Root of trust
A root of trust is an initially trusted hardware- or software-protected foundation from which the authenticity, integrity, and trustworthiness of other components are established.
Real-World Cryptography
A root of trust is a trusted hardware or software foundation from which the authenticity and integrity of subsequent system components are established.
- How it is used
- Anchors cryptographic protocols and secure-boot chains in a trusted starting value, device, or communication channel.
- How deep it goes
- Defines trust chaining and shows ROM-based signature verification, while treating the initial secure acquisition of trust as an assumption.
- Examples
- Uses browser certificate chains, Apple Secure Enclave boot ROMs, signed boot loaders, and TPM 2.0 hardware.
- What you can do after
- Evaluate secure-boot designs by locating their immutable starting point and tracing signature checks through later system components.
Hacking Cryptography
A root of trust is an initially trusted hardware- or software-protected component from which subsequent trust decisions are established.
- How it is used
- Anchors authorized-code execution by validating each stage before handing over control.
- How deep it goes
- Explains protected keys, signature verification, execution handoff, key leakage, bypass attacks, and irreversible deployment consequences.
- Examples
- Uses phone app authorization and the PlayStation 3 signing-key compromise to illustrate normal operation and failure.
- What you can do after
- Evaluate code-signing architectures by tracing trust anchors, signature checks, bypasses, key compromise, and update limitations.
Related concepts
- public keyhas part · A public key is the openly distributable component of an asymmetric cryptographic key pair, used for encryption, authentication, or signature verification.
- digital signatureuses · A digital signature is cryptographic data generated with a private key and verified with corresponding public information to authenticate data or its signer and detect alteration.
- threat modelconfigured by · A threat model is a structured analysis or representation of a system’s relevant threats, adversaries, assets, attack paths, assumptions, and possible mitigations.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.