# Secure boot and the root of trust

At start-up, each piece of software checks the signature of the next one before running it, starting from code that cannot be changed.

Page: https://dharanova.com/learn/secure-boot · Track: Secure · Level: Core · Facts last checked 7 October 2026

Read first: [Microcontroller or microprocessor?](https://dharanova.com/learn/mcu-vs-mpu.md)

Diagram: Chain of trust: unchangeable boot ROM code verifies the first-stage loader using a key fixed in hardware, often a hash fused into one-time-programmable memory; the loader verifies the next stage, and so on. Secure element or TPM, a separate chip or built in: the main processor asks it to use a key and gets a result back, so the private key is never exposed to the operating system. Debug port (JTAG or SWD): left open on a shipped device, someone could read or change its code; ETSI EN 303 645 requires, before shipping, that it be turned off or protected by authentication or access control.

## Key points

1. Secure boot is a chain of trust: immutable boot ROM code verifies the signature of the first-stage loader against a key fixed in hardware (often a hash fused into one-time-programmable memory), and each stage then verifies the next. [1][2]
2. A secure element or TPM stores keys and uses them in a protected environment, so a private key is never exposed to the main operating system. Secure elements are usually separate tamper-resistant chips, though some are built into the processor. A TPM can be a chip, or firmware in a protected mode of the processor. [3][4][5]
3. An open JTAG or SWD port on a shipped device can let someone read or change its code, including its security features. ETSI EN 303 645 requires debug interfaces to be turned off, or protected by authentication or access control, before a product ships. [6]

## Where to go next

- [BLE application-layer authentication with ECDSA certificate chains on ESP32-C3](https://dharanova.com/whitepapers/ble-certificate-authentication.md): a whitepaper from our lab
- [Over-the-air updates](https://dharanova.com/learn/ota-updates.md): Devices need software updates after they ship, and a failed update must not break the device. A/B slots and rollback handle both.
- [Security baselines and the law](https://dharanova.com/learn/iot-security-rules.md): Several countries now have security rules for connected products. The basic requirements are short and specific.

## Sources

1. [Trusted Firmware-A: Trusted Board Boot](https://trustedfirmware-a.readthedocs.io/en/latest/design/trusted-board-boot.html), TrustedFirmware.org
2. [U-Boot: Verified Boot](https://docs.u-boot.org/en/latest/usage/fit/verified-boot.html), U-Boot project
3. [Introduction to Secure Elements](https://globalplatform.org/wp-content/uploads/2018/05/Introduction-to-Secure-Element-15May2018.pdf), GlobalPlatform
4. [Trusted Platform Module (TPM) fundamentals](https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/tpm-fundamentals), Microsoft
5. [TPM 2.0 Library specification](https://trustedcomputinggroup.org/resource/tpm-library-specification/), Trusted Computing Group
6. [ETSI EN 303 645 V3.1.3 (2024-09): Cyber Security for Consumer Internet of Things: Baseline Requirements](https://www.etsi.org/deliver/etsi_en/303600_303699/303645/03.01.03_60/en_303645v030103p.pdf), ETSI