Chain of trust
eBoot's chain of trust starts with an immutable ROM stage 0 that contains the root-of-trust public key baked into OTP fuses at manufacturing. Stage 0 verifies stage 1 (the eBoot main binary) using ECDSA-P256. Stage 1 verifies the EoS kernel image and the app manifest. No stage executes unless the previous stage's signature is valid.
Stage progression
Stage 0 (ROM, 4 KB) → Stage 1 (eBoot main, 48 KB) → Stage 2 (EoS kernel, variable) → Stage 3 (app manifest verification). Each stage measures the next stage's hash into a TPM PCR register (or a software PCR on devices without hardware TPM). The final PCR chain is the device's attestation quote.
Anti-rollback counters
Each signed image contains a monotonic version counter stored in OTP. eBoot refuses to boot any image with a counter value lower than the current OTP value. This prevents downgrade attacks where an attacker flashes an older, vulnerable firmware version. Counter increments are irreversible.
Runtime attestation
The eAI model loader calls eBoot's attestation API to verify the PCR chain before loading any ML model. This ensures that a model only executes on a device that booted a known-good firmware stack. Compromised firmware cannot load production models, limiting the blast radius of a kernel exploit.