BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.1.2 Root of Trust for Update (RTU) and Chain of Trust for Update (CTU)

NIST platform security: roots of trust, firmware and secure enclaves SP 800-193
All changes in this version
first version loaded 4 Firmware Security Guidelines for Platform Devices part of 4.1

Title

Root of Trust for Update (RTU) and Chain of Trust for Update (CTU)

Control

1) Each platform device with mutable firmware shall rely on either a Root of Trust for Update (RTU), or a Chain of Trust for Update (CTU) which is anchored by an RTU, to authenticate firmware updates. 2) If the RTU or CTU is mutable, then the RTU or CTU elements shall be updated using an authenticated update mechanism, absent physical intervention through a secure local update. During such an update, the RTU or CTU shall always be operational or recoverable upon a subsequent reboot even in the event of an unexpected, catastrophic event (e.g., power loss in the middle of a flash write operation). 3) The RTU or CTU shall include a key store and an approved digital signature algorithm implementation from FIPS 186-4 [7] to verify the digital signature of firmware update images. 4) If the key store is updateable, then the key store shall be updated using an authenticated update mechanism, absent unambiguous physical presence through a secure local update. Note: Updatable key stores provide a means to recover from compromise of the signing key, but may make the device’s key store more vulnerable to tampering. Implementers that use a non-updatable key store are encouraged to design mitigations and recovery mechanisms that address the threat of potential disclosure of the firmware signing keys.

5) An authenticated update mechanism anchored in the RTU shall be the exclusive means for updating device firmware, absent unambiguous physical presence through a secure local update.