Which option best describes the secure boot components typically involved in a mission computer?

Which option best describes the secure boot components typically involved in a mission computer?

• A. Chain-of-trust with signed bootloader and kernel, hardware root of trust, secure storage for keys, and measured boot.
• B. Hardware root of trust.
• C. Measured boot.
• D. Non-secure boot.

Answer: (C)

Secure boot is about building a chain of trust that starts with a hardware root of trust and continues through the bootloader and kernel with verified signatures, so only trusted code runs. The hardware root of trust provides the secure anchor that protects keys and cryptographic operations. Secure storage for keys keeps the signing keys safe from extraction or tampering, which is essential for maintaining authenticity of the boot components. Measured boot contributes by recording cryptographic measurements (hashes) of each component as they load, enabling later attestation of what was booted. Taken together, these elements describe how secure boot enforces a trusted boot path and proves its state. Relying on measured boot alone doesn’t enforce trust, while focusing on only hardware root of trust or describing non-secure boot misses crucial parts of the trust chain and verification process.

Secure boot is about building a chain of trust that starts with a hardware root of trust and continues through the bootloader and kernel with verified signatures, so only trusted code runs. The hardware root of trust provides the secure anchor that protects keys and cryptographic operations. Secure storage for keys keeps the signing keys safe from extraction or tampering, which is essential for maintaining authenticity of the boot components. Measured boot contributes by recording cryptographic measurements (hashes) of each component as they load, enabling later attestation of what was booted. Taken together, these elements describe how secure boot enforces a trusted boot path and proves its state. Relying on measured boot alone doesn’t enforce trust, while focusing on only hardware root of trust or describing non-secure boot misses crucial parts of the trust chain and verification process.