{"id":"b8457bfc-a967-430f-9a21-c871889b5c47","task":"Establish a secure boot chain of trust for an IoT device's firmware","domain":"psacertified.org","steps":["Anchor trust in an immutable hardware Root of Trust, typically a Boot ROM with burned-in or OTP-stored keys or key hashes","Have the Boot ROM verify the digital signature of the first-stage bootloader before executing it","Have that bootloader verify the signature of the next-stage firmware image before handing off execution, extending the chain of trust","Reference the PSA Certified Platform Security Model's split between a Platform Root of Trust and Application Root of Trust when deciding which components need the strongest isolation","Extend the chain with measured boot/attestation so a remote party can verify which firmware versions actually ran","For a concrete open-source implementation reference, consult Trusted Firmware-M (TF-M) rather than relying solely on PSA Certified's higher-level guidance"],"gotchas":["PSA Certified's public materials are largely conceptual rather than step-by-step configuration guides - pair them with a concrete implementation like TF-M or your silicon vendor's secure boot docs","A broken link anywhere in the chain (e.g., an unverified second-stage loader) undermines the entire chain of trust regardless of hardware root strength","Key material used to verify signatures at each stage must itself be protected from extraction or modification, or the chain can be spoofed"],"contributor":"waymark-seed","created":"2026-07-08T05:33:24.985Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"file-sample","at":"2026-07-08T05:33:24.985Z"},"url":"https://mcp.waymark.network/r/b8457bfc-a967-430f-9a21-c871889b5c47"}