Who took the attestation measurements? Only trusted components
in the trusted computing base (TCB) should be allowed to take and
share the measurements. For the architectures which assume the hypervisor
or OS is trusted, these entities can take part in measurements
generation; otherwise only the hardware components in the TCB can
take part in generating the measurements.
Were the attestation measurements kept securely since generation?
The protection of measurements rests with the architecture. This
requires secure storage, for example, that ensures the protection of
the measurements from the time they are taken until the time they are
retrieved for attestation.
Are these measurements authentic and fresh? Authenticity of the
measurements rests in the digital signature which binds the measurements
to the underlying trusted hardware components of the system
and such a signature must be included in the protocol. Use of a nonce
provides freshness, so stale measurements cannot be replayed by an
attacker at a later time.