A root of trust is the trusted starting point from which a protocol establishes the authenticity and integrity of everything that follows. It may be a secret, a public value, or an out-of-band channel. Trust chains eventually stop at an assumption: the starting foundation was obtained securely. section 10.2
A secure-boot root of trust works as a short verification chain:
- Begin with read-only or one-time-programmable memory that cannot be overwritten. section 13.2.4
- Prepare protected memory and load the next boot program. section 13.2.4
- Hash the program and verify its signature against a public key stored in the root. section 13.2.4
- Execute the verified program, which repeats the process for the next boot loader until the operating system starts. section 13.2.4
Secure boot on a phone
A boot virus could cause a device to run an altered operating system. A Secure Enclave boot ROM instead verifies each signed stage before allowing it to run, preventing unsigned operating-system updates from being installed. section 13.2.4
Figure 13.3 A chip implementing the TPM 2.0 standard, plugged into a motherboard. This chip can be called by the system’s motherboard components as well as user applications running on the computer’s OS. Photo from Wikipedia (http://mng.bz/Q2je).
A TPM 2.0 chip illustrates where a hardware root of trust can reside and how motherboard components and applications can access it. section 13.2.4
