, list->get_count(list));
+			close(fd);
+			return TRUE;
+		}
+
+		entry = malloc_thing(ima_entry_t);
+		entry->measurement = chunk_alloc(HASH_SIZE_SHA1);
+		entry->filename = NULL;
+
+		if (res != 4 || pcr != IMA_PCR)
+		{
+			break;
+		}
+		if (read(fd, entry->measurement.ptr, HASH_SIZE_SHA1) != HASH_SIZE_SHA1)
+		{
+			break;
+		}
+		if (read(fd, &len, 4) != 4 || len != IMA_TYPE_LEN)
+		{
+			break;
+		}
+		if (read(fd, type, IMA_TYPE_LEN) != IMA_TYPE_LEN ||
+			memcmp(type, "ima", IMA_TYPE_LEN))
+		{
+			break;
+		}
+		if (lseek(fd, HASH_SIZE_SHA1, SEEK_CUR) == -1)
+		{
+			break;
+		}
+		if (read(fd, &len, 4) != 4)
+		{
+			break;
+		}
+		entry->filename = malloc(len + 1);
+		if (read(fd, entry->filename, len) != len)
+		{
+			break;
+		}
+		entry->filename[len] = '\0';
+
+		list->insert_last(list, entry);
+	}
+
+	DBG1(DBG_PTS, "loading ima measurements '%s' failed: %s",
+		 file, strerror(errno));
 	close(fd);
 	return FALSE;
 }
 
+/**
+ * Extend measurement into PCR an create evidence
+ */
+static pts_comp_evidence_t* extend_pcr(pts_ita_comp_ima_t* this,
+									   u_int8_t qualifier, pts_pcr_t *pcrs,
+									   u_int32_t pcr, chunk_t measurement)
+{
+	size_t pcr_len;
+	pts_pcr_transform_t pcr_transform;
+	pts_meas_algorithms_t hash_algo;
+	pts_comp_func_name_t *name;
+	pts_comp_evidence_t *evidence;
+	chunk_t pcr_before = chunk_empty, pcr_after = chunk_empty;
+
+	hash_algo = PTS_MEAS_ALGO_SHA1;
+	pcr_len = HASH_SIZE_SHA1;
+	pcr_transform = pts_meas_algo_to_pcr_transform(hash_algo, pcr_len);
+
+	if (this->pcr_info)
+	{
+		pcr_before = chunk_clone(pcrs->get(pcrs, pcr));
+	}
+	pcr_after = pcrs->extend(pcrs, pcr, measurement);
+	if (!pcr_after.ptr)
+	{
+		free(pcr_before.ptr);
+		return NULL;
+	}
+	name = this->name->clone(this->name);
+	name->set_qualifier(name, qualifier);
+	evidence = pts_comp_evidence_create(name, this->depth, pcr, hash_algo,
+			 		pcr_transform, this->measurement_time, measurement);
+	if (this->pcr_info)
+	{
+		pcr_after =chunk_clone(pcrs->get(pcrs, pcr));
+		evidence->set_pcr_info(evidence, pcr_before, pcr_after);
+	}
+	return evidence;
+}
+
+/**
+ * Compute and check boot aggregate value by hashing PCR0 to PCR7
+ */
+static bool check_boot_aggregate(pts_pcr_t *pcrs, chunk_t measurement)
+{
+	u_int32_t i;
+	u_char filename_buffer[IMA_FILENAME_LEN_MAX + 1];
+	u_char pcr_buffer[HASH_SIZE_SHA1];
+	chunk_t file_name, boot_aggregate;
+	hasher_t *hasher;
+	bool success, pcr_ok = TRUE;
+
+	hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
+	if (!hasher)
+	{
+		DBG1(DBG_PTS, "%N hasher could not be created",
+			 hash_algorithm_short_names, HASH_SHA1);
+		return FALSE;
+	}
+	for (i = 0; i < 8 && pcr_ok; i++)
+	{
+		pcr_ok = hasher->get_hash(hasher, pcrs->get(pcrs, i), NULL);
+	}
+	if (pcr_ok)
+	{
+		boot_aggregate = chunk_create(pcr_buffer, sizeof(pcr_buffer));
+		memset(filename_buffer, 0, sizeof(filename_buffer));
+		strcpy(filename_buffer, "boot_aggregate");
+		file_name = chunk_create (filename_buffer, sizeof(filename_buffer));
+
+		pcr_ok = hasher->get_hash(hasher, chunk_empty, pcr_buffer) &&
+				 hasher->get_hash(hasher, boot_aggregate, NULL) &&
+				 hasher->get_hash(hasher, file_name, boot_aggregate.ptr);
+	}
+	hasher->destroy(hasher);
+
+	if (pcr_ok)
+	{
+		success = chunk_equals(boot_aggregate, measurement);
+		DBG1(DBG_PTS, "boot aggregate value is %scorrect",
+					   success ? "":"in");
+		return success;
+	}
+	else
+	{
+		DBG1(DBG_PTS, "failed to compute boot aggregate value");
+		return FALSE;
+	}
+}
+
 METHOD(pts_component_t, get_comp_func_name, pts_comp_func_name_t*,
 	pts_ita_comp_ima_t *this)
 {
@@ -224,193 +490,446 @@ METHOD(pts_component_t, get_depth, u_int32_t,
 }
 
 METHOD(pts_component_t, measure, status_t,
-	pts_ita_comp_ima_t *this, pts_t *pts, pts_comp_evidence_t **evidence)
+	pts_ita_comp_ima_t *this, u_int8_t qualifier, pts_t *pts,
+	pts_comp_evidence_t **evidence)
 {
-	pts_comp_evidence_t *evid;
-	chunk_t pcr_before, pcr_after;
-	pts_pcr_transform_t pcr_transform;
-	pts_meas_algorithms_t hash_algo;
-	size_t pcr_len;
-	entry_t *entry;
-	hasher_t *hasher;
+	bios_entry_t *bios_entry;
+	ima_entry_t *ima_entry;
+	pts_pcr_t *pcrs;
+	pts_comp_evidence_t *evid = NULL;
+	status_t status;
 
-	hash_algo = PTS_MEAS_ALGO_SHA1;
-	pcr_len = pts->get_pcr_len(pts);   
-	pcr_transform = pts_meas_algo_to_pcr_transform(hash_algo, pcr_len);
+	pcrs = pts->get_pcrs(pts);
 
-	if (this->list->get_count(this->list) == 0)
+	if (qualifier == (PTS_ITA_QUALIFIER_FLAG_KERNEL |
+					  PTS_ITA_QUALIFIER_TYPE_TRUSTED))
 	{
-		if (!load_measurements(IMA_BIOS_MEASUREMENT_PATH, this->list,
-							   &this->bios_measurement_time))
+		switch (this->state)
 		{
-			return FAILED;
+			case IMA_STATE_INIT:
+				if (!load_bios_measurements(IMA_BIOS_MEASUREMENTS,
+					this->bios_list, &this->measurement_time))
+				{
+					return FAILED;
+				}
+				this->bios_count = this->bios_list->get_count(this->bios_list);
+				this->state = IMA_STATE_BIOS;
+				/* fall through to next state */
+			case IMA_STATE_BIOS:
+				status = this->bios_list->remove_first(this->bios_list,
+													  (void**)&bios_entry);
+				if (status != SUCCESS)
+				{
+					DBG1(DBG_PTS, "could not retrieve bios measurement entry");
+					return status;
+				}
+				evid = extend_pcr(this, qualifier, pcrs, bios_entry->pcr,
+								  bios_entry->measurement);
+				free(bios_entry);
+	
+				this->state = this->bios_list->get_count(this->bios_list) ?
+										IMA_STATE_BIOS : IMA_STATE_INIT;
+				break;
+			default:
+				return FAILED;
 		}
 	}
-	
-	if (this->list->remove_first(this->list, (void**)&entry) != SUCCESS)
+	else if (qualifier == (PTS_ITA_QUALIFIER_FLAG_KERNEL |
+						   PTS_ITA_QUALIFIER_TYPE_OS))
+	{
+		switch (this->state)
+		{
+			case IMA_STATE_INIT:
+				if (!load_runtime_measurements(IMA_RUNTIME_MEASUREMENTS,
+								this->ima_list, &this->measurement_time))
+				{
+					return FAILED;
+				}
+				this->state = IMA_STATE_BOOT_AGGREGATE;
+				/* fall through to next state */
+			case IMA_STATE_BOOT_AGGREGATE:
+			case IMA_STATE_RUNTIME:
+				status = this->ima_list->remove_first(this->ima_list,
+													 (void**)&ima_entry);
+				if (status != SUCCESS)
+				{
+					DBG1(DBG_PTS, "could not retrieve ima measurement entry");
+					return status;
+				}
+				if (this->state == IMA_STATE_BOOT_AGGREGATE && this->bios_count)
+				{
+					if (!check_boot_aggregate(pcrs, ima_entry->measurement))
+					{
+						return FAILED;
+					}
+				}
+				evid = extend_pcr(this, qualifier, pcrs, IMA_PCR,
+								  ima_entry->measurement);
+				if (evid)
+				{
+					evid->set_validation(evid, PTS_COMP_EVID_VALIDATION_PASSED,
+											   ima_entry->filename);
+				}
+				free(ima_entry->filename);
+				free(ima_entry);
+
+				this->state = this->ima_list->get_count(this->ima_list) ?
+									IMA_STATE_RUNTIME : IMA_STATE_END;
+				break;
+			default:
+				return FAILED;
+		}
+	}
+	else
 	{
-		DBG1(DBG_PTS, "could not retrieve measurement entry");
+		DBG1(DBG_PTS, "unsupported functional component name qualifier");
 		return FAILED;
 	}
-	
-	pcr_before = chunk_clone(this->pcrs[entry->pcr]);
-	
-	hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
-	hasher->get_hash(hasher, pcr_before, NULL);
-	hasher->get_hash(hasher, entry->measurement, this->pcrs[entry->pcr].ptr);
-	hasher->destroy(hasher);
-
-	pcr_after = chunk_clone(this->pcrs[entry->pcr]);
 
-	evid = *evidence = pts_comp_evidence_create(this->name->clone(this->name),
-							this->depth, entry->pcr, hash_algo, pcr_transform,
-							this->bios_measurement_time, entry->measurement);
-	evid->set_pcr_info(evid, pcr_before, pcr_after);
-
-	free(entry);
+	*evidence = evid;
+	if (!evid)
+	{
+		return FAILED;
+	}
 
-	return (this->list->get_count(this->list)) ? NEED_MORE : SUCCESS;
+	return (this->state == IMA_STATE_INIT || this->state == IMA_STATE_END) ?
+			SUCCESS : NEED_MORE;
 }
 
 METHOD(pts_component_t, verify, status_t,
-	pts_ita_comp_ima_t *this, pts_t *pts, pts_comp_evidence_t *evidence)
+	pts_ita_comp_ima_t *this, u_int8_t qualifier, pts_t *pts,
+	pts_comp_evidence_t *evidence)
 {
 	bool has_pcr_info;
-	u_int32_t extended_pcr, vid, name;
+	u_int32_t pcr, vid, name;
 	enum_name_t *names;
 	pts_meas_algorithms_t algo;
 	pts_pcr_transform_t transform;
+	pts_pcr_t *pcrs;
 	time_t measurement_time;
 	chunk_t measurement, pcr_before, pcr_after;
+	status_t status;
+	char *uri;
 
-	measurement = evidence->get_measurement(evidence, &extended_pcr,
-								&algo, &transform, &measurement_time);
-
+	/* some first time initializations */
 	if (!this->keyid.ptr)
 	{
 		if (!pts->get_aik_keyid(pts, &this->keyid))
 		{
+			DBG1(DBG_PTS, "AIK keyid not available");
 			return FAILED;
 		}
 		this->keyid = chunk_clone(this->keyid);
-
 		if (!this->pts_db)
 		{
 			DBG1(DBG_PTS, "pts database not available");
 			return FAILED;
 		}
-		if (this->pts_db->get_comp_measurement_count(this->pts_db,
-							this->name, this->keyid, algo,
-							&this->cid, &this->kid, &this->count) != SUCCESS)
-		{
-			return FAILED;
-		}
-		vid = this->name->get_vendor_id(this->name);
-		name = this->name->get_name(this->name);
-		names = pts_components->get_comp_func_names(pts_components, vid);
+	}
 
-		if (this->count)
-		{
-			DBG1(DBG_PTS, "checking %d %N '%N' functional component evidence "
-				 "measurements", this->count, pen_names, vid, names, name);
-		}
-		else
+	pcrs = pts->get_pcrs(pts);
+	measurement = evidence->get_measurement(evidence, &pcr,	&algo, &transform,
+											&measurement_time);
+
+	if (qualifier == (PTS_ITA_QUALIFIER_FLAG_KERNEL |
+					  PTS_ITA_QUALIFIER_TYPE_TRUSTED))
+	{
+		switch (this->state)
 		{
-			DBG1(DBG_PTS, "registering %N '%N' functional component evidence "
-				 "measurements", pen_names, vid, names, name);
-			this->is_registering = TRUE;
+			case IMA_STATE_INIT:
+				this->name->set_qualifier(this->name, qualifier);
+				status = this->pts_db->get_comp_measurement_count(this->pts_db,
+								this->name, this->keyid, algo, &this->bios_cid,
+								&this->kid, &this->bios_count);
+				this->name->set_qualifier(this->name, PTS_QUALIFIER_UNKNOWN);
+				if (status != SUCCESS)
+				{
+					return status;
+				}
+				vid = this->name->get_vendor_id(this->name);
+				name = this->name->get_name(this->name);
+				names = pts_components->get_comp_func_names(pts_components, vid);
+
+				if (this->bios_count)
+				{
+					DBG1(DBG_PTS, "checking %d %N '%N' BIOS evidence measurements",
+								   this->bios_count, pen_names, vid, names, name);
+				}
+				else
+				{
+					DBG1(DBG_PTS, "registering %N '%N' BIOS evidence measurements",
+								   pen_names, vid, names, name);
+					this->is_bios_registering = TRUE;
+				}
+
+				this->state = IMA_STATE_BIOS;
+				/* fall through to next state */
+			case IMA_STATE_BIOS:
+				if (this->is_bios_registering)
+				{
+					status = this->pts_db->insert_comp_measurement(this->pts_db,
+										measurement, this->bios_cid, this->kid,
+										++this->seq_no,	pcr, algo);
+					if (status != SUCCESS)
+					{
+						return status;
+					}
+					this->bios_count = this->seq_no + 1;
+				}
+				else
+				{
+					status = this->pts_db->check_comp_measurement(this->pts_db,
+										measurement, this->bios_cid, this->kid,
+										++this->seq_no,	pcr, algo);
+					if (status != SUCCESS)
+					{
+						return status;
+					}
+				}
+				break;
+			default:
+				return FAILED;
 		}
 	}
-
-	if (this->is_registering)
+	else if (qualifier == (PTS_ITA_QUALIFIER_FLAG_KERNEL |
+						   PTS_ITA_QUALIFIER_TYPE_OS))
 	{
-		if (this->pts_db->insert_comp_measurement(this->pts_db, measurement,
-										this->cid, this->kid, ++this->seq_no,
-										extended_pcr, algo) != SUCCESS)
+		int ima_count;
+
+		switch (this->state)
 		{
-			return FAILED;
+			case IMA_STATE_BIOS:
+				if (!check_boot_aggregate(pcrs, measurement))
+				{
+					this->state = IMA_STATE_RUNTIME;
+					return FAILED;
+				}
+				this->state = IMA_STATE_INIT;
+				/* fall through to next state */
+			case IMA_STATE_INIT:
+				this->name->set_qualifier(this->name, qualifier);
+				status = this->pts_db->get_comp_measurement_count(this->pts_db,
+										this->name, this->keyid, algo,
+										&this->ima_cid,	&this->kid, &ima_count);
+				this->name->set_qualifier(this->name, PTS_QUALIFIER_UNKNOWN);
+				if (status != SUCCESS)
+				{
+					return status;
+				}
+				vid = this->name->get_vendor_id(this->name);
+				name = this->name->get_name(this->name);
+				names = pts_components->get_comp_func_names(pts_components, vid);
+
+				if (ima_count)
+				{
+					DBG1(DBG_PTS, "checking %N '%N' boot aggregate evidence "
+								  "measurement", pen_names, vid, names, name);
+					status = this->pts_db->check_comp_measurement(this->pts_db,
+													measurement, this->ima_cid,
+													this->kid, 1, pcr, algo);
+				}
+				else
+				{
+					DBG1(DBG_PTS, "registering %N '%N' boot aggregate evidence "
+								   "measurement", pen_names, vid, names, name);
+					this->is_ima_registering = TRUE;
+					status = this->pts_db->insert_comp_measurement(this->pts_db,
+													measurement, this->ima_cid,
+										 			this->kid, 1, pcr, algo);
+				}
+				this->state = IMA_STATE_RUNTIME;
+
+				if (status != SUCCESS)
+				{
+					return status;
+				}
+				break;
+			case IMA_STATE_RUNTIME:
+				this->count++;
+				if (evidence->get_validation(evidence, &uri) !=
+					PTS_COMP_EVID_VALIDATION_PASSED)
+				{
+					DBG1(DBG_PTS, "policy URI could no be retrieved");
+					this->count_failed++;
+					return FAILED;
+				}
+				status = this->pts_db->check_file_measurement(this->pts_db,
+												pts->get_platform_info(pts),
+												PTS_MEAS_ALGO_SHA1_IMA,
+												measurement, uri);
+				switch (status)
+				{
+					case SUCCESS:
+						DBG3(DBG_PTS, "%#B for '%s' is ok",
+									   &measurement, uri);
+						this->count_ok++;
+						break;
+					case NOT_FOUND:
+						DBG2(DBG_PTS, "%#B for '%s' not found",
+									   &measurement, uri);
+						this->count_unknown++;
+						break;
+					case VERIFY_ERROR:
+						DBG1(DBG_PTS, "%#B for '%s' differs",
+									   &measurement, uri);
+						this->count_differ++;
+						break;
+					case FAILED:
+					default:
+						DBG1(DBG_PTS, "%#B for '%s' failed",
+									   &measurement, uri);
+						this->count_failed++;
+				}
+				break;
+			default:
+				return FAILED;
 		}
-		this->count = this->seq_no + 1;
 	}
 	else
 	{
-		if (this->pts_db->check_comp_measurement(this->pts_db, measurement,
-										this->cid, this->kid, ++this->seq_no,
-										extended_pcr, algo) != SUCCESS)
-		{
-			return FAILED;
-		}
+		DBG1(DBG_PTS, "unsupported functional component name qualifier");
+		return FAILED;
 	}
 
 	has_pcr_info = evidence->get_pcr_info(evidence, &pcr_before, &pcr_after);
 	if (has_pcr_info)
 	{
-		if (!pts->add_pcr(pts, extended_pcr, pcr_before, pcr_after))
+		if (!chunk_equals(pcr_before, pcrs->get(pcrs, pcr)))
 		{
-			return FAILED;
+			DBG1(DBG_PTS, "PCR %2u: pcr_before is not equal to register value",
+						   pcr);
+		}
+		if (pcrs->set(pcrs, pcr, pcr_after))
+		{
+			return SUCCESS;
 		}
 	}
-
-	return (this->seq_no < this->count) ? NEED_MORE : SUCCESS;
+	else
+	{
+		pcr_after = pcrs->extend(pcrs, pcr, measurement);
+		if (pcr_after.ptr)
+		{
+			return SUCCESS;
+		}
+	}
+	return FAILED;
 }
 
-METHOD(pts_component_t, check_off_registrations, bool,
-	pts_ita_comp_ima_t *this)
+METHOD(pts_component_t, finalize, bool,
+	pts_ita_comp_ima_t *this, u_int8_t qualifier)
 {
 	u_int32_t vid, name;
 	enum_name_t *names;
+	bool success = TRUE;
 		
-	if (!this->is_registering)
+	this->name->set_qualifier(this->name, qualifier);
+	vid = this->name->get_vendor_id(this->name);
+	name = this->name->get_name(this->name);
+	names = pts_components->get_comp_func_names(pts_components, vid);
+
+	if (qualifier == (PTS_ITA_QUALIFIER_FLAG_KERNEL |
+					  PTS_ITA_QUALIFIER_TYPE_TRUSTED))
 	{
-		return FALSE;
+		/* finalize BIOS measurements */
+		if (this->is_bios_registering)
+		{
+			/* close registration */
+			this->is_bios_registering = FALSE;
+
+			DBG1(DBG_PTS, "registered %d %N '%N' BIOS evidence measurements",
+						   this->seq_no, pen_names, vid, names, name);
+		}
+		else if (this->seq_no < this->bios_count)
+		{
+			DBG1(DBG_PTS, "%d of %d %N '%N' BIOS evidence measurements missing",
+						   this->bios_count - this->seq_no, this->bios_count,
+						   pen_names, vid, names, name);
+			success = FALSE;
+		}
 	}
+	else if (qualifier == (PTS_ITA_QUALIFIER_FLAG_KERNEL |
+						   PTS_ITA_QUALIFIER_TYPE_OS))
+	{
+		/* finalize IMA file measurements */
+		if (this->is_ima_registering)
+		{
+			/* close registration */
+			this->is_ima_registering = FALSE;
 
-	/* Finalize registration */
-	this->is_registering = FALSE;
+			DBG1(DBG_PTS, "registered %N '%N' boot aggregate evidence "
+						  "measurement", pen_names, vid, names, name);
+		}
+		if (this->count)
+		{
+			DBG1(DBG_PTS, "processed %d %N '%N' file evidence measurements: "
+						  "%d ok, %d unknown, %d differ, %d failed",
+						   this->count, pen_names, vid, names, name,
+						   this->count_ok, this->count_unknown,
+						   this->count_differ, this->count_failed);
+			success = !this->count_differ && !this->count_failed;
+		}
+	}
+	else
+	{
+		DBG1(DBG_PTS, "unsupported functional component name qualifier");
+		success = FALSE;
+	}
+	this->name->set_qualifier(this->name, PTS_QUALIFIER_UNKNOWN);
 
-	vid = this->name->get_vendor_id(this->name);
-	name = this->name->get_name(this->name);
-	names = pts_components->get_comp_func_names(pts_components, vid);
-	DBG1(DBG_PTS, "registered %d %N '%N' functional component evidence "
-				  "measurements", this->seq_no, pen_names, vid, names, name);
-	return TRUE;
+	return success;
+}
+
+METHOD(pts_component_t, get_ref, pts_component_t*,
+	pts_ita_comp_ima_t *this)
+{
+	ref_get(&this->ref);
+	return &this->public;
 }
 
 METHOD(pts_component_t, destroy, void,
 	pts_ita_comp_ima_t *this)
 {
-	int i, count;
+	int count;
 	u_int32_t vid, name;
 	enum_name_t *names;
 
-	for (i = 0; i < IMA_PCR_MAX; i++)
-	{
-		free(this->pcrs[i].ptr);
-	}
-	if (this->is_registering)
+	if (ref_put(&this->ref))
 	{
-		count = this->pts_db->delete_comp_measurements(this->pts_db,
-													   this->cid, this->kid);
 		vid = this->name->get_vendor_id(this->name);
 		name = this->name->get_name(this->name);
 		names = pts_components->get_comp_func_names(pts_components, vid);
-		DBG1(DBG_PTS, "deleted %d registered %N '%N' functional component "
-			 "evidence measurements", count, pen_names, vid, names, name);
+
+		if (this->is_bios_registering)
+		{
+			count = this->pts_db->delete_comp_measurements(this->pts_db,
+													this->bios_cid, this->kid);
+			DBG1(DBG_PTS, "deleted %d registered %N '%N' BIOS evidence "
+						  "measurements", count, pen_names, vid, names, name);
+		}
+		if (this->is_ima_registering)
+		{
+			count = this->pts_db->delete_comp_measurements(this->pts_db,
+													this->ima_cid, this->kid);
+			DBG1(DBG_PTS, "deleted registered %N '%N' boot aggregate evidence "
+						  "measurement", pen_names, vid, names, name);
+		}
+		this->bios_list->destroy_function(this->bios_list,
+										 (void *)free_bios_entry);
+		this->ima_list->destroy_function(this->ima_list, 
+										 (void *)free_ima_entry);
+		this->name->destroy(this->name);
+		free(this->keyid.ptr);
+		free(this);
 	}
-	this->list->destroy_function(this->list, (void *)free_entry);
-	this->name->destroy(this->name);
-	free(this->keyid.ptr);
-	free(this);
 }
 
 /**
  * See header
  */
-pts_component_t *pts_ita_comp_ima_create(u_int8_t qualifier, u_int32_t depth,
+pts_component_t *pts_ita_comp_ima_create(u_int32_t depth,
 										 pts_database_t *pts_db)
 {
 	pts_ita_comp_ima_t *this;
-	int i;
 
 	INIT(this,
 		.public = {
@@ -419,21 +938,21 @@ pts_component_t *pts_ita_comp_ima_create(u_int8_t qualifier, u_int32_t depth,
 			.get_depth = _get_depth,
 			.measure = _measure,
 			.verify = _verify,
-			.check_off_registrations = _check_off_registrations,
+			.finalize = _finalize,
+			.get_ref = _get_ref,
 			.destroy = _destroy,
 		},
 		.name = pts_comp_func_name_create(PEN_ITA, PTS_ITA_COMP_FUNC_NAME_IMA,
-										  qualifier),
+										  PTS_QUALIFIER_UNKNOWN),
 		.depth = depth,
 		.pts_db = pts_db,
-		.list = linked_list_create(),
+		.bios_list = linked_list_create(),
+		.ima_list = linked_list_create(),
+		.pcr_info = lib->settings->get_bool(lib->settings,
+						"libimcv.plugins.imc-attestation.pcr_info", TRUE),
+		.ref = 1,
 	);
 
-	for (i = 0; i < IMA_PCR_MAX; i++)
-	{
-		this->pcrs[i] = chunk_alloc(HASH_SIZE_SHA1);
-		memset(this->pcrs[i].ptr, 0x00, HASH_SIZE_SHA1);
-	}
 	return &this->public;
 }
 
diff --git a/src/libpts/pts/components/ita/ita_comp_ima.h b/src/libpts/pts/components/ita/ita_comp_ima.h
index 1ca27e6f0..546d0a4b2 100644
--- a/src/libpts/pts/components/ita/ita_comp_ima.h
+++ b/src/libpts/pts/components/ita/ita_comp_ima.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Andreas Steffen
+ * Copyright (C) 2011-2012 Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -26,11 +26,10 @@
 /**
  * Create a PTS ITS Functional Component object
  *
- * @param qualifier		PTS Component Functional Name Qualifier
  * @param depth			Sub-component depth
  * @param pts_db		PTS measurement database
  */
-pts_component_t* pts_ita_comp_ima_create(u_int8_t qualifier, u_int32_t depth,
+pts_component_t* pts_ita_comp_ima_create(u_int32_t depth,
 										 pts_database_t *pts_db);
 
 #endif /** PTS_ITA_COMP_IMA_H_ @}*/
diff --git a/src/libpts/pts/components/ita/ita_comp_tboot.c b/src/libpts/pts/components/ita/ita_comp_tboot.c
index a85de8cd8..9deeb19b5 100644
--- a/src/libpts/pts/components/ita/ita_comp_tboot.c
+++ b/src/libpts/pts/components/ita/ita_comp_tboot.c
@@ -1,6 +1,5 @@
 /*
- * Copyright (C) 2011 Andreas Steffen
- *
+ * Copyright (C) 2011-2012 Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -86,6 +85,11 @@ struct pts_ita_comp_tboot_t {
 	 */
 	int seq_no;
 
+	/**
+	 * Reference count
+	 */
+	refcount_t ref;
+
 };
 
 METHOD(pts_component_t, get_comp_func_name, pts_comp_func_name_t*,
@@ -107,15 +111,18 @@ METHOD(pts_component_t, get_depth, u_int32_t,
 }
 
 METHOD(pts_component_t, measure, status_t,
-	pts_ita_comp_tboot_t *this, pts_t *pts, pts_comp_evidence_t **evidence)
+	pts_ita_comp_tboot_t *this, u_int8_t qualifier, pts_t *pts,
+	pts_comp_evidence_t **evidence)
+
 {
+	size_t pcr_len;
+	pts_pcr_t *pcrs;
+	pts_pcr_transform_t pcr_transform;
+	pts_meas_algorithms_t hash_algo;
 	pts_comp_evidence_t *evid;
 	char *meas_hex, *pcr_before_hex, *pcr_after_hex;
 	chunk_t measurement, pcr_before, pcr_after;
-	size_t hash_size, pcr_len;
 	u_int32_t extended_pcr;
-	pts_pcr_transform_t pcr_transform;
-	pts_meas_algorithms_t hash_algo;
 	
 	switch (this->seq_no++)
 	{
@@ -149,9 +156,8 @@ METHOD(pts_component_t, measure, status_t,
 		return FAILED;
 	}
 
-	hash_algo = pts->get_meas_algorithm(pts);
-	hash_size = pts_meas_algo_hash_size(hash_algo);
-	pcr_len = pts->get_pcr_len(pts);
+	hash_algo = PTS_MEAS_ALGO_SHA1;
+	pcr_len = HASH_SIZE_SHA1;
 	pcr_transform = pts_meas_algo_to_pcr_transform(hash_algo, pcr_len);
 
 	/* get and check the measurement data */
@@ -162,35 +168,40 @@ METHOD(pts_component_t, measure, status_t,
 	pcr_after = chunk_from_hex(
 					chunk_create(pcr_after_hex, strlen(pcr_after_hex)), NULL);
 	if (pcr_before.len != pcr_len || pcr_after.len != pcr_len ||
-		measurement.len != hash_size)
+		measurement.len != pcr_len)
 	{
-		DBG1(DBG_PTS, "TBOOT measurement or pcr data have the wrong size");
+		DBG1(DBG_PTS, "TBOOT measurement or PCR data have the wrong size");
 		free(measurement.ptr);
 		free(pcr_before.ptr);
 		free(pcr_after.ptr);
 		return FAILED;
 	}
 
+	pcrs = pts->get_pcrs(pts);
+	pcrs->set(pcrs, extended_pcr, pcr_after);
 	evid = *evidence = pts_comp_evidence_create(this->name->clone(this->name),
-								this->depth, extended_pcr,
-								hash_algo, pcr_transform,
-								this->measurement_time, measurement);
+							this->depth, extended_pcr, hash_algo, pcr_transform,
+							this->measurement_time, measurement);
 	evid->set_pcr_info(evid, pcr_before, pcr_after);
 
 	return (this->seq_no < 2) ? NEED_MORE : SUCCESS;
 }
 
 METHOD(pts_component_t, verify, status_t,
-	pts_ita_comp_tboot_t *this, pts_t *pts, pts_comp_evidence_t *evidence)
+	pts_ita_comp_tboot_t *this, u_int8_t qualifier,pts_t *pts,
+	pts_comp_evidence_t *evidence)
 {
 	bool has_pcr_info;
 	u_int32_t extended_pcr, vid, name;
 	enum_name_t *names;
 	pts_meas_algorithms_t algo;
 	pts_pcr_transform_t transform;
+	pts_pcr_t *pcrs;
 	time_t measurement_time;
 	chunk_t measurement, pcr_before, pcr_after;
+	status_t status;
 
+	pcrs = pts->get_pcrs(pts);
 	measurement = evidence->get_measurement(evidence, &extended_pcr,
 								&algo, &transform, &measurement_time);
 
@@ -207,11 +218,12 @@ METHOD(pts_component_t, verify, status_t,
 			DBG1(DBG_PTS, "pts database not available");
 			return FAILED;
 		}
-		if (this->pts_db->get_comp_measurement_count(this->pts_db,
-					 		this->name, this->keyid, algo,
-							&this->cid, &this->kid, &this->count) != SUCCESS)
+		status = this->pts_db->get_comp_measurement_count(this->pts_db,
+								this->name, this->keyid, algo, &this->cid,
+								&this->kid, &this->count);
+		if (status != SUCCESS)
 		{
-			return FAILED;
+			return status;
 		}
 		vid = this->name->get_vendor_id(this->name);
 		name = this->name->get_name(this->name);
@@ -232,58 +244,79 @@ METHOD(pts_component_t, verify, status_t,
 
 	if (this->is_registering)
 	{
-		if (this->pts_db->insert_comp_measurement(this->pts_db, measurement,
-						 				this->cid, this->kid, ++this->seq_no,
-										extended_pcr, algo) != SUCCESS)
+		status = this->pts_db->insert_comp_measurement(this->pts_db,
+								measurement, this->cid, this->kid,
+								++this->seq_no, extended_pcr, algo);
+		if (status != SUCCESS)
 		{
-			return FAILED;
+			return status;
 		}
 		this->count = this->seq_no + 1;
 	}
 	else
 	{
-		if (this->pts_db->check_comp_measurement(this->pts_db, measurement,
-										this->cid, this->kid, ++this->seq_no,
-										extended_pcr, algo) != SUCCESS)
+		status = this->pts_db->check_comp_measurement(this->pts_db,
+								measurement, this->cid, this->kid,
+								++this->seq_no, extended_pcr, algo);
+		if (status != SUCCESS)
 		{
-			return FAILED;
+			return status;
 		}
 	}
 
 	has_pcr_info = evidence->get_pcr_info(evidence, &pcr_before, &pcr_after);
 	if (has_pcr_info)
 	{
-		if (!pts->add_pcr(pts, extended_pcr, pcr_before, pcr_after))
+		if (!chunk_equals(pcr_before, pcrs->get(pcrs, extended_pcr)))
 		{
-			return FAILED;
+			DBG1(DBG_PTS, "PCR %2u: pcr_before is not equal to register value",
+						   extended_pcr);
+		}
+		if (pcrs->set(pcrs, extended_pcr, pcr_after))
+		{
+			return SUCCESS;
 		}
 	}
 
-	return (this->seq_no < this->count) ? NEED_MORE : SUCCESS;
+	return SUCCESS;
 }
 
-METHOD(pts_component_t, check_off_registrations, bool,
-	pts_ita_comp_tboot_t *this)
+METHOD(pts_component_t, finalize, bool,
+	pts_ita_comp_tboot_t *this, u_int8_t qualifier)
 {
 	u_int32_t vid, name;
 	enum_name_t *names;
 		
-	if (!this->is_registering)
+	vid = this->name->get_vendor_id(this->name);
+	name = this->name->get_name(this->name);
+	names = pts_components->get_comp_func_names(pts_components, vid);
+
+	if (this->is_registering)
 	{
+		/* close registration */
+		this->is_registering = FALSE;
+
+		DBG1(DBG_PTS, "registered %d %N '%N' functional component evidence "
+					  "measurements", this->seq_no, pen_names, vid, names, name);
+	}
+	else if (this->seq_no < this->count)
+	{
+		DBG1(DBG_PTS, "%d of %d %N '%N' functional component evidence "
+					  "measurements missing", this->count - this->seq_no,
+					   this->count, pen_names, vid, names, name);
 		return FALSE;
 	}
 
-	/* Finalize registration */
-	this->is_registering = FALSE;
-
-	vid = this->name->get_vendor_id(this->name);
-	name = this->name->get_name(this->name);
-	names = pts_components->get_comp_func_names(pts_components, vid);
-	DBG1(DBG_PTS, "registered %d %N '%N' functional component evidence "
-				  "measurements", this->seq_no, pen_names, vid, names, name);
 	return TRUE;
 }
 
+METHOD(pts_component_t, get_ref, pts_component_t*,
+	pts_ita_comp_tboot_t *this)
+{
+	ref_get(&this->ref);
+	return &this->public;
+}
+
 METHOD(pts_component_t, destroy, void,
 	   pts_ita_comp_tboot_t *this)
 {
@@ -291,25 +324,28 @@ METHOD(pts_component_t, destroy, void,
 	u_int32_t vid, name;
 	enum_name_t *names;
 
-	if (this->is_registering)
+	if (ref_put(&this->ref))
 	{
-		count = this->pts_db->delete_comp_measurements(this->pts_db,
-													   this->cid, this->kid);
-		vid = this->name->get_vendor_id(this->name);
-		name = this->name->get_name(this->name);
-		names = pts_components->get_comp_func_names(pts_components, vid);
-		DBG1(DBG_PTS, "deleted %d registered %N '%N' functional component "
-			 "evidence measurements", count, pen_names, vid, names, name);
+		if (this->is_registering)
+		{
+			count = this->pts_db->delete_comp_measurements(this->pts_db,
+													this->cid, this->kid);
+			vid = this->name->get_vendor_id(this->name);
+			name = this->name->get_name(this->name);
+			names = pts_components->get_comp_func_names(pts_components, vid);
+			DBG1(DBG_PTS, "deleted %d registered %N '%N' functional component "
+				 "evidence measurements", count, pen_names, vid, names, name);
+		}
+		this->name->destroy(this->name);
+		free(this->keyid.ptr);
+		free(this);
 	}
-	this->name->destroy(this->name);
-	free(this->keyid.ptr);
-	free(this);
 }
 
 /**
  * See header
  */
-pts_component_t *pts_ita_comp_tboot_create(u_int8_t qualifier, u_int32_t depth,
+pts_component_t *pts_ita_comp_tboot_create(u_int32_t depth,
 										   pts_database_t *pts_db)
 {
 	pts_ita_comp_tboot_t *this;
@@ -321,13 +357,16 @@ pts_component_t *pts_ita_comp_tboot_create(u_int8_t qualifier, u_int32_t depth,
 			.get_depth = _get_depth,
 			.measure = _measure,
 			.verify = _verify,
-			.check_off_registrations = _check_off_registrations,
+			.finalize = _finalize,
+			.get_ref = _get_ref,
 			.destroy = _destroy,
 		},
 		.name = pts_comp_func_name_create(PEN_ITA, PTS_ITA_COMP_FUNC_NAME_TBOOT,
-										  qualifier),
+										  PTS_ITA_QUALIFIER_FLAG_KERNEL |
+										  PTS_ITA_QUALIFIER_TYPE_TRUSTED),
 		.depth = depth,
 		.pts_db = pts_db,
+		.ref = 1,
 	);
 
 	return &this->public;
diff --git a/src/libpts/pts/components/ita/ita_comp_tboot.h b/src/libpts/pts/components/ita/ita_comp_tboot.h
index 39554fbc7..1e1a14831 100644
--- a/src/libpts/pts/components/ita/ita_comp_tboot.h
+++ b/src/libpts/pts/components/ita/ita_comp_tboot.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -26,11 +26,10 @@
 /**
  * Create a PTS ITS Functional Component object
  *
- * @param qualifier		PTS Component Functional Name Qualifier
  * @param depth			Sub-component depth
  * @param pts_db		PTS measurement database
  */
-pts_component_t* pts_ita_comp_tboot_create(u_int8_t qualifier, u_int32_t depth,
+pts_component_t* pts_ita_comp_tboot_create(u_int32_t depth,
 										   pts_database_t *pts_db);
 
 #endif /** PTS_ITA_COMP_TBOOT_H_ @}*/
diff --git a/src/libpts/pts/components/ita/ita_comp_tgrub.c b/src/libpts/pts/components/ita/ita_comp_tgrub.c
index 0dfd5fd41..986f7ace2 100644
--- a/src/libpts/pts/components/ita/ita_comp_tgrub.c
+++ b/src/libpts/pts/components/ita/ita_comp_tgrub.c
@@ -1,6 +1,5 @@
 /*
- * Copyright (C) 2011 Andreas Steffen
- *
+ * Copyright (C) 2011-2012 Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -50,6 +49,12 @@ struct pts_ita_comp_tgrub_t {
 	 */
 	pts_database_t *pts_db;
 
+
+	/**
+	 * Reference count
+	 */
+	refcount_t ref;
+
 };
 
 METHOD(pts_component_t, get_comp_func_name, pts_comp_func_name_t*,
@@ -71,15 +76,16 @@ METHOD(pts_component_t, get_depth, u_int32_t,
 }
 
 METHOD(pts_component_t, measure, status_t,
-	pts_ita_comp_tgrub_t *this, pts_t *pts, pts_comp_evidence_t **evidence)
+	pts_ita_comp_tgrub_t *this, u_int8_t qualifier, pts_t *pts,
+	pts_comp_evidence_t **evidence)
 {
+	size_t pcr_len;
+	pts_pcr_transform_t pcr_transform;
+	pts_meas_algorithms_t hash_algo;
 	pts_comp_evidence_t *evid;
 	u_int32_t extended_pcr;
 	time_t measurement_time;
 	chunk_t measurement, pcr_before, pcr_after;
-	pts_pcr_transform_t pcr_transform;
-	pts_meas_algorithms_t hash_algo;
-	size_t hash_size, pcr_len;
 
 	/* Provisional implementation for TGRUB */
 	extended_pcr = PCR_DEBUG;
@@ -91,12 +97,11 @@ METHOD(pts_component_t, measure, status_t,
 		return FAILED;
 	}
 
-	hash_algo = pts->get_meas_algorithm(pts);
-	hash_size = pts_meas_algo_hash_size(hash_algo);
-	pcr_len = pts->get_pcr_len(pts);
+	hash_algo = PTS_MEAS_ALGO_SHA1;
+	pcr_len = HASH_SIZE_SHA1;
 	pcr_transform = pts_meas_algo_to_pcr_transform(hash_algo, pcr_len);
 
-	measurement = chunk_alloc(hash_size);
+	measurement = chunk_alloc(pcr_len);
 	memset(measurement.ptr, 0x00, measurement.len);
 		
 	pcr_before = chunk_alloc(pcr_len);
@@ -112,15 +117,18 @@ METHOD(pts_component_t, measure, status_t,
 }
 
 METHOD(pts_component_t, verify, status_t,
-	pts_ita_comp_tgrub_t *this, pts_t *pts,	pts_comp_evidence_t *evidence)
+	pts_ita_comp_tgrub_t *this, u_int8_t qualifier, pts_t *pts,
+	pts_comp_evidence_t *evidence)
 {
 	bool has_pcr_info;
 	u_int32_t extended_pcr;
 	pts_meas_algorithms_t algo;
 	pts_pcr_transform_t transform;
+	pts_pcr_t *pcrs;
 	time_t measurement_time;
 	chunk_t measurement, pcr_before, pcr_after;
 
+	pcrs = pts->get_pcrs(pts);
 	measurement = evidence->get_measurement(evidence, &extended_pcr,
 								&algo, &transform, &measurement_time);
 	if (extended_pcr != PCR_DEBUG)
@@ -133,32 +141,46 @@ METHOD(pts_component_t, verify, status_t,
 	has_pcr_info = evidence->get_pcr_info(evidence, &pcr_before, &pcr_after);
 	if (has_pcr_info)
 	{
-		if (!pts->add_pcr(pts, extended_pcr, pcr_before, pcr_after))
+		if (!chunk_equals(pcr_before, pcrs->get(pcrs, extended_pcr)))
 		{
-			return FAILED;
+			DBG1(DBG_PTS, "PCR %2u: pcr_before is not equal to pcr value");
+		}
+		if (pcrs->set(pcrs, extended_pcr, pcr_after))
+		{
+			return SUCCESS;
 		}
 	}
 	
 	return SUCCESS;
 }
 
-METHOD(pts_component_t, check_off_registrations, bool,
-	pts_ita_comp_tgrub_t *this)
+METHOD(pts_component_t, finalize, bool,
+	pts_ita_comp_tgrub_t *this, u_int8_t qualifier)
 {
 	return FALSE;
 }
 
+METHOD(pts_component_t, get_ref, pts_component_t*,
+	pts_ita_comp_tgrub_t *this)
+{
+	ref_get(&this->ref);
+	return &this->public;
+}
+
 METHOD(pts_component_t, destroy, void,
 	pts_ita_comp_tgrub_t *this)
 {
-	this->name->destroy(this->name);
-	free(this);
+	if (ref_put(&this->ref))
+	{
+		this->name->destroy(this->name);
+		free(this);
+	}
 }
 
 /**
  * See header
  */
-pts_component_t *pts_ita_comp_tgrub_create(u_int8_t qualifier, u_int32_t depth,
+pts_component_t *pts_ita_comp_tgrub_create(u_int32_t depth,
 										   pts_database_t *pts_db)
 {
 	pts_ita_comp_tgrub_t *this;
@@ -170,13 +192,16 @@ pts_component_t *pts_ita_comp_tgrub_create(u_int8_t qualifier, u_int32_t depth,
 			.get_depth = _get_depth,
 			.measure = _measure,
 			.verify = _verify,
-			.check_off_registrations = _check_off_registrations,
+			.finalize = _finalize,
+			.get_ref = _get_ref,
 			.destroy = _destroy,
 		},
 		.name = pts_comp_func_name_create(PEN_ITA, PTS_ITA_COMP_FUNC_NAME_TGRUB,
-										  qualifier),
+										  PTS_ITA_QUALIFIER_FLAG_KERNEL |
+										  PTS_ITA_QUALIFIER_TYPE_TRUSTED),
 		.depth = depth,
 		.pts_db = pts_db,
+		.ref = 1,
 	);
 
 	return &this->public;
diff --git a/src/libpts/pts/components/ita/ita_comp_tgrub.h b/src/libpts/pts/components/ita/ita_comp_tgrub.h
index 52ecc325c..59913c82d 100644
--- a/src/libpts/pts/components/ita/ita_comp_tgrub.h
+++ b/src/libpts/pts/components/ita/ita_comp_tgrub.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -26,11 +26,10 @@
 /**
  * Create a PTS ITS Functional Component object
  *
- * @param qualifier		PTS Component Functional Name Qualifier
  * @param depth			Sub-component depth
  * @param pts_db		PTS measurement database
  */
-pts_component_t* pts_ita_comp_tgrub_create(u_int8_t qualifier, u_int32_t depth,
+pts_component_t* pts_ita_comp_tgrub_create(u_int32_t depth,
 										   pts_database_t *pts_db);
 
 #endif /** PTS_ITA_COMP_TGRUB_H_ @}*/
diff --git a/src/libpts/pts/components/pts_comp_evidence.c b/src/libpts/pts/components/pts_comp_evidence.c
index 9eb8dae75..050717472 100644
--- a/src/libpts/pts/components/pts_comp_evidence.c
+++ b/src/libpts/pts/components/pts_comp_evidence.c
@@ -87,7 +87,7 @@ struct private_pts_comp_evidence_t {
 	/**
 	 * Verification Policy URI
 	 */
-	chunk_t policy_uri;
+	char *policy_uri;
 
 };
 
@@ -152,12 +152,12 @@ METHOD(pts_comp_evidence_t, set_pcr_info, void,
 	this->pcr_before = pcr_before;
 	this->pcr_after =  pcr_after;
 
-	DBG2(DBG_PTS, "PCR %2d before value : %#B", this->extended_pcr, &pcr_before);
-	DBG2(DBG_PTS, "PCR %2d after value  : %#B", this->extended_pcr, &pcr_after);
+	DBG3(DBG_PTS, "PCR %2d before value : %#B", this->extended_pcr, &pcr_before);
+	DBG3(DBG_PTS, "PCR %2d after value  : %#B", this->extended_pcr, &pcr_after);
 }
 
 METHOD(pts_comp_evidence_t, get_validation, pts_comp_evid_validation_t,
-	private_pts_comp_evidence_t *this, chunk_t *uri)
+	private_pts_comp_evidence_t *this, char **uri)
 {
 	if (uri)
 	{
@@ -168,10 +168,14 @@ METHOD(pts_comp_evidence_t, get_validation, pts_comp_evid_validation_t,
 
 METHOD(pts_comp_evidence_t, set_validation, void,
 	private_pts_comp_evidence_t *this, pts_comp_evid_validation_t validation,
-	chunk_t uri)
+	char *uri)
 {
 	this->validation = validation;
-	this->policy_uri = chunk_clone(uri);
+	if (uri)
+	{
+		this->policy_uri = strdup(uri);
+		DBG3(DBG_PTS, "'%s'", uri);
+	}
 }
 
 METHOD(pts_comp_evidence_t, destroy, void,
@@ -181,7 +185,7 @@ METHOD(pts_comp_evidence_t, destroy, void,
 	free(this->measurement.ptr);
 	free(this->pcr_before.ptr);
 	free(this->pcr_after.ptr);
-	free(this->policy_uri.ptr);
+	free(this->policy_uri);
 	free(this);
 }
 
@@ -219,8 +223,8 @@ pts_comp_evidence_t *pts_comp_evidence_create(pts_comp_func_name_t *name,
 	);
 
 	name->log(name, "");
-	DBG2(DBG_PTS, "measurement time: %T", &measurement_time, FALSE);
-	DBG2(DBG_PTS, "PCR %2d extended with: %#B", extended_pcr, &measurement);
+	DBG3(DBG_PTS, "measurement time: %T", &measurement_time, FALSE);
+	DBG3(DBG_PTS, "PCR %2d extended with: %#B", extended_pcr, &measurement);
 
 	return &this->public;
 }
diff --git a/src/libpts/pts/components/pts_comp_evidence.h b/src/libpts/pts/components/pts_comp_evidence.h
index fe86aa940..55776ce8b 100644
--- a/src/libpts/pts/components/pts_comp_evidence.h
+++ b/src/libpts/pts/components/pts_comp_evidence.h
@@ -120,7 +120,7 @@ struct pts_comp_evidence_t {
 	 * @return validation		Validation Result
 	 */
 	pts_comp_evid_validation_t (*get_validation)(pts_comp_evidence_t *this,
-								chunk_t *uri);
+								char **uri);
 
 	/**
 	 * Sets Validation Result if available
@@ -129,7 +129,7 @@ struct pts_comp_evidence_t {
 	 * @param uri				Verification Policy URI
 	 */
 	void (*set_validation)(pts_comp_evidence_t *this,
-						   pts_comp_evid_validation_t validation, chunk_t uri);
+						   pts_comp_evid_validation_t validation, char* uri);
 
 	/**
 	 * Destroys a pts_comp_evidence_t object.
diff --git a/src/libpts/pts/components/pts_comp_func_name.c b/src/libpts/pts/components/pts_comp_func_name.c
index d98850d78..7501be044 100644
--- a/src/libpts/pts/components/pts_comp_func_name.c
+++ b/src/libpts/pts/components/pts_comp_func_name.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Andreas Steffen
+ * Copyright (C) 2011-2012 Andreas Steffen
  *
  * HSR Hochschule fuer Technik Rapperswil
  *
@@ -67,6 +67,12 @@ METHOD(pts_comp_func_name_t, get_qualifier, u_int8_t,
 	return this->qualifier;
 }
 
+METHOD(pts_comp_func_name_t, set_qualifier, void,
+	private_pts_comp_func_name_t *this, u_int8_t qualifier)
+{
+	this->qualifier = qualifier;
+}
+
 static bool equals(private_pts_comp_func_name_t *this,
 				   private_pts_comp_func_name_t *other)
 {
@@ -137,6 +143,7 @@ pts_comp_func_name_t* pts_comp_func_name_create(u_int32_t vid, u_int32_t name,
 			.get_vendor_id = _get_vendor_id,
 			.get_name = _get_name,
 			.get_qualifier = _get_qualifier,
+			.set_qualifier = _set_qualifier,
 			.equals = (bool(*)(pts_comp_func_name_t*,pts_comp_func_name_t*))equals,
 			.clone = _clone_,
 			.log = _log_,
diff --git a/src/libpts/pts/components/pts_comp_func_name.h b/src/libpts/pts/components/pts_comp_func_name.h
index 2c7a84177..a3ffa1ba9 100644
--- a/src/libpts/pts/components/pts_comp_func_name.h
+++ b/src/libpts/pts/components/pts_comp_func_name.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -55,6 +55,13 @@ struct pts_comp_func_name_t {
 	u_int8_t (*get_qualifier)(pts_comp_func_name_t *this);
 
 	/**
+	 * Set the PTS Component Functional Name Qualifier
+	 *
+	 * @param qualifier		PTS Component Functional Name Qualifier to be set
+	 */
+	void (*set_qualifier)(pts_comp_func_name_t *this, u_int8_t qualifier);
+
+	/**
 	 * Check to PTS Component Functional Names for equality
 	 *
 	 * @param other			Other PTS Component Functional Name
diff --git a/src/libpts/pts/components/pts_component.h b/src/libpts/pts/components/pts_component.h
index 524ff332d..da339a55f 100644
--- a/src/libpts/pts/components/pts_component.h
+++ b/src/libpts/pts/components/pts_component.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Andreas Steffen
+ * Copyright (C) 2011-2012 Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -25,6 +25,7 @@ typedef struct pts_component_t pts_component_t;
 
 #include "pts/pts.h"
 #include "pts/pts_database.h"
+#include "pts/pts_file_meas.h"
 #include "pts/components/pts_comp_func_name.h"
 #include "pts/components/pts_comp_evidence.h"
 
@@ -59,30 +60,41 @@ struct pts_component_t {
 	/**
 	 * Do evidence measurements on the PTS Functional Component
 	 *
+	 * @param qualifier		PTS Component Functional Name Qualifier
 	 * @param pts			PTS interface
 	 * @param evidence		returns component evidence measureemt
+	 * @param measurements	additional file measurements (NULL if not present)
 	 * @return				status return code
 	 */
-	status_t (*measure)(pts_component_t *this, pts_t *pts,
+	status_t (*measure)(pts_component_t *this, u_int8_t qualifier, pts_t *pts,
 						pts_comp_evidence_t** evidence);
 
 	/**
 	 * Verify the evidence measurements of the PTS Functional Component
 	 *
+	 * @param qualifier		PTS Component Functional Name Qualifier
 	 * @param pts			PTS interface
 	 * @param evidence		component evidence measurement to be verified
 	 * @return				status return code
 	 */
-	status_t (*verify)(pts_component_t *this, pts_t *pts,
+	status_t (*verify)(pts_component_t *this, u_int8_t qualifier, pts_t *pts,
 					   pts_comp_evidence_t *evidence);
 
-
 	/**
 	 * Tell the PTS Functional Component to finalize pending registrations
+	 * and check for missing measurements
+	 *
+	 * @param qualifier		PTS Component Functional Name Qualifier
+	 * @return				TRUE if finalization successful
+	 */
+	bool (*finalize)(pts_component_t *this, u_int8_t qualifier);
+
+	/**
+	 * Get a new reference to the PTS Functional Component
 	 *
-	 * @return				TRUE if there are pending registrations
+	 * @return			this, with an increased refcount
 	 */
-	bool (*check_off_registrations)(pts_component_t *this);
+	pts_component_t* (*get_ref)(pts_component_t *this);
 
 	/**
 	 * Destroys a pts_component_t object.
diff --git a/src/libpts/pts/components/pts_component_manager.c b/src/libpts/pts/components/pts_component_manager.c
index 8ac4767bf..e330aeebf 100644
--- a/src/libpts/pts/components/pts_component_manager.c
+++ b/src/libpts/pts/components/pts_component_manager.c
@@ -1,6 +1,5 @@
 /*
- * Copyright (C) 2011 Andreas Steffen
- *
+ * Copyright (C) 2011-2012 Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -270,8 +269,7 @@ METHOD(pts_component_manager_t, create, pts_component_t*,
 			{
 				if (entry2->name == name->get_name(name) && entry2->create)
 				{
-					component = entry2->create(name->get_qualifier(name),
-											   depth, pts_db);
+					component = entry2->create(depth, pts_db);
 					break;
 				}
 			}
diff --git a/src/libpts/pts/components/pts_component_manager.h b/src/libpts/pts/components/pts_component_manager.h
index 0079d0e26..61055ec74 100644
--- a/src/libpts/pts/components/pts_component_manager.h
+++ b/src/libpts/pts/components/pts_component_manager.h
@@ -30,8 +30,7 @@ typedef struct pts_component_manager_t pts_component_manager_t;
 #include <library.h>
 #include <pen/pen.h>
 
-typedef pts_component_t* (*pts_component_create_t)(u_int8_t qualifier,
-												   u_int32_t depth,
+typedef pts_component_t* (*pts_component_create_t)(u_int32_t depth,
 												   pts_database_t *pts_db);
 
 /**
diff --git a/src/libpts/pts/pts.c b/src/libpts/pts/pts.c
index 65ae2b2d2..4c6c5bc22 100644
--- a/src/libpts/pts/pts.c
+++ b/src/libpts/pts/pts.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -23,22 +23,13 @@
 #include <trousers/tss.h>
 #include <trousers/trousers.h>
 
+#include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/utsname.h>
+#include <libgen.h>
+#include <unistd.h>
 #include <errno.h>
 
-#define PTS_BUF_SIZE	4096
-
-/**
- * Maximum number of PCR's of TPM, TPM Spec 1.2
- */
-#define PCR_MAX_NUM				24
-
-/**
- * Number of bytes that can be saved in a PCR of TPM, TPM Spec 1.2
- */
-#define PCR_LEN					20
-
 typedef struct private_pts_t private_pts_t;
 
 /**
@@ -118,29 +109,9 @@ struct private_pts_t {
  	certificate_t *aik;
 
 	/**
-	 * Table of extended PCRs with corresponding values
-	 */
-	u_char* pcrs[PCR_MAX_NUM];
-
-	/**
-	 * Length of PCR registers
-	 */
-	size_t pcr_len;
-
-	/**
-	 * Number of extended PCR registers
-	 */
-	u_int32_t pcr_count;
-
-	/**
-	 * Highest extended PCR register
-	 */
-	u_int32_t pcr_max;
-
-	/**
-	 * Bitmap of extended PCR registers
+	 * Shadow PCR set
 	 */
-	u_int8_t pcr_select[PCR_MAX_NUM / 8];
+	pts_pcr_t *pcrs;
 
 };
 
@@ -225,9 +196,13 @@ METHOD(pts_t, create_dh_nonce, bool,
 	DBG2(DBG_PTS, "nonce length is %d", nonce_len);
 	nonce = this->is_imc ? &this->responder_nonce : &this->initiator_nonce;
 	chunk_free(nonce);
-	rng->allocate_bytes(rng, nonce_len, nonce);
+	if (!rng->allocate_bytes(rng, nonce_len, nonce))
+	{
+		DBG1(DBG_PTS, "failed to allocate nonce");
+		rng->destroy(rng);
+		return FALSE;
+	}
 	rng->destroy(rng);
-
 	return TRUE;
 }
 
@@ -282,10 +257,15 @@ METHOD(pts_t, calculate_secret, bool,
 	hash_alg = pts_meas_algo_to_hash(this->dh_hash_algorithm);
 	hasher = lib->crypto->create_hasher(lib->crypto, hash_alg);
 
-	hasher->allocate_hash(hasher, chunk_from_chars('1'), NULL);
-	hasher->allocate_hash(hasher, this->initiator_nonce, NULL);
-	hasher->allocate_hash(hasher, this->responder_nonce, NULL);
-	hasher->allocate_hash(hasher, shared_secret, &this->secret);
+	if (!hasher ||
+		!hasher->get_hash(hasher, chunk_from_chars('1'), NULL) ||
+		!hasher->get_hash(hasher, this->initiator_nonce, NULL) ||
+		!hasher->get_hash(hasher, this->responder_nonce, NULL) ||
+		!hasher->allocate_hash(hasher, shared_secret, &this->secret))
+	{
+		DESTROY_IF(hasher);
+		return FALSE;
+	}
 	hasher->destroy(hasher);
 
 	/* The DH secret must be destroyed */
@@ -359,12 +339,6 @@ METHOD(pts_t, set_tpm_version_info, void,
 	print_tpm_version_info(this);
 }
 
-METHOD(pts_t, get_pcr_len, size_t,
-	private_pts_t *this)
-{
-	return this->pcr_len;
-}
-
 /**
  * Load an AIK Blob (TSS_TSPATTRIB_KEYBLOB_BLOB attribute)
  */
@@ -486,54 +460,6 @@ METHOD(pts_t, get_aik_keyid, bool,
 	return success;
 }
 
-METHOD(pts_t, hash_file, bool,
-	private_pts_t *this, hasher_t *hasher, char *pathname, u_char *hash)
-{
-	u_char buffer[PTS_BUF_SIZE];
-	FILE *file;
-	int bytes_read;
-
-	file = fopen(pathname, "rb");
-	if (!file)
-	{
-		DBG1(DBG_PTS,"  file '%s' can not be opened, %s", pathname,
-			 strerror(errno));
-		return FALSE;
-	}
-	while (TRUE)
-	{
-		bytes_read = fread(buffer, 1, sizeof(buffer), file);
-		if (bytes_read > 0)
-		{
-			hasher->get_hash(hasher, chunk_create(buffer, bytes_read), NULL);
-		}
-		else
-		{
-			hasher->get_hash(hasher, chunk_empty, hash);
-			break;
-		}
-	}
-	fclose(file);
-
-	return TRUE;
-}
-
-/**
- * Get the relative filename of a fully qualified file pathname
- */
-static char* get_filename(char *pathname)
-{
-	char *pos, *filename;
-
-	pos = filename = pathname;
-	while (pos && *(++pos) != '\0')
-	{
-		filename = pos;
-		pos = strchr(filename, '/');
-	}
-	return filename;
-}
-
 METHOD(pts_t, is_path_valid, bool,
 	private_pts_t *this, char *path, pts_error_code_t *error_code)
 {
@@ -565,82 +491,6 @@ METHOD(pts_t, is_path_valid, bool,
 	return TRUE;
 }
 
-METHOD(pts_t, do_measurements, pts_file_meas_t*,
-	private_pts_t *this, u_int16_t request_id, char *pathname, bool is_directory)
-{
-	hasher_t *hasher;
-	hash_algorithm_t hash_alg;
-	u_char hash[HASH_SIZE_SHA384];
-	chunk_t measurement;
-	pts_file_meas_t *measurements;
-
-	/* Create a hasher */
-	hash_alg = pts_meas_algo_to_hash(this->algorithm);
-	hasher = lib->crypto->create_hasher(lib->crypto, hash_alg);
-	if (!hasher)
-	{
-		DBG1(DBG_PTS, "hasher %N not available", hash_algorithm_names, hash_alg);
-		return NULL;
-	}
-
-	/* Create a measurement object */
-	measurements = pts_file_meas_create(request_id);
-
-	/* Link the hash to the measurement and set the measurement length */
-	measurement = chunk_create(hash, hasher->get_hash_size(hasher));
-
-	if (is_directory)
-	{
-		enumerator_t *enumerator;
-		char *rel_name, *abs_name;
-		struct stat st;
-
-		enumerator = enumerator_create_directory(pathname);
-		if (!enumerator)
-		{
-			DBG1(DBG_PTS,"  directory '%s' can not be opened, %s", pathname,
-				 strerror(errno));
-			hasher->destroy(hasher);
-			measurements->destroy(measurements);
-			return NULL;
-		}
-		while (enumerator->enumerate(enumerator, &rel_name, &abs_name, &st))
-		{
-			/* measure regular files only */
-			if (S_ISREG(st.st_mode) && *rel_name != '.')
-			{
-				if (!hash_file(this, hasher, abs_name, hash))
-				{
-					enumerator->destroy(enumerator);
-					hasher->destroy(hasher);
-					measurements->destroy(measurements);
-					return NULL;
-				}
-				DBG2(DBG_PTS, "  %#B for '%s'", &measurement, rel_name);
-				measurements->add(measurements, rel_name, measurement);
-			}
-		}
-		enumerator->destroy(enumerator);
-	}
-	else
-	{
-		char *filename;
-
-		if (!hash_file(this, hasher, pathname, hash))
-		{
-			hasher->destroy(hasher);
-			measurements->destroy(measurements);
-			return NULL;
-		}
-		filename = get_filename(pathname);
-		DBG2(DBG_PTS, "  %#B for '%s'", &measurement, filename);
-		measurements->add(measurements, filename, measurement);
-	}
-	hasher->destroy(hasher);
-
-	return measurements;
-}
-
 /**
  * Obtain statistical information describing a file
  */
@@ -654,6 +504,7 @@ static bool file_metadata(char *pathname, pts_file_metadata_t **entry)
 	if (stat(pathname, &st))
 	{
 		DBG1(DBG_PTS, "unable to obtain statistics about '%s'", pathname);
+		free(this);
 		return FALSE;
 	}
 
@@ -748,7 +599,7 @@ METHOD(pts_t, get_metadata, pts_file_meta_t*,
 			metadata->destroy(metadata);
 			return NULL;
 		}
-		entry->filename = strdup(get_filename(pathname));
+		entry->filename = strdup(basename(pathname));
 		metadata->add(metadata, entry);
 	}
 
@@ -809,7 +660,7 @@ METHOD(pts_t, extend_pcr, bool,
 	TSS_HTPM hTPM;
 	TSS_RESULT result;
 	u_int32_t pcr_length;
-	chunk_t pcr_value;
+	chunk_t pcr_value = chunk_empty;
 
 	result = Tspi_Context_Create(&hContext);
 	if (result != TSS_SUCCESS)
@@ -829,8 +680,8 @@ METHOD(pts_t, extend_pcr, bool,
 		goto err;
 	}
 
-	pcr_value = chunk_alloc(PCR_LEN);
-	result = Tspi_TPM_PcrExtend(hTPM, pcr_num, PCR_LEN, input.ptr,
+	pcr_value = chunk_alloc(PTS_PCR_LEN);
+	result = Tspi_TPM_PcrExtend(hTPM, pcr_num, PTS_PCR_LEN, input.ptr,
 								NULL, &pcr_length, &pcr_value.ptr);
 	if (result != TSS_SUCCESS)
 	{
@@ -842,7 +693,7 @@ METHOD(pts_t, extend_pcr, bool,
 
 	DBG3(DBG_PTS, "PCR %d extended with:      %B", pcr_num, &input);
 	DBG3(DBG_PTS, "PCR %d value after extend: %B", pcr_num, output);
-	
+
 	chunk_clear(&pcr_value);
 	Tspi_Context_FreeMemory(hContext, NULL);
 	Tspi_Context_Close(hContext);
@@ -851,28 +702,12 @@ METHOD(pts_t, extend_pcr, bool,
 
 err:
 	DBG1(DBG_PTS, "TPM not available: tss error 0x%x", result);
-	
+
 	chunk_clear(&pcr_value);
 	Tspi_Context_FreeMemory(hContext, NULL);
 	Tspi_Context_Close(hContext);
-	
-	return FALSE;
-}
-
-
-static void clear_pcrs(private_pts_t *this)
-{
-	int i;
 
-	for (i = 0; i <= this->pcr_max; i++)
-	{
-		free(this->pcrs[i]);
-		this->pcrs[i] = NULL;
-	}
-	this->pcr_count = 0;
-	this->pcr_max = 0;
-
-	memset(this->pcr_select, 0x00, sizeof(this->pcr_select));
+	return FALSE;
 }
 
 METHOD(pts_t, quote_tpm, bool,
@@ -890,7 +725,8 @@ METHOD(pts_t, quote_tpm, bool,
 	TSS_RESULT result;
 	chunk_t quote_info;
 	BYTE* versionInfo;
-	u_int32_t versionInfoSize, pcr, i = 0, f = 1;
+	u_int32_t versionInfoSize, pcr;
+	enumerator_t *enumerator;
 	bool success = FALSE;
 
 	result = Tspi_Context_Create(&hContext);
@@ -943,32 +779,30 @@ METHOD(pts_t, quote_tpm, bool,
 			Tspi_Context_CreateObject(hContext, TSS_OBJECT_TYPE_PCRS,
 							TSS_PCRS_STRUCT_INFO_SHORT, &hPcrComposite) :
 			Tspi_Context_CreateObject(hContext, TSS_OBJECT_TYPE_PCRS,
-							0, &hPcrComposite);
+							TSS_PCRS_STRUCT_DEFAULT, &hPcrComposite);
 	if (result != TSS_SUCCESS)
 	{
 		goto err2;
 	}
 
 	/* Select PCRs */
-	for (pcr = 0; pcr <= this->pcr_max ; pcr++)
-	{
-		if (f == 256)
+	enumerator = this->pcrs->create_enumerator(this->pcrs);
+	while (enumerator->enumerate(enumerator, &pcr))
+	{
+		result = use_quote2 ?
+				Tspi_PcrComposite_SelectPcrIndexEx(hPcrComposite, pcr,
+											TSS_PCRS_DIRECTION_RELEASE) :
+				Tspi_PcrComposite_SelectPcrIndex(hPcrComposite, pcr);
+		if (result != TSS_SUCCESS)
 		{
-			i++;
-			f = 1;
-		}		
-		if (this->pcr_select[i] & f)
-		{
-			result = use_quote2 ?
-					Tspi_PcrComposite_SelectPcrIndexEx(hPcrComposite, pcr,
-												TSS_PCRS_DIRECTION_RELEASE) :
-					Tspi_PcrComposite_SelectPcrIndex(hPcrComposite, pcr);
-			if (result != TSS_SUCCESS)
-			{
-				goto err3;
-			}
+			break;
 		}
-		f <<= 1;
+	}
+	enumerator->destroy(enumerator);
+
+	if (result != TSS_SUCCESS)
+	{
+		goto err3;
 	}
 
 	/* Set the Validation Data */
@@ -1028,87 +862,14 @@ err1:
 	{
 		DBG1(DBG_PTS, "TPM not available: tss error 0x%x", result);
 	}
-	clear_pcrs(this);
 
 	return success;
 }
 
-METHOD(pts_t, select_pcr, bool,
-	private_pts_t *this, u_int32_t pcr)
-{
-	u_int32_t i, f;
-
-	if (pcr >= PCR_MAX_NUM)
-	{
-		DBG1(DBG_PTS, "PCR %u: number is larger than maximum of %u",
-					   pcr, PCR_MAX_NUM-1);
-		return FALSE;
-	}
-
-	/* Determine PCR selection flag */
-	i = pcr / 8;
-	f = 1 << (pcr - 8*i);
-
-	/* Has this PCR already been selected? */
-	if (!(this->pcr_select[i] & f))
-	{
-		this->pcr_select[i] |= f;
-		this->pcr_max = max(this->pcr_max, pcr);
-		this->pcr_count++;
-	}
-
-	return TRUE;
-}
-
-METHOD(pts_t, add_pcr, bool,
-	private_pts_t *this, u_int32_t pcr, chunk_t pcr_before, chunk_t pcr_after)
+METHOD(pts_t, get_pcrs, pts_pcr_t*,
+	private_pts_t *this)
 {
-	if (pcr >= PCR_MAX_NUM)
-	{
-		DBG1(DBG_PTS, "PCR %u: number is larger than maximum of %u",
-					   pcr, PCR_MAX_NUM-1);
-		return FALSE;
-	}
-
-	/* Is the length of the PCR registers already set? */
-	if (this->pcr_len)
-	{
-		if (pcr_after.len != this->pcr_len)
-		{
-			DBG1(DBG_PTS, "PCR %02u: length is %d bytes but should be %d bytes",
-						   pcr_after.len, this->pcr_len);
-			return FALSE;
-		}
-	}
-	else
-	{
-		this->pcr_len = pcr_after.len;
-	}
-
-	/* Has the value of the PCR register already been assigned? */
-	if (this->pcrs[pcr])
-	{
-		if (!memeq(this->pcrs[pcr], pcr_before.ptr, this->pcr_len))
-		{
-			DBG1(DBG_PTS, "PCR %02u: new pcr_before value does not equal "
-						  "old pcr_after value");
-		}
-		/* remove the old PCR value */
-		free(this->pcrs[pcr]);
-	}
-	else
-	{
-		/* add extended PCR Register */
-		this->pcr_select[pcr / 8] |= 1 << (pcr % 8);
-		this->pcr_max = max(this->pcr_max, pcr);
-		this->pcr_count++;
-	}
-
-	/* Duplicate and store current PCR value */
-	pcr_after = chunk_clone(pcr_after);
-	this->pcrs[pcr] = pcr_after.ptr;
-
-	return TRUE;
+	return this->pcrs;
 }
 
 /**
@@ -1130,13 +891,11 @@ METHOD(pts_t, get_quote_info, bool,
 	pts_meas_algorithms_t comp_hash_algo,
 	chunk_t *out_pcr_comp, chunk_t *out_quote_info)
 {
-	u_int8_t size_of_select;
-	int pcr_comp_len, i;
-	chunk_t pcr_comp, hash_pcr_comp;
+	chunk_t selection, pcr_comp, hash_pcr_comp;
 	bio_writer_t *writer;
 	hasher_t *hasher;
 
-	if (this->pcr_count == 0)
+	if (!this->pcrs->get_count(this->pcrs))
 	{
 		DBG1(DBG_PTS, "No extended PCR entries available, "
 					  "unable to construct TPM Quote Info");
@@ -1154,34 +913,9 @@ METHOD(pts_t, get_quote_info, bool,
 					  "unable to construct TPM Quote Info2");
 		return FALSE;
 	}
-	
-	/**
-	 * A TPM v1.2 has 24 PCR Registers
-	 * so the bitmask field length used by TrouSerS is at least 3 bytes
-	 */
-	size_of_select = max(PCR_MAX_NUM / 8, 1 + this->pcr_max / 8);
-	pcr_comp_len = 2 + size_of_select + 4 + this->pcr_count * this->pcr_len;
-	
-	writer = bio_writer_create(pcr_comp_len);
-
-	writer->write_uint16(writer, size_of_select);
-	for (i = 0; i < size_of_select; i++)
-	{
-		writer->write_uint8(writer, this->pcr_select[i]);
-	}
 
-	writer->write_uint32(writer, this->pcr_count * this->pcr_len);
-	for (i = 0; i < 8 * size_of_select; i++)
-	{
-		if (this->pcrs[i])
-		{
-			writer->write_data(writer, chunk_create(this->pcrs[i], this->pcr_len));
-		}
-	}
-	pcr_comp = chunk_clone(writer->get_buf(writer));
-	DBG3(DBG_PTS, "constructed PCR Composite: %B", &pcr_comp);
+	pcr_comp = this->pcrs->get_composite(this->pcrs);
 
-	writer->destroy(writer);
 
 	/* Output the TPM_PCR_COMPOSITE expected from IMC */
 	if (comp_hash_algo)
@@ -1192,7 +926,12 @@ METHOD(pts_t, get_quote_info, bool,
 		hasher = lib->crypto->create_hasher(lib->crypto, algo);
 
 		/* Hash the PCR Composite Structure */
-		hasher->allocate_hash(hasher, pcr_comp, out_pcr_comp);
+		if (!hasher || !hasher->allocate_hash(hasher, pcr_comp, out_pcr_comp))
+		{
+			DESTROY_IF(hasher);
+			free(pcr_comp.ptr);
+			return FALSE;
+		}
 		DBG3(DBG_PTS, "constructed PCR Composite hash: %#B", out_pcr_comp);
 		hasher->destroy(hasher);
 	}
@@ -1203,7 +942,13 @@ METHOD(pts_t, get_quote_info, bool,
 
 	/* SHA1 hash of PCR Composite to construct TPM_QUOTE_INFO */
 	hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
-	hasher->allocate_hash(hasher, pcr_comp, &hash_pcr_comp);
+	if (!hasher || !hasher->allocate_hash(hasher, pcr_comp, &hash_pcr_comp))
+	{
+		DESTROY_IF(hasher);
+		chunk_free(out_pcr_comp);
+		free(pcr_comp.ptr);
+		return FALSE;
+	}
 	hasher->destroy(hasher);
 
 	/* Construct TPM_QUOTE_INFO/TPM_QUOTE_INFO2 structure */
@@ -1220,15 +965,11 @@ METHOD(pts_t, get_quote_info, bool,
 		/* Secret assessment value 20 bytes (nonce) */
 		writer->write_data(writer, this->secret);
 
-		/* Length of the PCR selection field */
-		writer->write_uint16(writer, size_of_select);
-
 		/* PCR selection */
-		for (i = 0; i < size_of_select ; i++)
-		{
-			writer->write_uint8(writer, this->pcr_select[i]);
-		}
-		
+		selection.ptr = pcr_comp.ptr;
+		selection.len = 2 + this->pcrs->get_selection_size(this->pcrs);
+		writer->write_data(writer, selection);
+
 		/* TPM Locality Selection */
 		writer->write_uint8(writer, TPM_LOC_ZERO);
 
@@ -1263,7 +1004,6 @@ METHOD(pts_t, get_quote_info, bool,
 	writer->destroy(writer);
 	free(pcr_comp.ptr);
 	free(hash_pcr_comp.ptr);
-	clear_pcrs(this);
 
 	return TRUE;
 }
@@ -1295,7 +1035,7 @@ METHOD(pts_t, verify_quote_signature, bool,
 METHOD(pts_t, destroy, void,
 	private_pts_t *this)
 {
-	clear_pcrs(this);
+	DESTROY_IF(this->pcrs);
 	DESTROY_IF(this->aik);
 	DESTROY_IF(this->dh);
 	free(this->initiator_nonce.ptr);
@@ -1357,7 +1097,7 @@ static char* extract_platform_info(void)
 		{
 			strcpy(buf, str_debian);
 			pos += strlen(str_debian);
-			len -= strlen(str_debian); 
+			len -= strlen(str_debian);
 		}
 
 		fseek(file, 0, SEEK_END);
@@ -1477,6 +1217,14 @@ static bool has_tpm(private_pts_t *this)
 pts_t *pts_create(bool is_imc)
 {
 	private_pts_t *this;
+	pts_pcr_t *pcrs;
+
+	pcrs = pts_pcr_create();
+	if (!pcrs)
+	{
+		DBG1(DBG_PTS, "shadow PCR set could not be created");
+		return NULL;
+	}
 
 	INIT(this,
 		.public = {
@@ -1494,19 +1242,15 @@ pts_t *pts_create(bool is_imc)
 			.set_platform_info = _set_platform_info,
 			.get_tpm_version_info = _get_tpm_version_info,
 			.set_tpm_version_info = _set_tpm_version_info,
-			.get_pcr_len = _get_pcr_len,
 			.get_aik = _get_aik,
 			.set_aik = _set_aik,
 			.get_aik_keyid = _get_aik_keyid,
 			.is_path_valid = _is_path_valid,
-			.hash_file = _hash_file,
-			.do_measurements = _do_measurements,
 			.get_metadata = _get_metadata,
 			.read_pcr = _read_pcr,
 			.extend_pcr = _extend_pcr,
 			.quote_tpm = _quote_tpm,
-			.select_pcr = _select_pcr,
-			.add_pcr = _add_pcr,
+			.get_pcrs = _get_pcrs,
 			.get_quote_info = _get_quote_info,
 			.verify_quote_signature  = _verify_quote_signature,
 			.destroy = _destroy,
@@ -1515,6 +1259,7 @@ pts_t *pts_create(bool is_imc)
 		.proto_caps = PTS_PROTO_CAPS_V,
 		.algorithm = PTS_MEAS_ALGO_SHA256,
 		.dh_hash_algorithm = PTS_MEAS_ALGO_SHA256,
+		.pcrs = pcrs,
 	);
 
 	if (is_imc)
@@ -1524,7 +1269,6 @@ pts_t *pts_create(bool is_imc)
 		if (has_tpm(this))
 		{
 			this->has_tpm = TRUE;
-			this->pcr_len = PCR_LEN;
 			this->proto_caps |= PTS_PROTO_CAPS_T | PTS_PROTO_CAPS_D;
 			load_aik(this);
 			load_aik_blob(this);
diff --git a/src/libpts/pts/pts.h b/src/libpts/pts/pts.h
index 212acb02a..5f88cd15c 100644
--- a/src/libpts/pts/pts.h
+++ b/src/libpts/pts/pts.h
@@ -29,6 +29,7 @@ typedef struct pts_t pts_t;
 #include "pts_file_meas.h"
 #include "pts_file_meta.h"
 #include "pts_dh_group.h"
+#include "pts_pcr.h"
 #include "pts_req_func_comp_evid.h"
 #include "pts_simple_evid_final.h"
 #include "components/pts_comp_func_name.h"
@@ -190,13 +191,6 @@ struct pts_t {
 	void (*set_tpm_version_info)(pts_t *this, chunk_t info);
 
 	/**
-	 * Get the length of the TPM PCR registers
-	 *
-	 * @return					Length of PCR registers in bytes, 0 if undefined
-	 */
-	size_t (*get_pcr_len)(pts_t *this);
-
-	/**
 	 * Get Attestation Identity Certificate or Public Key
 	 *
 	 * @return					AIK Certificate or Public Key
@@ -230,34 +224,13 @@ struct pts_t {
 	bool (*is_path_valid)(pts_t *this, char *path, pts_error_code_t *error_code);
 
 	/**
-	* Compute a hash over a file
-	 * @param hasher			Hasher to be used
-	 * @param pathname			Absolute path of a file
-	 * @param hash				Buffer to keep hash output
-	 * @return					TRUE if path is valid and hashing succeeded
-	 */
-	bool (*hash_file)(pts_t *this, hasher_t *hasher, char *pathname, u_char *hash);
-
-	/**
-	 * Do PTS File Measurements
-	 *
-	 * @param request_id		ID of PTS File Measurement Request
-	 * @param pathname			Absolute pathname of file to be measured
-	 * @param is_directory		TRUE if directory contents are measured
-	 * @return					PTS File Measurements of NULL if FAILED
-	 */
-	pts_file_meas_t* (*do_measurements)(pts_t *this, u_int16_t request_id,
-										char *pathname, bool is_directory);
-
-	/**
 	 * Obtain file metadata
 	 *
 	 * @param pathname			Absolute pathname of file/directory
-	 * @param is_directory		TRUE if directory contents are requested
+	 * @param is_dir			TRUE if directory contents are requested
 	 * @return					PTS File Metadata or NULL if FAILED
 	 */
-	pts_file_meta_t* (*get_metadata)(pts_t *this, char *pathname,
-									 bool is_directory);
+	pts_file_meta_t* (*get_metadata)(pts_t *this, char *pathname, bool is_dir);
 
 	/**
 	 * Reads given PCR value and returns it
@@ -294,24 +267,12 @@ struct pts_t {
 	 bool (*quote_tpm)(pts_t *this, bool use_quote2, chunk_t *pcr_comp,
 													 chunk_t *quote_sig);
 
-	 /**
-	 * Mark an extended PCR as selected
-	 *
-	 * @param pcr				Number of the extended PCR
-	 * @return					TRUE if PCR number is valid
-	 */
-	 bool (*select_pcr)(pts_t *this, u_int32_t pcr);
-
-	 /**
-	 * Add an extended PCR with its corresponding value
+	/**
+	 * Get the shadow PCR set
 	 *
-	 * @param pcr				Number of the extended PCR
-	 * @param pcr_before		PCR value before extension
-	 * @param pcr_after			PCR value after extension
-	 * @return					TRUE if PCR number and register length is valid
+	 * @return					shadow PCR set
 	 */
-	bool (*add_pcr)(pts_t *this, u_int32_t pcr, chunk_t pcr_before,
-												chunk_t pcr_after);
+	pts_pcr_t* (*get_pcrs)(pts_t *this);
 
 	 /**
 	 * Constructs and returns TPM Quote Info structure expected from IMC
diff --git a/src/libpts/pts/pts_database.c b/src/libpts/pts/pts_database.c
index 282755c0a..946f37e1e 100644
--- a/src/libpts/pts/pts_database.c
+++ b/src/libpts/pts/pts_database.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -121,6 +121,42 @@ METHOD(pts_database_t, check_aik_keyid, status_t,
 	return SUCCESS;
 }
 
+METHOD(pts_database_t, check_file_measurement, status_t,
+	private_pts_database_t *this, char *product, pts_meas_algorithms_t algo,
+	chunk_t measurement, char *filename)
+{
+	enumerator_t *e;
+	chunk_t hash;
+	status_t status = NOT_FOUND;
+
+	e = this->db->query(this->db,
+		"SELECT fh.hash FROM file_hashes AS fh "
+		"JOIN files AS f ON f.id = fh.file "
+		"JOIN products AS p ON p.id = fh.product "
+		"WHERE p.name = ? AND f.path = ? AND fh.algo = ?",
+		DB_TEXT, product, DB_TEXT, filename, DB_INT, algo, DB_BLOB);
+	if (!e)
+	{
+		return FAILED;
+	}
+	while (e->enumerate(e, &hash))
+	{
+		/* with relative filenames there might be multiple entries */
+		if (chunk_equals(measurement, hash))
+		{
+			status = SUCCESS;
+			break;
+		}
+		else
+		{
+			status = VERIFY_ERROR;
+		}
+	}	
+	e->destroy(e);
+
+	return status;
+}
+
 METHOD(pts_database_t, create_comp_evid_enumerator, enumerator_t*,
 	private_pts_database_t *this, int kid)
 {
@@ -169,7 +205,7 @@ METHOD(pts_database_t, check_comp_measurement, status_t,
 						  "found in database", pcr, seq_no);
 			DBG1(DBG_PTS, "  expected: %#B", &hash);
 			DBG1(DBG_PTS, "  received: %#B", &measurement);
-			status = FAILED;
+			status = VERIFY_ERROR;
 			break;
 		}
 	}
@@ -290,6 +326,7 @@ pts_database_t *pts_database_create(char *uri)
 			.create_comp_evid_enumerator = _create_comp_evid_enumerator,
 			.create_file_hash_enumerator = _create_file_hash_enumerator,
 			.check_aik_keyid = _check_aik_keyid,
+			.check_file_measurement = _check_file_measurement,
 			.check_comp_measurement = _check_comp_measurement,
 			.insert_comp_measurement = _insert_comp_measurement,
 			.delete_comp_measurements = _delete_comp_measurements,
diff --git a/src/libpts/pts/pts_database.h b/src/libpts/pts/pts_database.h
index a9a68ac76..649ef0e31 100644
--- a/src/libpts/pts/pts_database.h
+++ b/src/libpts/pts/pts_database.h
@@ -82,6 +82,19 @@ struct pts_database_t {
 	enumerator_t* (*create_comp_evid_enumerator)(pts_database_t *this, int kid);
 
 	/**
+	* Check PTS file measurement against reference stored in database
+	*
+	* @param product		Software product (os, vpn client, etc.)
+	* @param algo			File measurement hash algorithm used
+	* @param measurement	File measurement hash
+	* @param filename		Optional name of the file to be checked
+	* @return				Status
+	*/
+	status_t (*check_file_measurement)(pts_database_t *this, char *product,
+									   pts_meas_algorithms_t algo,
+									   chunk_t measurement, char *filename);
+
+	/**
 	* Check a functional component measurement against value stored in database
 	*
 	* @param measurement	measurement hash
diff --git a/src/libpts/pts/pts_error.c b/src/libpts/pts/pts_error.c
index 6e914b2a9..1e79689f9 100644
--- a/src/libpts/pts/pts_error.c
+++ b/src/libpts/pts/pts_error.c
@@ -46,13 +46,13 @@ pa_tnc_attr_t* pts_hash_alg_error_create(pts_meas_algorithms_t algorithms)
 	bio_writer_t *writer;
 	chunk_t msg_info;
 	pa_tnc_attr_t *attr;
+	pen_type_t error_code = { PEN_TCG, TCG_PTS_HASH_ALG_NOT_SUPPORTED };
 
 	writer = bio_writer_create(4);
 	writer->write_uint16(writer, 0x0000);
 	writer->write_uint16(writer, algorithms);
 	msg_info = writer->get_buf(writer);
-	attr = ietf_attr_pa_tnc_error_create(PEN_TCG, TCG_PTS_HASH_ALG_NOT_SUPPORTED,
-										 msg_info);
+	attr = ietf_attr_pa_tnc_error_create(error_code, msg_info);
 	writer->destroy(writer);
 
 	return attr;
@@ -66,13 +66,13 @@ pa_tnc_attr_t* pts_dh_group_error_create(pts_dh_group_t dh_groups)
 	bio_writer_t *writer;
 	chunk_t msg_info;
 	pa_tnc_attr_t *attr;
+	pen_type_t error_code = { PEN_TCG, TCG_PTS_DH_GRPS_NOT_SUPPORTED };
 
 	writer = bio_writer_create(4);
 	writer->write_uint16(writer, 0x0000);
 	writer->write_uint16(writer, dh_groups);
 	msg_info = writer->get_buf(writer);
-	attr = ietf_attr_pa_tnc_error_create(PEN_TCG, TCG_PTS_DH_GRPS_NOT_SUPPORTED,
-										 msg_info);
+	attr = ietf_attr_pa_tnc_error_create(error_code, msg_info);
 	writer->destroy(writer);
 
 	return attr;
@@ -86,13 +86,13 @@ pa_tnc_attr_t* pts_dh_nonce_error_create(int min_nonce_len, int max_nonce_len)
 	bio_writer_t *writer;
 	chunk_t msg_info;
 	pa_tnc_attr_t *attr;
+	pen_type_t error_code = { PEN_TCG, TCG_PTS_BAD_NONCE_LENGTH };
 
 	writer = bio_writer_create(4);
 	writer->write_uint16(writer, min_nonce_len);
 	writer->write_uint16(writer, max_nonce_len);
 	msg_info = writer->get_buf(writer);
-	attr = ietf_attr_pa_tnc_error_create(PEN_TCG, TCG_PTS_BAD_NONCE_LENGTH,
-										 msg_info);
+	attr = ietf_attr_pa_tnc_error_create(error_code, msg_info);
 	writer->destroy(writer);
 
 	return attr;
diff --git a/src/libpts/pts/pts_file_meas.c b/src/libpts/pts/pts_file_meas.c
index f0e0d4c0a..4fece6b3c 100644
--- a/src/libpts/pts/pts_file_meas.c
+++ b/src/libpts/pts/pts_file_meas.c
@@ -18,6 +18,10 @@
 #include <utils/linked_list.h>
 #include <debug.h>
 
+#include <sys/stat.h>
+#include <libgen.h>
+#include <errno.h>
+
 typedef struct private_pts_file_meas_t private_pts_file_meas_t;
 
 /**
@@ -107,6 +111,51 @@ METHOD(pts_file_meas_t, create_enumerator, enumerator_t*,
 								   (void*)entry_filter, NULL, NULL);
 }
 
+METHOD(pts_file_meas_t, check, bool,
+	private_pts_file_meas_t *this, pts_database_t *pts_db, char *product,
+	pts_meas_algorithms_t algo)
+{
+	enumerator_t *enumerator;
+	entry_t *entry;
+	int count_ok = 0, count_not_found = 0, count_differ = 0;
+	status_t status;
+
+	enumerator = this->list->create_enumerator(this->list);
+	while (enumerator->enumerate(enumerator, &entry))
+	{
+		status = pts_db->check_file_measurement(pts_db, product, algo,
+									entry->measurement, entry->filename);
+		switch (status)
+		{
+			case SUCCESS:
+				DBG3(DBG_PTS, "  %#B for '%s' is ok", &entry->measurement,
+													   entry->filename);
+				count_ok++;
+				break;
+			case NOT_FOUND:
+				DBG2(DBG_PTS, "  %#B for '%s' not found", &entry->measurement,
+														   entry->filename);
+				count_not_found++;
+				break;
+			case VERIFY_ERROR:
+				DBG1(DBG_PTS, "  %#B for '%s' differs", &entry->measurement,
+														 entry->filename);
+				count_differ++;
+				break;
+			case FAILED:
+			default:
+				DBG1(DBG_PTS, "  %#B for '%s' failed", &entry->measurement,
+														entry->filename);
+		}
+	}
+	enumerator->destroy(enumerator);
+
+	DBG1(DBG_PTS, "%d measurements, %d ok, %d not found, %d differ",
+		 this->list->get_count(this->list),
+		 count_ok, count_not_found, count_differ);
+	return TRUE;
+}
+
 METHOD(pts_file_meas_t, verify, bool,
 	private_pts_file_meas_t *this, enumerator_t *e_hash, bool is_dir)
 {
@@ -174,6 +223,7 @@ pts_file_meas_t *pts_file_meas_create(u_int16_t request_id)
 			.get_file_count = _get_file_count,
 			.add = _add,
 			.create_enumerator = _create_enumerator,
+			.check = _check,
 			.verify = _verify,
 			.destroy = _destroy,
 		},
@@ -184,3 +234,141 @@ pts_file_meas_t *pts_file_meas_create(u_int16_t request_id)
 	return &this->public;
 }
 
+/**
+ * Hash a file with a given absolute pathname
+ */
+static bool hash_file(hasher_t *hasher, char *pathname, u_char *hash)
+{
+	u_char buffer[4096];
+	size_t bytes_read;
+	bool success = TRUE;
+	FILE *file;
+
+	file = fopen(pathname, "rb");
+	if (!file)
+	{
+		DBG1(DBG_PTS,"  file '%s' can not be opened, %s", pathname,
+			 strerror(errno));
+		return FALSE;
+	}
+	while (TRUE)
+	{
+		bytes_read = fread(buffer, 1, sizeof(buffer), file);
+		if (bytes_read > 0)
+		{
+			if (!hasher->get_hash(hasher, chunk_create(buffer, bytes_read), NULL))
+			{
+				DBG1(DBG_PTS, "  hasher increment error");
+				success = FALSE;
+				break;
+			}
+		}
+		else
+		{
+			if (!hasher->get_hash(hasher, chunk_empty, hash))
+			{
+				DBG1(DBG_PTS, "  hasher finalize error");
+				success = FALSE;
+			}
+			break;
+		}
+	}
+	fclose(file);
+
+	return success;
+}
+
+/**
+ * See header
+ */
+pts_file_meas_t *pts_file_meas_create_from_path(u_int16_t request_id,
+							char *pathname, bool is_dir, bool use_rel_name,
+							pts_meas_algorithms_t alg)
+{
+	private_pts_file_meas_t *this;
+	hash_algorithm_t hash_alg;
+	hasher_t *hasher;
+	u_char hash[HASH_SIZE_SHA384];
+	chunk_t measurement;
+	char* filename;
+	bool success = TRUE;
+
+	/* Create a hasher and a hash measurement buffer */
+	hash_alg = pts_meas_algo_to_hash(alg);
+	hasher = lib->crypto->create_hasher(lib->crypto, hash_alg);
+	if (!hasher)
+	{
+		DBG1(DBG_PTS, "hasher %N not available", hash_algorithm_names, hash_alg);
+		return NULL;
+	}
+	measurement = chunk_create(hash, hasher->get_hash_size(hasher));
+
+	INIT(this,
+		.public = {
+			.get_request_id = _get_request_id,
+			.get_file_count = _get_file_count,
+			.add = _add,
+			.create_enumerator = _create_enumerator,
+			.check = _check,
+			.verify = _verify,
+			.destroy = _destroy,
+		},
+		.request_id = request_id,
+		.list = linked_list_create(),
+	);
+
+	if (is_dir)
+	{
+		enumerator_t *enumerator;
+		char *rel_name, *abs_name;
+		struct stat st;
+
+		enumerator = enumerator_create_directory(pathname);
+		if (!enumerator)
+		{
+			DBG1(DBG_PTS, "  directory '%s' can not be opened, %s", pathname,
+				 strerror(errno));
+			success = FALSE;
+			goto end;
+		}
+		while (enumerator->enumerate(enumerator, &rel_name, &abs_name, &st))
+		{
+			/* measure regular files only */
+			if (S_ISREG(st.st_mode) && *rel_name != '.')
+			{
+				if (!hash_file(hasher, abs_name, hash))
+				{
+					success = FALSE;
+					break;
+				}
+				filename = use_rel_name ? rel_name : abs_name;
+				DBG2(DBG_PTS, "  %#B for '%s'", &measurement, filename);
+				add(this, filename, measurement);
+			}
+		}
+		enumerator->destroy(enumerator);
+	}
+	else
+	{
+		if (!hash_file(hasher, pathname, hash))
+		{
+			success = FALSE;
+			goto end;
+		}
+		filename = use_rel_name ? basename(pathname) : pathname;
+		DBG2(DBG_PTS, "  %#B for '%s'", &measurement, filename);
+		add(this, filename, measurement);
+	}
+
+end:
+	hasher->destroy(hasher);
+	if (success)
+	{
+		return &this->public;
+	}
+	else
+	{
+		destroy(this);
+		return NULL;
+	}
+}
diff --git a/src/libpts/pts/pts_file_meas.h b/src/libpts/pts/pts_file_meas.h
index 3ebb5c2a0..71efd5026 100644
--- a/src/libpts/pts/pts_file_meas.h
+++ b/src/libpts/pts/pts_file_meas.h
@@ -21,6 +21,8 @@
 #ifndef PTS_FILE_MEAS_H_
 #define PTS_FILE_MEAS_H_
 
+#include "pts/pts_database.h"
+
 #include <library.h>
 
 typedef struct pts_file_meas_t pts_file_meas_t;
@@ -60,6 +62,17 @@ struct pts_file_meas_t {
 	enumerator_t* (*create_enumerator)(pts_file_meas_t *this);
 
 	/**
+	 * Check PTS File Measurements against reference value in the database
+	 *
+	 * @param db			PTS Measurement database
+	 * @param product		Software product (os, vpn client, etc.)
+	 * @param algo			PTS Measurement algorithm used
+	 * @return				TRUE if all measurements agreed
+	 */
+	bool (*check)(pts_file_meas_t *this, pts_database_t *db, char* product,
+				  pts_meas_algorithms_t algo);
+
+	/**
 	 * Verify stored hashes against PTS File Measurements
 	 *
 	 * @param e_hash		Hash enumerator
@@ -82,4 +95,17 @@ struct pts_file_meas_t {
  */
 pts_file_meas_t* pts_file_meas_create(u_int16_t request_id);
 
+/**
+ * Creates a pts_file_meas_t object measuring a file/directory
+ *
+ * @param request_id		ID of PTS File Measurement Request
+ * @param pathname			Absolute file or directory pathname
+ * @param is_dir			TRUE if directory path
+ * @param use_rel_name		TRUE if relative filenames are to be used
+ * @param alg				PTS hash measurement algorithm to be used
+ */
+pts_file_meas_t* pts_file_meas_create_from_path(u_int16_t request_id,
+							char* pathname, bool is_dir, bool use_rel_name,
+							pts_meas_algorithms_t alg);
+
 #endif /** PTS_FILE_MEAS_H_ @}*/
diff --git a/src/libpts/pts/pts_meas_algo.c b/src/libpts/pts/pts_meas_algo.c
index 865857d3c..fbc9c6959 100644
--- a/src/libpts/pts/pts_meas_algo.c
+++ b/src/libpts/pts/pts_meas_algo.c
@@ -17,12 +17,21 @@
 
 #include <debug.h>
 
-ENUM(pts_meas_algorithm_names, PTS_MEAS_ALGO_NONE, PTS_MEAS_ALGO_SHA384,
-	"None",
-	"SHA1",
-	"SHA256",
-	"SHA384"
-);
+ENUM_BEGIN(pts_meas_algorithm_names, PTS_MEAS_ALGO_NONE, PTS_MEAS_ALGO_NONE,
+	"None");
+ENUM_NEXT(pts_meas_algorithm_names,	PTS_MEAS_ALGO_SHA384, PTS_MEAS_ALGO_SHA384,
+									PTS_MEAS_ALGO_NONE,
+	"SHA384");
+ENUM_NEXT(pts_meas_algorithm_names,	PTS_MEAS_ALGO_SHA256, PTS_MEAS_ALGO_SHA256,
+									PTS_MEAS_ALGO_SHA384,
+	"SHA256");
+ENUM_NEXT(pts_meas_algorithm_names,	PTS_MEAS_ALGO_SHA1, PTS_MEAS_ALGO_SHA1,
+									PTS_MEAS_ALGO_SHA256,
+	"SHA1");
+ENUM_NEXT(pts_meas_algorithm_names,	PTS_MEAS_ALGO_SHA1_IMA, PTS_MEAS_ALGO_SHA1_IMA,
+									PTS_MEAS_ALGO_SHA1,
+	"SHA1-IMA");
+ENUM_END(pts_meas_algorithm_names,  PTS_MEAS_ALGO_SHA1_IMA);
 
 /**
  * Described in header.
diff --git a/src/libpts/pts/pts_meas_algo.h b/src/libpts/pts/pts_meas_algo.h
index 1d96a4946..27cdaea7e 100644
--- a/src/libpts/pts/pts_meas_algo.h
+++ b/src/libpts/pts/pts_meas_algo.h
@@ -30,10 +30,11 @@ typedef enum pts_meas_algorithms_t pts_meas_algorithms_t;
  * PTS Measurement Algorithms
  */
 enum pts_meas_algorithms_t {
-	PTS_MEAS_ALGO_NONE   =	   0,
-	PTS_MEAS_ALGO_SHA1   =	(1<<15),
-	PTS_MEAS_ALGO_SHA256 =	(1<<14),
-	PTS_MEAS_ALGO_SHA384 =	(1<<13),
+	PTS_MEAS_ALGO_NONE     =      0,
+	PTS_MEAS_ALGO_SHA384   = (1<<13),
+	PTS_MEAS_ALGO_SHA256   = (1<<14),
+	PTS_MEAS_ALGO_SHA1     = (1<<15),
+	PTS_MEAS_ALGO_SHA1_IMA = (1<<16), /* internal use only */
 };
 
 /**
diff --git a/src/libpts/pts/pts_pcr.c b/src/libpts/pts/pts_pcr.c
new file mode 100644
index 000000000..a7a2f5fae
--- /dev/null
+++ b/src/libpts/pts/pts_pcr.c
@@ -0,0 +1,289 @@
+/*
+ * Copyright (C) 2012 Andreas Steffen
+ * HSR Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "pts_pcr.h"
+
+#include <debug.h>
+
+#include <stdarg.h>
+
+typedef struct private_pts_pcr_t private_pts_pcr_t;
+
+/**
+ * Private data of a pts_pcr_t object.
+ *
+ */
+struct private_pts_pcr_t {
+
+	/**
+	 * Public pts_pcr_t interface.
+	 */
+	pts_pcr_t public;
+
+	/**
+	 * Shadow PCR registers
+	 */
+	chunk_t pcrs[PTS_PCR_MAX_NUM];
+
+	/**
+	 * Number of extended PCR registers
+	 */
+	u_int32_t pcr_count;
+
+	/**
+	 * Highest extended PCR register
+	 */
+	u_int32_t pcr_max;
+
+	/**
+	 * Bitmap of extended PCR registers
+	 */
+	u_int8_t pcr_select[PTS_PCR_MAX_NUM / 8];
+
+	/**
+	 * Hasher used to extend shadow PCRs
+	 */
+	hasher_t *hasher;
+
+};
+
+METHOD(pts_pcr_t, get_count, u_int32_t,
+	private_pts_pcr_t *this)
+{
+	return this->pcr_count;
+}
+
+METHOD(pts_pcr_t, select_pcr, bool,
+	private_pts_pcr_t *this, u_int32_t pcr)
+{
+	u_int32_t i, f;
+
+	if (pcr >= PTS_PCR_MAX_NUM)
+	{
+		DBG1(DBG_PTS, "PCR %2u: number is larger than maximum of %u",
+					   pcr, PTS_PCR_MAX_NUM-1);
+		return FALSE;
+	}
+
+	/* Determine PCR selection flag */
+	i = pcr / 8;
+	f = 1 << (pcr - 8*i);
+
+	/* Has this PCR already been selected? */
+	if (!(this->pcr_select[i] & f))
+	{
+		this->pcr_select[i] |= f;
+		this->pcr_max = max(this->pcr_max, pcr);
+		this->pcr_count++;
+	}
+	return TRUE;
+}
+
+METHOD(pts_pcr_t, get_selection_size, size_t,
+	private_pts_pcr_t *this)
+{
+
+	/**
+	 * A TPM v1.2 has 24 PCR Registers so the bitmask field length
+	 * used by TrouSerS is at least 3 bytes
+	 */
+	return PTS_PCR_MAX_NUM / 8;
+}
+
+typedef struct {
+	/** implements enumerator_t */
+	enumerator_t public;
+	/** current PCR */
+	u_int32_t pcr;
+	/** back reference to parent */
+	private_pts_pcr_t *pcrs;
+} pcr_enumerator_t;
+
+/**
+ * Implementation of enumerator.enumerate
+ */
+static bool pcr_enumerator_enumerate(pcr_enumerator_t *this, ...)
+{
+	u_int32_t *pcr, i, f;
+	va_list args;
+
+	va_start(args, this);
+	pcr = va_arg(args, u_int32_t*);
+	va_end(args);
+
+	while (this->pcr <= this->pcrs->pcr_max)
+	{
+		/* Determine PCR selection flag */
+		i = this->pcr / 8;
+		f = 1 << (this->pcr - 8*i);
+
+		/* Assign current PCR to output argument and increase */
+		*pcr = this->pcr++;
+
+		/* return if PCR is selected */
+		if (this->pcrs->pcr_select[i] & f)
+		{
+			return TRUE;
+		}
+	}
+	return FALSE;
+}
+
+METHOD(pts_pcr_t, create_enumerator, enumerator_t*,
+	private_pts_pcr_t *this)
+{
+	pcr_enumerator_t *enumerator;
+
+	INIT(enumerator,
+		.public = {
+			.enumerate = (void*)pcr_enumerator_enumerate,
+			.destroy = (void*)free,
+		},
+		.pcrs = this,
+	);
+
+	return (enumerator_t*)enumerator;
+}
+
+METHOD(pts_pcr_t, get, chunk_t,
+	private_pts_pcr_t *this, u_int32_t pcr)
+{
+	return (pcr < PTS_PCR_MAX_NUM) ? this->pcrs[pcr] : chunk_empty;
+}
+
+METHOD(pts_pcr_t, set, bool,
+	private_pts_pcr_t *this, u_int32_t pcr, chunk_t value)
+{
+	if (value.len != PTS_PCR_LEN)
+	{
+		DBG1(DBG_PTS, "PCR %2u: value does not fit", pcr);
+		return FALSE;
+	}
+	if (select_pcr(this, pcr))
+	{
+		memcpy(this->pcrs[pcr].ptr, value.ptr, PTS_PCR_LEN);
+		return TRUE;
+	}
+	return FALSE;
+}
+
+METHOD(pts_pcr_t, extend, chunk_t,
+	private_pts_pcr_t *this, u_int32_t pcr, chunk_t measurement)
+{
+	if (measurement.len != PTS_PCR_LEN)
+	{
+		DBG1(DBG_PTS, "PCR %2u: measurement does not fit", pcr);
+		return chunk_empty;
+	}
+	if (!select_pcr(this, pcr))
+	{
+		return chunk_empty;
+	}
+	if (!this->hasher->get_hash(this->hasher, this->pcrs[pcr] , NULL) ||
+		!this->hasher->get_hash(this->hasher, measurement, this->pcrs[pcr].ptr))
+	{
+		DBG1(DBG_PTS, "PCR %2u: not extended due to hasher problem", pcr);
+		return chunk_empty;
+	}
+	return this->pcrs[pcr];
+}
+
+METHOD(pts_pcr_t, get_composite, chunk_t,
+	private_pts_pcr_t *this)
+{
+	chunk_t composite;
+	enumerator_t *enumerator;
+	u_int16_t selection_size;
+	u_int32_t pcr_field_size, pcr;
+	u_char *pos;
+
+	selection_size = get_selection_size(this);
+	pcr_field_size = this->pcr_count * PTS_PCR_LEN;
+
+	composite = chunk_alloc(2 + selection_size + 4 + pcr_field_size);
+	pos = composite.ptr;
+	htoun16(pos, selection_size);
+	pos += 2;
+	memcpy(pos, this->pcr_select, selection_size);
+	pos += selection_size;
+	htoun32(pos, pcr_field_size);
+	pos += 4;
+
+	enumerator = create_enumerator(this);
+	while (enumerator->enumerate(enumerator, &pcr))
+	{
+		memcpy(pos, this->pcrs[pcr].ptr, PTS_PCR_LEN);
+		pos += PTS_PCR_LEN;
+	}
+	enumerator->destroy(enumerator);
+
+	DBG3(DBG_PTS, "constructed PCR Composite: %B", &composite);
+	return composite;
+}
+
+METHOD(pts_pcr_t, destroy, void,
+	private_pts_pcr_t *this)
+{
+	u_int32_t i;
+
+	for (i = 0; i < PTS_PCR_MAX_NUM; i++)
+	{
+		free(this->pcrs[i].ptr);
+	}
+	this->hasher->destroy(this->hasher);
+	free(this);
+}
+
+/**
+ * See header
+ */
+pts_pcr_t *pts_pcr_create(void)
+{
+	private_pts_pcr_t *this;
+	hasher_t *hasher;
+	u_int32_t i;
+
+	hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
+	if (!hasher)
+	{
+		DBG1(DBG_PTS, "%N hasher could not be created",
+			 hash_algorithm_short_names, HASH_SHA1);
+		return NULL;
+	}
+
+	INIT(this,
+		.public = {
+			.get_count = _get_count,
+			.select_pcr = _select_pcr,
+			.get_selection_size = _get_selection_size,
+			.create_enumerator = _create_enumerator,
+			.get = _get,
+			.set = _set,
+			.extend = _extend,
+			.get_composite = _get_composite,
+			.destroy = _destroy,
+		},
+		.hasher = hasher,
+	);
+
+	for (i = 0; i < PTS_PCR_MAX_NUM; i++)
+	{
+		this->pcrs[i] = chunk_alloc(PTS_PCR_LEN);
+		memset(this->pcrs[i].ptr, 0x00, PTS_PCR_LEN);
+	}
+
+	return &this->public;
+}
+
diff --git a/src/libpts/pts/pts_pcr.h b/src/libpts/pts/pts_pcr.h
new file mode 100644
index 000000000..f638b5ee4
--- /dev/null
+++ b/src/libpts/pts/pts_pcr.h
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2012 Andreas Steffen
+ * HSR Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup pts_pcr pts_pcr
+ * @{ @ingroup pts
+ */
+
+#ifndef PTS_PCR_H_
+#define PTS_PCR_H_
+
+typedef struct pts_pcr_t pts_pcr_t;
+
+#include <library.h>
+
+/**
+ * Maximum number of PCR's of TPM, TPM Spec 1.2
+ */
+#define PTS_PCR_MAX_NUM				24
+
+/**
+ * Number of bytes that can be saved in a PCR of TPM, TPM Spec 1.2
+ */
+#define PTS_PCR_LEN					20
+
+/**
+ * Class implementing a shadow PCR register set
+ */
+struct pts_pcr_t {
+
+	/**
+	 * Get the number of selected PCRs
+	 *
+	 * @return				number of selected PCRs
+	 */
+	u_int32_t (*get_count)(pts_pcr_t *this);
+
+	/**
+	 * Mark a PCR as selected
+	 *
+	 * @param pcr			index of PCR
+	 * @return				TRUE if PCR index exists
+	 */
+	bool (*select_pcr)(pts_pcr_t *this, u_int32_t pcr);
+
+	/**
+	 * Get the size of the selection field in bytes
+	 *
+	 * @return				number of bytes written
+	 */
+	size_t (*get_selection_size)(pts_pcr_t *this);
+
+	/**
+	 * Create an enumerator over all selected PCR indexes
+	 *
+	 * @return				enumerator
+	 */
+	enumerator_t* (*create_enumerator)(pts_pcr_t *this);
+
+	/**
+	 * Get the current content of a PCR
+	 *
+	 * @param pcr			index of PCR
+	 * @return				content of PCR
+	 */
+	chunk_t (*get)(pts_pcr_t *this, u_int32_t pcr);
+
+	/**
+	 * Set the content of a PCR
+	 *
+	 * @param pcr			index of PCR
+	 * @param value			new value of PCR
+	 * @return				TRUE if value could be set
+	 */
+	bool (*set)(pts_pcr_t *this, u_int32_t pcr, chunk_t value);
+
+	/**
+	 * Extend the content of a PCR
+	 *
+	 * @param pcr			index of PCR
+	 * @param measurement	measurment value to be extended into PCR
+	 * @return				new content of PCR
+	 */
+	chunk_t (*extend)(pts_pcr_t *this, u_int32_t pcr, chunk_t measurement);
+
+	/**
+	 * Create a PCR Composite object over all selected PCRs
+	 *
+	 * @return				PCR Composite object (must be freed)
+	 */
+	chunk_t (*get_composite)(pts_pcr_t *this);
+
+	/**
+
+	 * Destroys a pts_pcr_t object.
+	 */
+	void (*destroy)(pts_pcr_t *this);
+
+};
+
+/**
+ * Creates an pts_pcr_t object
+ */
+pts_pcr_t* pts_pcr_create(void);
+
+#endif /** PTS_PCR_H_ @}*/
diff --git a/src/libpts/tcg/tcg_pts_attr_aik.c b/src/libpts/tcg/tcg_pts_attr_aik.c
index 9be3794b6..75f3f179c 100644
--- a/src/libpts/tcg/tcg_pts_attr_aik.c
+++ b/src/libpts/tcg/tcg_pts_attr_aik.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -49,14 +49,9 @@ struct private_tcg_pts_attr_aik_t {
 	tcg_pts_attr_aik_t public;
 
 	/**
-	 * Attribute vendor ID
+	 * Vendor-specific attribute type
 	 */
-	pen_t vendor_id;
-
-	/**
-	 * Attribute type
-	 */
-	u_int32_t type;
+	pen_type_t type;
 
 	/**
 	 * Attribute value
@@ -79,13 +74,7 @@ struct private_tcg_pts_attr_aik_t {
 	refcount_t ref;
 };
 
-METHOD(pa_tnc_attr_t, get_vendor_id, pen_t,
-	private_tcg_pts_attr_aik_t *this)
-{
-	return this->vendor_id;
-}
-
-METHOD(pa_tnc_attr_t, get_type, u_int32_t,
+METHOD(pa_tnc_attr_t, get_type, pen_type_t,
 	private_tcg_pts_attr_aik_t *this)
 {
 	return this->type;
@@ -117,6 +106,10 @@ METHOD(pa_tnc_attr_t, build, void,
 	cred_encoding_type_t encoding_type = CERT_ASN1_DER;
 	chunk_t aik_blob;
 
+	if (this->value.ptr)
+	{
+		return;
+	}
 	if (this->aik->get_type(this->aik) == CERT_TRUSTED_PUBKEY)
 	{
 		flags |= PTS_AIK_FLAGS_NAKED_KEY;
@@ -202,7 +195,6 @@ pa_tnc_attr_t *tcg_pts_attr_aik_create(certificate_t *aik)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -214,8 +206,7 @@ pa_tnc_attr_t *tcg_pts_attr_aik_create(certificate_t *aik)
 			},
 			.get_aik = _get_aik,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_AIK,
+		.type = { PEN_TCG, TCG_PTS_AIK },
 		.aik = aik->get_ref(aik),
 		.ref = 1,
 	);
@@ -234,7 +225,6 @@ pa_tnc_attr_t *tcg_pts_attr_aik_create_from_data(chunk_t data)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -246,8 +236,7 @@ pa_tnc_attr_t *tcg_pts_attr_aik_create_from_data(chunk_t data)
 			},
 			.get_aik = _get_aik,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_AIK,
+		.type = { PEN_TCG, TCG_PTS_AIK },
 		.value = chunk_clone(data),
 		.ref = 1,
 	);
diff --git a/src/libpts/tcg/tcg_pts_attr_dh_nonce_finish.c b/src/libpts/tcg/tcg_pts_attr_dh_nonce_finish.c
index dce98e87d..3ca255cba 100644
--- a/src/libpts/tcg/tcg_pts_attr_dh_nonce_finish.c
+++ b/src/libpts/tcg/tcg_pts_attr_dh_nonce_finish.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -53,14 +53,9 @@ struct private_tcg_pts_attr_dh_nonce_finish_t {
 	tcg_pts_attr_dh_nonce_finish_t public;
 
 	/**
-	 * Attribute vendor ID
+	 * Vendor-specific attribute type
 	 */
-	pen_t vendor_id;
-
-	/**
-	 * Attribute type
-	 */
-	u_int32_t type;
+	pen_type_t type;
 
 	/**
 	 * Attribute value
@@ -93,13 +88,7 @@ struct private_tcg_pts_attr_dh_nonce_finish_t {
 	refcount_t ref;
 };
 
-METHOD(pa_tnc_attr_t, get_vendor_id, pen_t,
-	private_tcg_pts_attr_dh_nonce_finish_t *this)
-{
-	return this->vendor_id;
-}
-
-METHOD(pa_tnc_attr_t, get_type, u_int32_t,
+METHOD(pa_tnc_attr_t, get_type, pen_type_t,
 	private_tcg_pts_attr_dh_nonce_finish_t *this)
 {
 	return this->type;
@@ -128,6 +117,10 @@ METHOD(pa_tnc_attr_t, build, void,
 {
 	bio_writer_t *writer;
 
+	if (this->value.ptr)
+	{
+		return;
+	}
 	writer = bio_writer_create(PTS_DH_NONCE_FINISH_SIZE);
 	writer->write_uint8 (writer, PTS_DH_NONCE_FINISH_RESERVED);
 	writer->write_uint8 (writer, this->initiator_nonce.len);
@@ -217,7 +210,6 @@ pa_tnc_attr_t *tcg_pts_attr_dh_nonce_finish_create(
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -231,8 +223,7 @@ pa_tnc_attr_t *tcg_pts_attr_dh_nonce_finish_create(
 			.get_initiator_nonce = _get_initiator_nonce,
 			.get_initiator_value = _get_initiator_value,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_DH_NONCE_FINISH,
+		.type = { PEN_TCG, TCG_PTS_DH_NONCE_FINISH },
 		.hash_algo = hash_algo,
 		.initiator_value = initiator_value,
 		.initiator_nonce = chunk_clone(initiator_nonce),
@@ -252,7 +243,6 @@ pa_tnc_attr_t *tcg_pts_attr_dh_nonce_finish_create_from_data(chunk_t value)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -266,8 +256,7 @@ pa_tnc_attr_t *tcg_pts_attr_dh_nonce_finish_create_from_data(chunk_t value)
 			.get_initiator_nonce = _get_initiator_nonce,
 			.get_initiator_value = _get_initiator_value,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_DH_NONCE_FINISH,
+		.type = { PEN_TCG, TCG_PTS_DH_NONCE_FINISH },
 		.value = chunk_clone(value),
 		.ref = 1,
 	);
diff --git a/src/libpts/tcg/tcg_pts_attr_dh_nonce_params_req.c b/src/libpts/tcg/tcg_pts_attr_dh_nonce_params_req.c
index 36266fe12..828c09605 100644
--- a/src/libpts/tcg/tcg_pts_attr_dh_nonce_params_req.c
+++ b/src/libpts/tcg/tcg_pts_attr_dh_nonce_params_req.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -49,14 +49,9 @@ struct private_tcg_pts_attr_dh_nonce_params_req_t {
 	tcg_pts_attr_dh_nonce_params_req_t public;
 
 	/**
-	 * Attribute vendor ID
+	 * Vendor-specific attribute type
 	 */
-	pen_t vendor_id;
-
-	/**
-	 * Attribute type
-	 */
-	u_int32_t type;
+	pen_type_t type;
 
 	/**
 	 * Attribute value
@@ -84,13 +79,7 @@ struct private_tcg_pts_attr_dh_nonce_params_req_t {
 	refcount_t ref;
 };
 
-METHOD(pa_tnc_attr_t, get_vendor_id, pen_t,
-	private_tcg_pts_attr_dh_nonce_params_req_t *this)
-{
-	return this->vendor_id;
-}
-
-METHOD(pa_tnc_attr_t, get_type, u_int32_t,
+METHOD(pa_tnc_attr_t, get_type, pen_type_t,
 	private_tcg_pts_attr_dh_nonce_params_req_t *this)
 {
 	return this->type;
@@ -119,6 +108,10 @@ METHOD(pa_tnc_attr_t, build, void,
 {
 	bio_writer_t *writer;
 
+	if (this->value.ptr)
+	{
+		return;
+	}
 	writer = bio_writer_create(PTS_DH_NONCE_PARAMS_REQ_SIZE);
 	writer->write_uint8 (writer, PTS_DH_NONCE_PARAMS_REQ_RESERVED);
 	writer->write_uint8 (writer, this->min_nonce_len);
@@ -191,7 +184,6 @@ pa_tnc_attr_t *tcg_pts_attr_dh_nonce_params_req_create(u_int8_t min_nonce_len,
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -204,8 +196,7 @@ pa_tnc_attr_t *tcg_pts_attr_dh_nonce_params_req_create(u_int8_t min_nonce_len,
 			.get_min_nonce_len = _get_min_nonce_len,
 			.get_dh_groups = _get_dh_groups,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_DH_NONCE_PARAMS_REQ,
+		.type = { PEN_TCG, TCG_PTS_DH_NONCE_PARAMS_REQ },
 		.min_nonce_len = min_nonce_len,
 		.dh_groups = dh_groups,
 		.ref = 1,
@@ -224,7 +215,6 @@ pa_tnc_attr_t *tcg_pts_attr_dh_nonce_params_req_create_from_data(chunk_t value)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -237,8 +227,7 @@ pa_tnc_attr_t *tcg_pts_attr_dh_nonce_params_req_create_from_data(chunk_t value)
 			.get_min_nonce_len = _get_min_nonce_len,
 			.get_dh_groups = _get_dh_groups,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_DH_NONCE_PARAMS_REQ,
+		.type = { PEN_TCG, TCG_PTS_DH_NONCE_PARAMS_REQ },
 		.value = chunk_clone(value),
 		.ref = 1,
 	);
diff --git a/src/libpts/tcg/tcg_pts_attr_dh_nonce_params_resp.c b/src/libpts/tcg/tcg_pts_attr_dh_nonce_params_resp.c
index 09bfa3aac..66ac185b3 100644
--- a/src/libpts/tcg/tcg_pts_attr_dh_nonce_params_resp.c
+++ b/src/libpts/tcg/tcg_pts_attr_dh_nonce_params_resp.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -55,14 +55,9 @@ struct private_tcg_pts_attr_dh_nonce_params_resp_t {
 	tcg_pts_attr_dh_nonce_params_resp_t public;
 
 	/**
-	 * Attribute vendor ID
+	 * Vendor-specific attribute type
 	 */
-	pen_t vendor_id;
-
-	/**
-	 * Attribute type
-	 */
-	u_int32_t type;
+	pen_type_t type;
 
 	/**
 	 * Attribute value
@@ -100,13 +95,7 @@ struct private_tcg_pts_attr_dh_nonce_params_resp_t {
 	refcount_t ref;
 };
 
-METHOD(pa_tnc_attr_t, get_vendor_id, pen_t,
-	private_tcg_pts_attr_dh_nonce_params_resp_t *this)
-{
-	return this->vendor_id;
-}
-
-METHOD(pa_tnc_attr_t, get_type, u_int32_t,
+METHOD(pa_tnc_attr_t, get_type, pen_type_t,
 	private_tcg_pts_attr_dh_nonce_params_resp_t *this)
 {
 	return this->type;
@@ -135,6 +124,10 @@ METHOD(pa_tnc_attr_t, build, void,
 {
 	bio_writer_t *writer;
 
+	if (this->value.ptr)
+	{
+		return;
+	}
 	writer = bio_writer_create(PTS_DH_NONCE_PARAMS_RESP_SIZE);
 	writer->write_uint24(writer, PTS_DH_NONCE_PARAMS_RESP_RESERVED);
 	writer->write_uint8 (writer, this->responder_nonce.len);
@@ -233,7 +226,6 @@ pa_tnc_attr_t *tcg_pts_attr_dh_nonce_params_resp_create(pts_dh_group_t dh_group,
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -248,8 +240,7 @@ pa_tnc_attr_t *tcg_pts_attr_dh_nonce_params_resp_create(pts_dh_group_t dh_group,
 			.get_responder_nonce = _get_responder_nonce,
 			.get_responder_value = _get_responder_value,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_DH_NONCE_PARAMS_RESP,
+		.type = { PEN_TCG, TCG_PTS_DH_NONCE_PARAMS_RESP },
 		.dh_group = dh_group,
 		.hash_algo_set = hash_algo_set,
 		.responder_nonce = chunk_clone(responder_nonce),
@@ -270,7 +261,6 @@ pa_tnc_attr_t *tcg_pts_attr_dh_nonce_params_resp_create_from_data(chunk_t value)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -285,8 +275,7 @@ pa_tnc_attr_t *tcg_pts_attr_dh_nonce_params_resp_create_from_data(chunk_t value)
 			.get_responder_nonce = _get_responder_nonce,
 			.get_responder_value = _get_responder_value,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_DH_NONCE_PARAMS_RESP,
+		.type = { PEN_TCG, TCG_PTS_DH_NONCE_PARAMS_RESP },
 		.value = chunk_clone(value),
 		.ref = 1,
 	);
diff --git a/src/libpts/tcg/tcg_pts_attr_file_meas.c b/src/libpts/tcg/tcg_pts_attr_file_meas.c
index 737da65c1..01c4361e1 100644
--- a/src/libpts/tcg/tcg_pts_attr_file_meas.c
+++ b/src/libpts/tcg/tcg_pts_attr_file_meas.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -64,14 +64,9 @@ struct private_tcg_pts_attr_file_meas_t {
 	tcg_pts_attr_file_meas_t public;
 
 	/**
-	 * Attribute vendor ID
+	 * Vendor-specific attribute type
 	 */
-	pen_t vendor_id;
-
-	/**
-	 * Attribute type
-	 */
-	u_int32_t type;
+	pen_type_t type;
 
 	/**
 	 * Attribute value
@@ -94,13 +89,7 @@ struct private_tcg_pts_attr_file_meas_t {
 	refcount_t ref;
 };
 
-METHOD(pa_tnc_attr_t, get_vendor_id, pen_t,
-	private_tcg_pts_attr_file_meas_t *this)
-{
-	return this->vendor_id;
-}
-
-METHOD(pa_tnc_attr_t, get_type, u_int32_t,
+METHOD(pa_tnc_attr_t, get_type, pen_type_t,
 	private_tcg_pts_attr_file_meas_t *this)
 {
 	return this->type;
@@ -135,6 +124,10 @@ METHOD(pa_tnc_attr_t, build, void,
 	chunk_t measurement;
 	bool first = TRUE;
 	
+	if (this->value.ptr)
+	{
+		return;
+	}
 	number_of_files = this->measurements->get_file_count(this->measurements);
 	request_id = this->measurements->get_request_id(this->measurements);
 
@@ -254,7 +247,6 @@ pa_tnc_attr_t *tcg_pts_attr_file_meas_create(pts_file_meas_t *measurements)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -266,8 +258,7 @@ pa_tnc_attr_t *tcg_pts_attr_file_meas_create(pts_file_meas_t *measurements)
 			},
 			.get_measurements = _get_measurements,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_FILE_MEAS,
+		.type = { PEN_TCG, TCG_PTS_FILE_MEAS },
 		.measurements = measurements,
 		.ref = 1,
 	);
@@ -286,7 +277,6 @@ pa_tnc_attr_t *tcg_pts_attr_file_meas_create_from_data(chunk_t data)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -298,8 +288,7 @@ pa_tnc_attr_t *tcg_pts_attr_file_meas_create_from_data(chunk_t data)
 			},
 			.get_measurements = _get_measurements,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_FILE_MEAS,
+		.type = { PEN_TCG, TCG_PTS_FILE_MEAS },
 		.value = chunk_clone(data),
 		.ref = 1,
 	);
diff --git a/src/libpts/tcg/tcg_pts_attr_gen_attest_evid.c b/src/libpts/tcg/tcg_pts_attr_gen_attest_evid.c
index 054285c4e..5eac5ecae 100644
--- a/src/libpts/tcg/tcg_pts_attr_gen_attest_evid.c
+++ b/src/libpts/tcg/tcg_pts_attr_gen_attest_evid.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -50,14 +50,9 @@ struct private_tcg_pts_attr_gen_attest_evid_t {
 	tcg_pts_attr_gen_attest_evid_t public;
 
 	/**
-	 * Attribute vendor ID
+	 * Vendor-specific attribute type
 	 */
-	pen_t vendor_id;
-
-	/**
-	 * Attribute type
-	 */
-	u_int32_t type;
+	pen_type_t type;
 
 	/**
 	 * Attribute value
@@ -75,13 +70,7 @@ struct private_tcg_pts_attr_gen_attest_evid_t {
 	refcount_t ref;
 };
 
-METHOD(pa_tnc_attr_t, get_vendor_id, pen_t,
-	private_tcg_pts_attr_gen_attest_evid_t *this)
-{
-	return this->vendor_id;
-}
-
-METHOD(pa_tnc_attr_t, get_type, u_int32_t,
+METHOD(pa_tnc_attr_t, get_type, pen_type_t,
 	private_tcg_pts_attr_gen_attest_evid_t *this)
 {
 	return this->type;
@@ -110,6 +99,10 @@ METHOD(pa_tnc_attr_t, build, void,
 {
 	bio_writer_t *writer;
 
+	if (this->value.ptr)
+	{
+		return;
+	}
 	writer = bio_writer_create(PTS_GEN_ATTEST_EVID_SIZE);
 	writer->write_uint32 (writer, PTS_GEN_ATTEST_EVID_RESERVED);
 
@@ -163,7 +156,6 @@ pa_tnc_attr_t *tcg_pts_attr_gen_attest_evid_create()
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -174,8 +166,7 @@ pa_tnc_attr_t *tcg_pts_attr_gen_attest_evid_create()
 				.destroy = _destroy,
 			},
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_GEN_ATTEST_EVID,
+		.type = { PEN_TCG, TCG_PTS_GEN_ATTEST_EVID },
 		.ref = 1,
 	);
 
@@ -193,7 +184,6 @@ pa_tnc_attr_t *tcg_pts_attr_gen_attest_evid_create_from_data(chunk_t data)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -204,8 +194,7 @@ pa_tnc_attr_t *tcg_pts_attr_gen_attest_evid_create_from_data(chunk_t data)
 				.destroy = _destroy,
 			},
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_GEN_ATTEST_EVID,
+		.type = { PEN_TCG, TCG_PTS_GEN_ATTEST_EVID },
 		.value = chunk_clone(data),
 		.ref = 1,
 	);
diff --git a/src/libpts/tcg/tcg_pts_attr_get_aik.c b/src/libpts/tcg/tcg_pts_attr_get_aik.c
index 1875375a4..4b5eae7a7 100644
--- a/src/libpts/tcg/tcg_pts_attr_get_aik.c
+++ b/src/libpts/tcg/tcg_pts_attr_get_aik.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -47,14 +47,9 @@ struct private_tcg_pts_attr_get_aik_t {
 	tcg_pts_attr_get_aik_t public;
 
 	/**
-	 * Attribute vendor ID
+	 * Vendor-specific attribute type
 	 */
-	pen_t vendor_id;
-
-	/**
-	 * Attribute type
-	 */
-	u_int32_t type;
+	pen_type_t type;
 
 	/**
 	 * Attribute value
@@ -72,13 +67,7 @@ struct private_tcg_pts_attr_get_aik_t {
 	refcount_t ref;
 };
 
-METHOD(pa_tnc_attr_t, get_vendor_id, pen_t,
-	private_tcg_pts_attr_get_aik_t *this)
-{
-	return this->vendor_id;
-}
-
-METHOD(pa_tnc_attr_t, get_type, u_int32_t,
+METHOD(pa_tnc_attr_t, get_type, pen_type_t,
 	private_tcg_pts_attr_get_aik_t *this)
 {
 	return this->type;
@@ -107,6 +96,10 @@ METHOD(pa_tnc_attr_t, build, void,
 {
 	bio_writer_t *writer;
 
+	if (this->value.ptr)
+	{
+		return;
+	}
 	writer = bio_writer_create(PTS_GET_AIK_SIZE);
 	writer->write_uint32 (writer, PTS_GET_AIK_RESERVED);
 
@@ -160,7 +153,6 @@ pa_tnc_attr_t *tcg_pts_attr_get_aik_create()
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -171,8 +163,7 @@ pa_tnc_attr_t *tcg_pts_attr_get_aik_create()
 				.destroy = _destroy,
 			},
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_GET_AIK,
+		.type = { PEN_TCG, TCG_PTS_GET_AIK },
 		.ref = 1,
 	);
 
@@ -190,7 +181,6 @@ pa_tnc_attr_t *tcg_pts_attr_get_aik_create_from_data(chunk_t data)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -201,8 +191,7 @@ pa_tnc_attr_t *tcg_pts_attr_get_aik_create_from_data(chunk_t data)
 				.destroy = _destroy,
 			},
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_GET_AIK,
+		.type = { PEN_TCG, TCG_PTS_GET_AIK },
 		.value = chunk_clone(data),
 		.ref = 1,
 	);
diff --git a/src/libpts/tcg/tcg_pts_attr_get_tpm_version_info.c b/src/libpts/tcg/tcg_pts_attr_get_tpm_version_info.c
index cb6834ca5..0cfc7efa9 100644
--- a/src/libpts/tcg/tcg_pts_attr_get_tpm_version_info.c
+++ b/src/libpts/tcg/tcg_pts_attr_get_tpm_version_info.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -50,14 +50,9 @@ struct private_tcg_pts_attr_get_tpm_version_info_t {
 	tcg_pts_attr_get_tpm_version_info_t public;
 
 	/**
-	 * Attribute vendor ID
+	 * Vendor-specific attribute type
 	 */
-	pen_t vendor_id;
-
-	/**
-	 * Attribute type
-	 */
-	u_int32_t type;
+	pen_type_t type;
 
 	/**
 	 * Attribute value
@@ -75,13 +70,7 @@ struct private_tcg_pts_attr_get_tpm_version_info_t {
 	refcount_t ref;
 };
 
-METHOD(pa_tnc_attr_t, get_vendor_id, pen_t,
-	private_tcg_pts_attr_get_tpm_version_info_t *this)
-{
-	return this->vendor_id;
-}
-
-METHOD(pa_tnc_attr_t, get_type, u_int32_t,
+METHOD(pa_tnc_attr_t, get_type, pen_type_t,
 	private_tcg_pts_attr_get_tpm_version_info_t *this)
 {
 	return this->type;
@@ -110,6 +99,10 @@ METHOD(pa_tnc_attr_t, build, void,
 {
 	bio_writer_t *writer;
 
+	if (this->value.ptr)
+	{
+		return;
+	}
 	writer = bio_writer_create(PTS_GET_TPM_VER_INFO_SIZE);
 	writer->write_uint32 (writer, PTS_GET_TPM_VER_INFO_RESERVED);
 
@@ -163,7 +156,6 @@ pa_tnc_attr_t *tcg_pts_attr_get_tpm_version_info_create()
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -174,8 +166,7 @@ pa_tnc_attr_t *tcg_pts_attr_get_tpm_version_info_create()
 				.destroy = _destroy,
 			},
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_GET_TPM_VERSION_INFO,
+		.type = { PEN_TCG, TCG_PTS_GET_TPM_VERSION_INFO },
 		.ref = 1,
 	);
 
@@ -193,7 +184,6 @@ pa_tnc_attr_t *tcg_pts_attr_get_tpm_version_info_create_from_data(chunk_t data)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -204,8 +194,7 @@ pa_tnc_attr_t *tcg_pts_attr_get_tpm_version_info_create_from_data(chunk_t data)
 				.destroy = _destroy,
 			},
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_GET_TPM_VERSION_INFO,
+		.type = { PEN_TCG, TCG_PTS_GET_TPM_VERSION_INFO },
 		.value = chunk_clone(data),
 		.ref = 1,
 	);
diff --git a/src/libpts/tcg/tcg_pts_attr_meas_algo.c b/src/libpts/tcg/tcg_pts_attr_meas_algo.c
index ed520e3cd..bb95adc9e 100644
--- a/src/libpts/tcg/tcg_pts_attr_meas_algo.c
+++ b/src/libpts/tcg/tcg_pts_attr_meas_algo.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -48,14 +48,9 @@ struct private_tcg_pts_attr_meas_algo_t {
 	tcg_pts_attr_meas_algo_t public;
 
 	/**
-	 * Attribute vendor ID
+	 * Vendor-specific attribute type
 	 */
-	pen_t vendor_id;
-
-	/**
-	 * Attribute type
-	 */
-	u_int32_t type;
+	pen_type_t type;
 
 	/**
 	 * Attribute value
@@ -78,13 +73,7 @@ struct private_tcg_pts_attr_meas_algo_t {
 	refcount_t ref;
 };
 
-METHOD(pa_tnc_attr_t, get_vendor_id, pen_t,
-	private_tcg_pts_attr_meas_algo_t *this)
-{
-	return this->vendor_id;
-}
-
-METHOD(pa_tnc_attr_t, get_type, u_int32_t,
+METHOD(pa_tnc_attr_t, get_type, pen_type_t,
 	private_tcg_pts_attr_meas_algo_t *this)
 {
 	return this->type;
@@ -113,6 +102,10 @@ METHOD(pa_tnc_attr_t, build, void,
 {
 	bio_writer_t *writer;
 
+	if (this->value.ptr)
+	{
+		return;
+	}
 	writer = bio_writer_create(PTS_MEAS_ALGO_SIZE);
 	writer->write_uint16(writer, PTS_MEAS_ALGO_RESERVED);
 	writer->write_uint16(writer, this->algorithms);
@@ -175,7 +168,6 @@ pa_tnc_attr_t *tcg_pts_attr_meas_algo_create(pts_meas_algorithms_t algorithms,
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -187,8 +179,8 @@ pa_tnc_attr_t *tcg_pts_attr_meas_algo_create(pts_meas_algorithms_t algorithms,
 			},
 			.get_algorithms = _get_algorithms,
 		},
-		.vendor_id = PEN_TCG,
-		.type = selection ? TCG_PTS_MEAS_ALGO_SELECTION : TCG_PTS_MEAS_ALGO,
+		.type = { PEN_TCG,
+				  selection ? TCG_PTS_MEAS_ALGO_SELECTION : TCG_PTS_MEAS_ALGO },
 		.algorithms = algorithms,
 		.ref = 1,
 	);
@@ -208,7 +200,6 @@ pa_tnc_attr_t *tcg_pts_attr_meas_algo_create_from_data(chunk_t data,
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -220,8 +211,8 @@ pa_tnc_attr_t *tcg_pts_attr_meas_algo_create_from_data(chunk_t data,
 			},
 			.get_algorithms = _get_algorithms,
 		},
-		.vendor_id = PEN_TCG,
-		.type = selection ? TCG_PTS_MEAS_ALGO_SELECTION : TCG_PTS_MEAS_ALGO,
+		.type = { PEN_TCG,
+				  selection ? TCG_PTS_MEAS_ALGO_SELECTION : TCG_PTS_MEAS_ALGO },
 		.value = chunk_clone(data),
 		.ref = 1,
 	);
diff --git a/src/libpts/tcg/tcg_pts_attr_proto_caps.c b/src/libpts/tcg/tcg_pts_attr_proto_caps.c
index 055c750ff..83665ff69 100644
--- a/src/libpts/tcg/tcg_pts_attr_proto_caps.c
+++ b/src/libpts/tcg/tcg_pts_attr_proto_caps.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -48,14 +48,9 @@ struct private_tcg_pts_attr_proto_caps_t {
 	tcg_pts_attr_proto_caps_t public;
 
 	/**
-	 * Attribute vendor ID
+	 * Vendor-specific attribute type
 	 */
-	pen_t vendor_id;
-
-	/**
-	 * Attribute type
-	 */
-	u_int32_t type;
+	pen_type_t type;
 
 	/**
 	 * Attribute value
@@ -78,13 +73,7 @@ struct private_tcg_pts_attr_proto_caps_t {
 	refcount_t ref;
 };
 
-METHOD(pa_tnc_attr_t, get_vendor_id, pen_t,
-	private_tcg_pts_attr_proto_caps_t *this)
-{
-	return this->vendor_id;
-}
-
-METHOD(pa_tnc_attr_t, get_type, u_int32_t,
+METHOD(pa_tnc_attr_t, get_type, pen_type_t,
 	private_tcg_pts_attr_proto_caps_t *this)
 {
 	return this->type;
@@ -113,6 +102,10 @@ METHOD(pa_tnc_attr_t, build, void,
 {
 	bio_writer_t *writer;
 
+	if (this->value.ptr)
+	{
+		return;
+	}
 	writer = bio_writer_create(PTS_PROTO_CAPS_SIZE);
 	writer->write_uint16(writer, PTS_PROTO_CAPS_RESERVED);
 	writer->write_uint16(writer, this->flags);
@@ -176,7 +169,6 @@ pa_tnc_attr_t *tcg_pts_attr_proto_caps_create(pts_proto_caps_flag_t flags,
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -188,8 +180,8 @@ pa_tnc_attr_t *tcg_pts_attr_proto_caps_create(pts_proto_caps_flag_t flags,
 			},
 			.get_flags = _get_flags,
 		},
-		.vendor_id = PEN_TCG,
-		.type = request ? TCG_PTS_REQ_PROTO_CAPS : TCG_PTS_PROTO_CAPS,
+		.type = { PEN_TCG,
+				  request ? TCG_PTS_REQ_PROTO_CAPS : TCG_PTS_PROTO_CAPS },
 		.flags = flags,
 		.ref = 1,
 	);
@@ -208,7 +200,6 @@ pa_tnc_attr_t *tcg_pts_attr_proto_caps_create_from_data(chunk_t data,
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -220,8 +211,8 @@ pa_tnc_attr_t *tcg_pts_attr_proto_caps_create_from_data(chunk_t data,
 			},
 			.get_flags = _get_flags,
 		},
-		.vendor_id = PEN_TCG,
-		.type = request ? TCG_PTS_REQ_PROTO_CAPS : TCG_PTS_PROTO_CAPS,
+		.type = { PEN_TCG,
+				  request ? TCG_PTS_REQ_PROTO_CAPS : TCG_PTS_PROTO_CAPS },
 		.value = chunk_clone(data),
 		.ref = 1,
 	);
diff --git a/src/libpts/tcg/tcg_pts_attr_req_file_meas.c b/src/libpts/tcg/tcg_pts_attr_req_file_meas.c
index 17781f745..65bdff579 100644
--- a/src/libpts/tcg/tcg_pts_attr_req_file_meas.c
+++ b/src/libpts/tcg/tcg_pts_attr_req_file_meas.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -54,14 +54,9 @@ struct private_tcg_pts_attr_req_file_meas_t {
 	tcg_pts_attr_req_file_meas_t public;
 
 	/**
-	 * Attribute vendor ID
+	 * Vendor-specific attribute type
 	 */
-	pen_t vendor_id;
-
-	/**
-	 * Attribute type
-	 */
-	u_int32_t type;
+	pen_type_t type;
 
 	/**
 	 * Attribute value
@@ -99,13 +94,7 @@ struct private_tcg_pts_attr_req_file_meas_t {
 	refcount_t ref;
 };
 
-METHOD(pa_tnc_attr_t, get_vendor_id, pen_t,
-	private_tcg_pts_attr_req_file_meas_t *this)
-{
-	return this->vendor_id;
-}
-
-METHOD(pa_tnc_attr_t, get_type, u_int32_t,
+METHOD(pa_tnc_attr_t, get_type, pen_type_t,
 	private_tcg_pts_attr_req_file_meas_t *this)
 {
 	return this->type;
@@ -136,6 +125,10 @@ METHOD(pa_tnc_attr_t, build, void,
 	chunk_t pathname;
 	bio_writer_t *writer;
 	
+	if (this->value.ptr)
+	{
+		return;
+	}
 	if (this->directory_flag)
 	{
 		flags |= DIRECTORY_CONTENTS_FLAG;
@@ -240,7 +233,6 @@ pa_tnc_attr_t *tcg_pts_attr_req_file_meas_create(bool directory_flag,
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -255,8 +247,7 @@ pa_tnc_attr_t *tcg_pts_attr_req_file_meas_create(bool directory_flag,
 			.get_delimiter = _get_delimiter,
 			.get_pathname = _get_pathname,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_REQ_FILE_MEAS,
+		.type = { PEN_TCG, TCG_PTS_REQ_FILE_MEAS },
 		.directory_flag = directory_flag,
 		.request_id = request_id,
 		.delimiter = delimiter,
@@ -278,7 +269,6 @@ pa_tnc_attr_t *tcg_pts_attr_req_file_meas_create_from_data(chunk_t data)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -293,8 +283,7 @@ pa_tnc_attr_t *tcg_pts_attr_req_file_meas_create_from_data(chunk_t data)
 			.get_delimiter = _get_delimiter,
 			.get_pathname = _get_pathname,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_REQ_FILE_MEAS,
+		.type = { PEN_TCG, TCG_PTS_REQ_FILE_MEAS },
 		.value = chunk_clone(data),
 		.ref = 1,
 	);
diff --git a/src/libpts/tcg/tcg_pts_attr_req_file_meta.c b/src/libpts/tcg/tcg_pts_attr_req_file_meta.c
index bef6b5db6..eb5114172 100644
--- a/src/libpts/tcg/tcg_pts_attr_req_file_meta.c
+++ b/src/libpts/tcg/tcg_pts_attr_req_file_meta.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -52,14 +52,9 @@ struct private_tcg_pts_attr_req_file_meta_t {
 	tcg_pts_attr_req_file_meta_t public;
 
 	/**
-	 * Attribute vendor ID
+	 * Vendor-specific attribute type
 	 */
-	pen_t vendor_id;
-
-	/**
-	 * Attribute type
-	 */
-	u_int32_t type;
+	pen_type_t type;
 
 	/**
 	 * Attribute value
@@ -92,13 +87,7 @@ struct private_tcg_pts_attr_req_file_meta_t {
 	refcount_t ref;
 };
 
-METHOD(pa_tnc_attr_t, get_vendor_id, pen_t,
-	private_tcg_pts_attr_req_file_meta_t *this)
-{
-	return this->vendor_id;
-}
-
-METHOD(pa_tnc_attr_t, get_type, u_int32_t,
+METHOD(pa_tnc_attr_t, get_type, pen_type_t,
 	private_tcg_pts_attr_req_file_meta_t *this)
 {
 	return this->type;
@@ -129,6 +118,10 @@ METHOD(pa_tnc_attr_t, build, void,
 	chunk_t pathname;
 	bio_writer_t *writer;
 	
+	if (this->value.ptr)
+	{
+		return;
+	}
 	if (this->directory_flag)
 	{
 		flags |= DIRECTORY_CONTENTS_FLAG;
@@ -226,7 +219,6 @@ pa_tnc_attr_t *tcg_pts_attr_req_file_meta_create(bool directory_flag,
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -240,8 +232,7 @@ pa_tnc_attr_t *tcg_pts_attr_req_file_meta_create(bool directory_flag,
 			.get_delimiter = _get_delimiter,
 			.get_pathname = _get_pathname,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_REQ_FILE_META,
+		.type = { PEN_TCG, TCG_PTS_REQ_FILE_META },
 		.directory_flag = directory_flag,
 		.delimiter = delimiter,
 		.pathname = strdup(pathname),
@@ -262,7 +253,6 @@ pa_tnc_attr_t *tcg_pts_attr_req_file_meta_create_from_data(chunk_t data)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -276,8 +266,7 @@ pa_tnc_attr_t *tcg_pts_attr_req_file_meta_create_from_data(chunk_t data)
 			.get_delimiter = _get_delimiter,
 			.get_pathname = _get_pathname,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_REQ_FILE_META,
+		.type = { PEN_TCG, TCG_PTS_REQ_FILE_META },
 		.value = chunk_clone(data),
 		.ref = 1,
 	);
diff --git a/src/libpts/tcg/tcg_pts_attr_req_func_comp_evid.c b/src/libpts/tcg/tcg_pts_attr_req_func_comp_evid.c
index bfd108b9f..a631e9891 100644
--- a/src/libpts/tcg/tcg_pts_attr_req_func_comp_evid.c
+++ b/src/libpts/tcg/tcg_pts_attr_req_func_comp_evid.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -73,14 +73,9 @@ struct private_tcg_pts_attr_req_func_comp_evid_t {
 	tcg_pts_attr_req_func_comp_evid_t public;
 
 	/**
-	 * Attribute vendor ID
+	 * Vendor-specific attribute type
 	 */
-	pen_t vendor_id;
-
-	/**
-	 * Attribute type
-	 */
-	u_int32_t type;
+	pen_type_t type;
 
 	/**
 	 * Attribute value
@@ -140,13 +135,7 @@ static void free_entry(entry_t *this)
 	}
 }
 
-METHOD(pa_tnc_attr_t, get_vendor_id, pen_t,
-	private_tcg_pts_attr_req_func_comp_evid_t *this)
-{
-	return this->vendor_id;
-}
-
-METHOD(pa_tnc_attr_t, get_type, u_int32_t,
+METHOD(pa_tnc_attr_t, get_type, pen_type_t,
 	private_tcg_pts_attr_req_func_comp_evid_t *this)
 {
 	return this->type;
@@ -177,6 +166,10 @@ METHOD(pa_tnc_attr_t, build, void,
 	enumerator_t *enumerator;
 	entry_t *entry;
 
+	if (this->value.ptr)
+	{
+		return;
+	}
 	writer = bio_writer_create(PTS_REQ_FUNC_COMP_EVID_SIZE);
 
 	enumerator = this->list->create_enumerator(this->list);
@@ -320,7 +313,6 @@ pa_tnc_attr_t *tcg_pts_attr_req_func_comp_evid_create(void)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -334,8 +326,7 @@ pa_tnc_attr_t *tcg_pts_attr_req_func_comp_evid_create(void)
 			.get_count = _get_count,
 			.create_enumerator = _create_enumerator,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_REQ_FUNC_COMP_EVID,
+		.type = { PEN_TCG, TCG_PTS_REQ_FUNC_COMP_EVID },
 		.list = linked_list_create(),
 		.ref = 1,
 	);
@@ -353,7 +344,6 @@ pa_tnc_attr_t *tcg_pts_attr_req_func_comp_evid_create_from_data(chunk_t data)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -367,8 +357,7 @@ pa_tnc_attr_t *tcg_pts_attr_req_func_comp_evid_create_from_data(chunk_t data)
 			.get_count = _get_count,
 			.create_enumerator = _create_enumerator,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_REQ_FUNC_COMP_EVID,
+		.type = { PEN_TCG, TCG_PTS_REQ_FUNC_COMP_EVID },
 		.list = linked_list_create(),
 		.value = chunk_clone(data),
 		.ref = 1,
diff --git a/src/libpts/tcg/tcg_pts_attr_simple_comp_evid.c b/src/libpts/tcg/tcg_pts_attr_simple_comp_evid.c
index d2c197ac4..387f4a115 100644
--- a/src/libpts/tcg/tcg_pts_attr_simple_comp_evid.c
+++ b/src/libpts/tcg/tcg_pts_attr_simple_comp_evid.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -100,14 +100,9 @@ struct private_tcg_pts_attr_simple_comp_evid_t {
 	tcg_pts_attr_simple_comp_evid_t public;
 
 	/**
-	 * Attribute vendor ID
+	 * Vendor-specific attribute type
 	 */
-	pen_t vendor_id;
-
-	/**
-	 * Attribute type
-	 */
-	u_int32_t type;
+	pen_type_t type;
 
 	/**
 	 * Attribute value
@@ -130,13 +125,7 @@ struct private_tcg_pts_attr_simple_comp_evid_t {
 	refcount_t ref;
 };
 
-METHOD(pa_tnc_attr_t, get_vendor_id, pen_t,
-	private_tcg_pts_attr_simple_comp_evid_t *this)
-{
-	return this->vendor_id;
-}
-
-METHOD(pa_tnc_attr_t, get_type, u_int32_t,
+METHOD(pa_tnc_attr_t, get_type, pen_type_t,
 	private_tcg_pts_attr_simple_comp_evid_t *this)
 {
 	return this->type;
@@ -185,16 +174,22 @@ METHOD(pa_tnc_attr_t, build, void,
 {
 	bio_writer_t *writer;
 	bool has_pcr_info;
-	char utc_time_buf[25];
+	char utc_time_buf[25], *policy_uri;
 	u_int8_t flags;
+	u_int16_t len;
 	u_int32_t depth, extended_pcr;
 	pts_comp_func_name_t *name;
 	pts_meas_algorithms_t hash_algorithm;
 	pts_pcr_transform_t transform;
 	pts_comp_evid_validation_t validation;
 	time_t measurement_time;
-	chunk_t measurement, utc_time, pcr_before, pcr_after, policy_uri;
+	chunk_t measurement, utc_time, pcr_before, pcr_after;
 	
+	if (this->value.ptr)
+	{
+		return;
+	}
+
 	/* Extract parameters from comp_evidence_t object */
 	name         = this->evidence->get_comp_func_name(this->evidence,
 							&depth);
@@ -234,8 +229,9 @@ METHOD(pa_tnc_attr_t, build, void,
 	if (validation == PTS_COMP_EVID_VALIDATION_FAILED ||
 		validation == PTS_COMP_EVID_VALIDATION_PASSED)
 	{
-		writer->write_uint16(writer, policy_uri.len);
-		writer->write_data  (writer, policy_uri);
+		len = strlen(policy_uri);
+		writer->write_uint16(writer, len);
+		writer->write_data  (writer, chunk_create(policy_uri, len));
 	}
 	if (has_pcr_info)
 	{
@@ -409,8 +405,13 @@ METHOD(pa_tnc_attr_t, process, status_t,
 	/* Add options */
 	if (has_validation)
 	{
-		policy_uri = chunk_clone(policy_uri);
-		this->evidence->set_validation(this->evidence, validation, policy_uri);
+		char buf[BUF_LEN];
+		size_t len;
+
+		len = min(policy_uri.len, BUF_LEN-1);
+		memcpy(buf, policy_uri.ptr, len);
+		buf[len] = '\0';
+		this->evidence->set_validation(this->evidence, validation, buf);
 	}
 	if (has_pcr_info)
 	{
@@ -460,7 +461,6 @@ pa_tnc_attr_t *tcg_pts_attr_simple_comp_evid_create(pts_comp_evidence_t *evid)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -472,8 +472,7 @@ pa_tnc_attr_t *tcg_pts_attr_simple_comp_evid_create(pts_comp_evidence_t *evid)
 			},
 			.get_comp_evidence = _get_comp_evidence,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_SIMPLE_COMP_EVID,
+		.type = { PEN_TCG, TCG_PTS_SIMPLE_COMP_EVID },
 		.evidence = evid,
 		.ref = 1,
 	);
@@ -492,7 +491,6 @@ pa_tnc_attr_t *tcg_pts_attr_simple_comp_evid_create_from_data(chunk_t data)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -504,8 +502,7 @@ pa_tnc_attr_t *tcg_pts_attr_simple_comp_evid_create_from_data(chunk_t data)
 			},
 			.get_comp_evidence = _get_comp_evidence,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_SIMPLE_COMP_EVID,
+		.type = { PEN_TCG, TCG_PTS_SIMPLE_COMP_EVID },
 		.value = chunk_clone(data),
 		.ref = 1,
 	);
diff --git a/src/libpts/tcg/tcg_pts_attr_simple_evid_final.c b/src/libpts/tcg/tcg_pts_attr_simple_evid_final.c
index 27720d509..8d2d4f82d 100644
--- a/src/libpts/tcg/tcg_pts_attr_simple_evid_final.c
+++ b/src/libpts/tcg/tcg_pts_attr_simple_evid_final.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -58,14 +58,9 @@ struct private_tcg_pts_attr_simple_evid_final_t {
 	tcg_pts_attr_simple_evid_final_t public;
 
 	/**
-	 * Attribute vendor ID
+	 * Vendor-specific attribute type
 	 */
-	pen_t vendor_id;
-
-	/**
-	 * Attribute type
-	 */
-	u_int32_t type;
+	pen_type_t type;
 
 	/**
 	 * Attribute value
@@ -113,13 +108,7 @@ struct private_tcg_pts_attr_simple_evid_final_t {
 	refcount_t ref;
 };
 
-METHOD(pa_tnc_attr_t, get_vendor_id, pen_t,
-	private_tcg_pts_attr_simple_evid_final_t *this)
-{
-	return this->vendor_id;
-}
-
-METHOD(pa_tnc_attr_t, get_type, u_int32_t,
+METHOD(pa_tnc_attr_t, get_type, pen_type_t,
 	private_tcg_pts_attr_simple_evid_final_t *this)
 {
 	return this->type;
@@ -169,6 +158,10 @@ METHOD(pa_tnc_attr_t, build, void,
 	bio_writer_t *writer;
 	u_int8_t flags;
 	
+	if (this->value.ptr)
+	{
+		return;
+	}
 	flags = this->flags & PTS_SIMPLE_EVID_FINAL_FLAG_MASK;
 
 	if (this->has_evid_sig)
@@ -333,7 +326,6 @@ pa_tnc_attr_t *tcg_pts_attr_simple_evid_final_create(u_int8_t flags,
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -347,8 +339,7 @@ pa_tnc_attr_t *tcg_pts_attr_simple_evid_final_create(u_int8_t flags,
 			.get_evid_sig = _get_evid_sig,
 			.set_evid_sig = _set_evid_sig,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_SIMPLE_EVID_FINAL,
+		.type = { PEN_TCG, TCG_PTS_SIMPLE_EVID_FINAL },
 		.flags = flags,
 		.comp_hash_algorithm = comp_hash_algorithm,
 		.pcr_comp = pcr_comp,
@@ -370,7 +361,6 @@ pa_tnc_attr_t *tcg_pts_attr_simple_evid_final_create_from_data(chunk_t data)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -384,8 +374,7 @@ pa_tnc_attr_t *tcg_pts_attr_simple_evid_final_create_from_data(chunk_t data)
 			.get_evid_sig = _get_evid_sig,
 			.set_evid_sig = _set_evid_sig,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_SIMPLE_EVID_FINAL,
+		.type = { PEN_TCG, TCG_PTS_SIMPLE_EVID_FINAL },
 		.value = chunk_clone(data),
 		.ref = 1,
 	);
diff --git a/src/libpts/tcg/tcg_pts_attr_tpm_version_info.c b/src/libpts/tcg/tcg_pts_attr_tpm_version_info.c
index 944a12cc9..8d1e78f18 100644
--- a/src/libpts/tcg/tcg_pts_attr_tpm_version_info.c
+++ b/src/libpts/tcg/tcg_pts_attr_tpm_version_info.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -49,14 +49,9 @@ struct private_tcg_pts_attr_tpm_version_info_t {
 	tcg_pts_attr_tpm_version_info_t public;
 
 	/**
-	 * Attribute vendor ID
+	 * Vendor-specific attribute type
 	 */
-	pen_t vendor_id;
-
-	/**
-	 * Attribute type
-	 */
-	u_int32_t type;
+	pen_type_t type;
 
 	/**
 	 * Attribute value
@@ -79,13 +74,7 @@ struct private_tcg_pts_attr_tpm_version_info_t {
 	refcount_t ref;
 };
 
-METHOD(pa_tnc_attr_t, get_vendor_id, pen_t,
-	private_tcg_pts_attr_tpm_version_info_t *this)
-{
-	return this->vendor_id;
-}
-
-METHOD(pa_tnc_attr_t, get_type, u_int32_t,
+METHOD(pa_tnc_attr_t, get_type, pen_type_t,
 	private_tcg_pts_attr_tpm_version_info_t *this)
 {
 	return this->type;
@@ -114,6 +103,10 @@ METHOD(pa_tnc_attr_t, build, void,
 {
 	bio_writer_t *writer;
 
+	if (this->value.ptr)
+	{
+		return;
+	}
 	writer = bio_writer_create(PTS_TPM_VER_INFO_SIZE);
 	writer->write_data(writer, this->tpm_version_info);
 
@@ -181,7 +174,6 @@ pa_tnc_attr_t *tcg_pts_attr_tpm_version_info_create(chunk_t tpm_version_info)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -194,8 +186,7 @@ pa_tnc_attr_t *tcg_pts_attr_tpm_version_info_create(chunk_t tpm_version_info)
 			.get_tpm_version_info = _get_tpm_version_info,
 			.set_tpm_version_info = _set_tpm_version_info,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_TPM_VERSION_INFO,
+		.type = { PEN_TCG, TCG_PTS_TPM_VERSION_INFO },
 		.tpm_version_info = chunk_clone(tpm_version_info),
 		.ref = 1,
 	);
@@ -214,7 +205,6 @@ pa_tnc_attr_t *tcg_pts_attr_tpm_version_info_create_from_data(chunk_t data)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -227,8 +217,7 @@ pa_tnc_attr_t *tcg_pts_attr_tpm_version_info_create_from_data(chunk_t data)
 			.get_tpm_version_info = _get_tpm_version_info,
 			.set_tpm_version_info = _set_tpm_version_info,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_TPM_VERSION_INFO,
+		.type = { PEN_TCG, TCG_PTS_TPM_VERSION_INFO },
 		.value = chunk_clone(data),
 		.ref = 1,
 	);
diff --git a/src/libpts/tcg/tcg_pts_attr_unix_file_meta.c b/src/libpts/tcg/tcg_pts_attr_unix_file_meta.c
index a9f4a115d..4f93ee885 100644
--- a/src/libpts/tcg/tcg_pts_attr_unix_file_meta.c
+++ b/src/libpts/tcg/tcg_pts_attr_unix_file_meta.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Sansar Choinyambuu
+ * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
  * HSR Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -80,14 +80,9 @@ struct private_tcg_pts_attr_file_meta_t {
 	tcg_pts_attr_file_meta_t public;
 
 	/**
-	 * Attribute vendor ID
+	 * Vendor-specific attribute type
 	 */
-	pen_t vendor_id;
-
-	/**
-	 * Attribute type
-	 */
-	u_int32_t type;
+	pen_type_t type;
 
 	/**
 	 * Attribute value
@@ -110,13 +105,7 @@ struct private_tcg_pts_attr_file_meta_t {
 	refcount_t ref;
 };
 
-METHOD(pa_tnc_attr_t, get_vendor_id, pen_t,
-	private_tcg_pts_attr_file_meta_t *this)
-{
-	return this->vendor_id;
-}
-
-METHOD(pa_tnc_attr_t, get_type, u_int32_t,
+METHOD(pa_tnc_attr_t, get_type, pen_type_t,
 	private_tcg_pts_attr_file_meta_t *this)
 {
 	return this->type;
@@ -148,6 +137,10 @@ METHOD(pa_tnc_attr_t, build, void,
 	pts_file_metadata_t *entry;
 	u_int64_t number_of_files;
 	
+	if (this->value.ptr)
+	{
+		return;
+	}
 	number_of_files = this->metadata->get_file_count(this->metadata);
 	writer = bio_writer_create(PTS_FILE_META_SIZE);
 
@@ -306,7 +299,6 @@ pa_tnc_attr_t *tcg_pts_attr_unix_file_meta_create(pts_file_meta_t *metadata)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -318,8 +310,7 @@ pa_tnc_attr_t *tcg_pts_attr_unix_file_meta_create(pts_file_meta_t *metadata)
 			},
 			.get_metadata = _get_metadata,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_UNIX_FILE_META,
+		.type = { PEN_TCG, TCG_PTS_UNIX_FILE_META },
 		.metadata = metadata,
 		.ref = 1,
 	);
@@ -338,7 +329,6 @@ pa_tnc_attr_t *tcg_pts_attr_unix_file_meta_create_from_data(chunk_t data)
 	INIT(this,
 		.public = {
 			.pa_tnc_attribute = {
-				.get_vendor_id = _get_vendor_id,
 				.get_type = _get_type,
 				.get_value = _get_value,
 				.get_noskip_flag = _get_noskip_flag,
@@ -350,8 +340,7 @@ pa_tnc_attr_t *tcg_pts_attr_unix_file_meta_create_from_data(chunk_t data)
 			},
 			.get_metadata = _get_metadata,
 		},
-		.vendor_id = PEN_TCG,
-		.type = TCG_PTS_UNIX_FILE_META,
+		.type = { PEN_TCG, TCG_PTS_UNIX_FILE_META },
 		.value = chunk_clone(data),
 		.ref = 1,
 	);