An IoT device verifies each stage of its firmware before running it, beginning with a public key permanently stored in tamper-resistant hardware. Why is that hardware-stored key essential to the design?
Select an answer to reveal the explanation.
Short Explanation
A chain is only as strong as the hook it hangs from. That hardware key is the hook: every signature check after it trusts it without question. If an attacker could swap it, you'd never catch anything further down the line.
Full Explanation
A root of trust is a component that is inherently trusted because it cannot be easily modified, and from which all further trust is derived. In secure boot, a public key or hash anchored in tamper-resistant hardware verifies the signature on the first boot stage; that stage verifies the next, and so on until the operating system and applications are running. Because each check relies on the previous one, the integrity of the entire chain depends on that first key being genuine and immutable. Encrypting firmware protects confidentiality of the code, but secure boot is about verifying authenticity and integrity, and the scenario describes signature verification, not decryption. The hardware key does not remove the vendor's obligation to sign updates; on the contrary, it exists to verify those signatures, and unsigned updates would be rejected. Checking a revocation list at boot is not the role of the root key; many devices boot without network access, and revocation is handled through other update mechanisms. Exam caveat: hardware roots of trust include TPMs, secure elements, and keys fused into processors, and they underpin secure boot, measured boot, and attestation. Operational check: confirm the device rejects firmware with an invalid signature in testing, verify the root key cannot be overwritten through software, and document how the vendor would rotate keys if a signing key were compromised.