secure boot
When a computer powers on, it is briefly a blank slate that must load its software in stages: a tiny firmware first, then a bootloader, then the operating system kernel, then everything else. This start-up chain is a tempting target — malware that slips in early, before the OS and its defenses even exist, can hide beneath everything and survive reinstalls. Secure boot is the practice of checking, at each step of that chain, that the next piece of software is genuine and unmodified before handing control to it.
It works as a chain of trust built on digital signatures. The very first code to run is a small piece of trusted firmware that the hardware vouches for. Before it loads the bootloader, it verifies the bootloader's cryptographic signature against a public key it holds; only if the signature is valid does it proceed. The bootloader in turn verifies the OS kernel before running it, and so on. Each link checks the next, so a single trusted starting point extends trust up the whole chain. If any stage has been tampered with, its signature fails to verify and boot halts (or falls back) rather than running compromised code. A common variant, measured boot, instead records a hash of each stage into a secure chip (a TPM) so the final state can be checked or attested later.
The honest point is where the chain begins. Secure boot is only as trustworthy as its first link — the initial code and the keys must themselves be protected by hardware that cannot be quietly altered, which is the job of the hardware root of trust (see root-of-trust). If an attacker could replace the first piece or swap the trusted keys, the whole chain would faithfully verify their malware. Secure boot also is about authenticity, not secrecy: it ensures you are running the software you expect, but it does not by itself encrypt your data or stop attacks once the system is up and running. And it has a real-world tension — locking the boot chain to a vendor's keys can also lock out the owner from installing other operating systems, which is a genuine debate, not a pure win.
At power-on, trusted firmware computes the signature check on the bootloader. Suppose malware has replaced the bootloader: its signature no longer matches the vendor's public key, the check fails, and the machine refuses to run it — stopping the infection before the OS even loads. An untampered bootloader passes, then itself verifies the kernel's signature before launching it, extending the chain.
Each stage verifies the next by signature; a tampered link fails to verify and the chain stops there.
Secure boot checks authenticity, not secrecy, and is only as strong as its first link — without a hardware root of trust protecting the initial code and keys, an attacker who replaces them gets their malware verified for free.