rootoftrust

Root of trust, often abbreviated RoT or simply "root of trust," refers to a defined set of hardware, firmware, and software components that are assumed to be secure and are used to establish trust in a computing platform. It provides the foundation for security properties such as integrity, confidentiality, and trusted communication, enabling higher-level services to rely on secure operations.

Hardware RoT components are typically protected by tamper resistance. A RoT may be realized as a trusted platform module (TPM), a secure element, a hardware security module (HSM), or embedded fuse-based roots. The key feature is safeguarding cryptographic keys and secrets from the main processor and untrusted software.

The RoT seeds a chain of trust that begins at boot and extends through the software stack. In a trusted boot, each stage verifies the next before handing control, and measurements of code and configuration are recorded. Remote attestation can prove to a verifier that the device remains in a known, trusted state.

Provisioning and lifecycle management are critical. Keys and certificates are generated or provisioned securely, stored in protected hardware, and arranged in a hierarchy. Secure update mechanisms, key rotation, and revocation help preserve trust over time against evolving threats.

RoT concepts appear in many devices, from personal computers with TPMs to mobile secure enclaves and IoT or automotive systems. Related technologies include TPM, secure boot, trusted execution environments, and attestation protocols. The quality of trust depends on hardware design, secure provisioning, and robust supply-chain practices.