I am quite new to cryptography and security related stuff. We are working on a new project with Embedded Linux on the BeagleBone Black. We wish to implement a full root of trust during boot up using an external TPM, and also implement a solution for secure OTA updates.
From a high-level point of view, I understand that the TPM can store hashes of the trusted bootloader and kernel and therefore compares these on boot-up to verify that the software which is booting is actually what we intend to boot.
My confusion now is what happens when we do an OTA update with a new firmware image and we start to boot it? How does the TPM know to store and compare the new hash / hashes instead of the previous? Thanks