hardware security

**Hardware Security** — built-in chip features that establish trust, protect secrets, and ensure secure operation, providing a foundation that software security cannot achieve alone. **Hardware Root of Trust** - Immutable security anchor in silicon (not software — can't be patched or hacked after fabrication) - Stores: Chip-unique keys, secure boot public key hash, security configuration fuses - Examples: ARM TrustZone, Apple Secure Enclave, Google Titan, Intel SGX **Secure Boot** 1. ROM bootloader (in silicon) verifies first-stage bootloader signature 2. Each stage verifies the next (chain of trust) 3. If any signature fails → boot halts (prevents running tampered firmware) 4. Root public key burned into OTP (one-time programmable) fuses **Key Security Features** - **Crypto accelerators**: AES, SHA, RSA/ECC hardware for fast encryption without CPU overhead - **True RNG (TRNG)**: Physical random number generator (thermal noise, jitter) — essential for key generation - **PUF (Physical Unclonable Function)**: Chip-unique "fingerprint" derived from manufacturing variations. Generates keys without storage - **Tamper detection**: Sensors for voltage glitching, clock manipulation, temperature extremes, probing - **Secure key storage**: Keys in protected memory, erased on tamper detection **Why Hardware Security Matters** - Software can be patched/hacked; hardware provides immutable trust - Supply chain protection: Verify chip authenticity - DRM, payment, identity — all depend on hardware security **Hardware security** is no longer optional — every modern SoC includes a security subsystem.