Hardware Security

What is the most suitable thing placed inside the chip as the root of trust for secure boot?

  1. AImmutable ROM boot code and the public key (or its hash) used to verify signatures
  2. BBoot code in flash memory that anyone can rewrite
  3. CThe latest OS downloaded from the internet
Show answer and explanation

Answer: A. Immutable ROM boot code and the public key (or its hash) used to verify signatures

The chain of trust assumes the component performing the first check is correct. So the root of trust is boot code in mask ROM, written at manufacture and unchangeable afterward, together with the public key used to verify signatures (often stored as a hash in eFuses to save space). If this could be rewritten, every later check would be meaningless.

  • A. Correct. The starting point must be unchangeable.
  • B. If the root can be rewritten, every check can be faked.
  • C. The root resides in an unchanging part of the chip.
Practice this topic Back to topic

More Hardware Security questions

  1. What is the advantage of using public-key cryptography to verify software signatures in secure boot?
  2. In devices with secure boot, why is an anti-rollback mechanism needed?
  3. What is the main role of a TPM (Trusted Platform Module) installed in PCs and similar?
  4. What is the difference between secure boot and measured boot?
  5. Which describes remote attestation?