Every security chain has to start somewhere. The root of trust is the part that cannot be verified by anything else and is therefore made tamper-resistant: a boot ROM burned into the silicon, one-time-programmable fuses holding a public key hash, and a protected store for the device’s own private keys. Secure boot and attestation both begin here.
Implementations range from features inside a microcontroller to a dedicated secure element or TPM on the board. The dedicated chip costs more and adds integration work but isolates keys from the main processor, so a bug in application code cannot read them. Regulations and schemes such as PSA Certified increasingly expect a hardware root of trust in connected products.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.