diff --git a/common/fake_hardware.h b/common/fake_hardware.h
index 021d891..68fdd5b 100644
--- a/common/fake_hardware.h
+++ b/common/fake_hardware.h
@@ -37,6 +37,9 @@
   // Default value for crossystem tpm_kernver.
   static const int kMinKernelKeyVersion = 3;
 
+  // Default value for crossystem tpm_fwver.
+  static const int kMinFirmwareKeyVersion = 13;
+
   // Default value for crossystem max_kernel_rollforward. This value is the
   // default for consumer devices and effectively means "unlimited rollforward
   // is allowed", which is the same as the behavior prior to implementing
@@ -72,6 +75,10 @@
     return min_kernel_key_version_;
   }
 
+  int GetMinFirmwareKeyVersion() const override {
+    return min_firmware_key_version_;
+  }
+
   bool SetMaxKernelKeyRollforward(int max_kernel_rollforward) override {
     max_kernel_rollforward_ = max_kernel_rollforward;
     return true;
@@ -151,6 +158,10 @@
     min_kernel_key_version_ = min_kernel_key_version;
   }
 
+  void SetMinFirmwareKeyVersion(int min_firmware_key_version) {
+    min_firmware_key_version_ = min_firmware_key_version;
+  }
+
   void SetPowerwashCount(int powerwash_count) {
     powerwash_count_ = powerwash_count;
   }
@@ -170,6 +181,7 @@
   std::string firmware_version_{"Fake Firmware v1.0.1"};
   std::string ec_version_{"Fake EC v1.0a"};
   int min_kernel_key_version_{kMinKernelKeyVersion};
+  int min_firmware_key_version_{kMinFirmwareKeyVersion};
   int max_kernel_rollforward_{kMaxKernelRollforward};
   int powerwash_count_{kPowerwashCountNotSet};
   bool powerwash_scheduled_{false};
diff --git a/common/hardware_interface.h b/common/hardware_interface.h
index 9f3f618..4946b91 100644
--- a/common/hardware_interface.h
+++ b/common/hardware_interface.h
@@ -73,6 +73,11 @@
   // -1 on error, or if not running on Chrome OS.
   virtual int GetMinKernelKeyVersion() const = 0;
 
+  // Returns the minimum firmware key version that verified boot on Chrome OS
+  // will allow to boot. This is the value of crossystem tpm_fwver. Returns
+  // -1 on error, or if not running on Chrome OS.
+  virtual int GetMinFirmwareKeyVersion() const = 0;
+
   // Sets the maximum kernel key version that verified boot should roll
   // forward to. This is the value of crossystem max_kernel_rollforward.
   // Returns false if the value cannot be set, or if not running on Chrome OS.
diff --git a/common/mock_hardware.h b/common/mock_hardware.h
index 03ebfdb..fcbb0d5 100644
--- a/common/mock_hardware.h
+++ b/common/mock_hardware.h
@@ -57,6 +57,9 @@
     ON_CALL(*this, GetMinKernelKeyVersion())
         .WillByDefault(
             testing::Invoke(&fake_, &FakeHardware::GetMinKernelKeyVersion));
+    ON_CALL(*this, GetMinFirmwareKeyVersion())
+        .WillByDefault(
+            testing::Invoke(&fake_, &FakeHardware::GetMinFirmwareKeyVersion));
     ON_CALL(*this, SetMaxKernelKeyRollforward())
         .WillByDefault(
             testing::Invoke(&fake_, &FakeHardware::SetMaxKernelKeyRollforward));
@@ -88,6 +91,7 @@
   MOCK_CONST_METHOD0(GetFirmwareVersion, std::string());
   MOCK_CONST_METHOD0(GetECVersion, std::string());
   MOCK_CONST_METHOD0(GetMinKernelKeyVersion, int());
+  MOCK_CONST_METHOD0(GetMinFirmwareKeyVersion, int());
   MOCK_CONST_METHOD1(SetMaxKernelKeyRollforward,
                      bool(int max_kernel_rollforward));
   MOCK_CONST_METHOD0(GetPowerwashCount, int());