Join the early list

Secure boot and the root of trust

At start-up, each piece of software checks the signature of the next one before running it, starting from code that cannot be changed.

Core

Read firstMicrocontroller or microprocessor?
Secure boot, key storage and the debug port Immutable boot ROM code checks the first-stage loader against a key fixed in hardware, and each stage then verifies the next. A secure element or TPM uses keys without exposing them to the operating system. ETSI EN 303 645 requires the debug port to be off or protected before the product ships. Chain of trust Boot ROM immutable code verifies First-stage loader verifies Next stage verifies and so on Key fixed in hardware often a hash fused into one-time-programmable memory Each stage checks the signature of the next, starting from code that cannot be changed. Secure element or TPM Stores keys and uses them in a protected environment Secure element: usually a tamper-resistant chip (or built in) TPM: a chip, or firmware in a protected mode of the processor Main processor and operating system Secure element or TPM private key use a key result separate chip, or built in The private key is never exposed to the main operating system. Debug port JTAG or SWD Left open on a shipped device someone could read or change its code and security features ETSI EN 303 645 requires, before shipping: turned off, or protected by authentication or access control
Each boot stage verifies the next, starting from unchangeable ROM code and a key fixed in hardware; a secure element or TPM guards keys, and debug ports are locked before shipping.

Key points

  1. Secure boot is a chain of trust: immutable boot ROM code verifies the signature of the first-stage loader against a key fixed in hardware (often a hash fused into one-time-programmable memory), and each stage then verifies the next.12
  2. A secure element or TPM stores keys and uses them in a protected environment, so a private key is never exposed to the main operating system. Secure elements are usually separate tamper-resistant chips, though some are built into the processor. A TPM can be a chip, or firmware in a protected mode of the processor.345
  3. An open JTAG or SWD port on a shipped device can let someone read or change its code, including its security features. ETSI EN 303 645 requires debug interfaces to be turned off, or protected by authentication or access control, before a product ships.6

Where to go next

Sources

  1. Trusted Firmware-A: Trusted Board Boot · TrustedFirmware.org · Project docs
  2. U-Boot: Verified Boot · U-Boot project · Project docs
  3. Introduction to Secure Elements · GlobalPlatform · Reference
  4. Trusted Platform Module (TPM) fundamentals · Microsoft · Vendor page
  5. TPM 2.0 Library specification · Trusted Computing Group · Standard
  6. ETSI EN 303 645 V3.1.3 (2024-09): Cyber Security for Consumer Internet of Things: Baseline Requirements · ETSI · Standard