The bootloader can typically not be updated/changed and is therefore referred to as an Immutable Bootloader (see note). When the immutable bootloader is programmed onto the chip by a trusted party, the immutable bootloader is considered to be trusted forever, as we know it can not be changed. In security terminology, this is known as a Root of Trust.

Now, the trusted immutable bootloader can be used to verify the application, using public-key cryptography. There are a lot of resources on public-key cryptography on the internet, so if you have never heard about this before, we suggest you look it up (specifically digital signatures).

Digital signatures are used to verify the application. To explain briefly how this works:

• The developer has a private key, which should not be shared with anyone and should be kept secret.
• A public key is generated from the private key.
• The public key is embedded into the bootloader code.
• The application firmware is signed using the private key.
• The bootloader can match the public key with the signature, to verify that the application firmware is signed by the private key. This guarantees that the application firmware also comes from the developer, as only the developer has the key.

With this signature verification, we know only our signed applications can be run on the chip.

From the image above: In the left picture, the verification is successful as the bootloader is able to find the signature (red dot), In the right image, the bootloader can not find the signature (empty magnification glass), it will skip step 2 and not run the application.