A root of trust is an initially trusted hardware- or software-protected component that anchors later security decisions. In code-integrity systems, protected firmware and manufacturer public keys validate each stage before it executes and hands off control. section 9.2.2
A practical trust chain typically works as follows:
- Protect firmware and a trusted public key, or its hash, directly in hardware. section 9.2.2
- Require every executable component to carry a valid digital signature from an authorized private key. section 9.2.2
- Verify the signature before launching code and pass trust to the next stage. section 9.2.2
The PlayStation 3 failure
Sony burned a public key into the console as a hardware root of trust and required valid ECDSA signatures. USB glitching initially bypassed running checks; later, flawed randomness exposed the private signing key, allowing forged signatures. Because the public key was not updateable on existing consoles, those systems could not be repaired through trust-key replacement. section 9.5
Figure 9.5 Digital signatures can be used to establish trust in a piece of code before executing it.
Trace how digital signatures establish trust in code before execution. section 9.2.2
