I am quite new to cryptography and security related stuff. We are working on a new project with Embedded Linux on the BeagleBone Black. We wish to implement a full root of trust during boot up using an external TPM, and also implement a solution for secure OTA updates.

From a high-level point of view, I understand that the TPM can store hashes of the trusted bootloader and kernel and therefore compares these on boot-up to verify that the software which is booting is actually what we intend to boot.

My confusion now is what happens when we do an OTA update with a new firmware image and we start to boot it? How does the TPM know to store and compare the new hash / hashes instead of the previous? Thanks

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.