Root of Trust

In cybersecurity, a Root of Trust (RoT) is an inherently trusted hardware, firmware, or software component that performs critical security functions. A Root of Trust provides a trusted foundation on which other security mechanisms can rely, including secure boot, cryptographic operations, integrity verification, and device authentication.

What is Root of Trust in Cybersecurity?

A Root of Trust, or RoT, is commonly used as the starting point in a chain of trust. Because the Root of Trust is trusted by design, other components can rely on it to verify software, protect cryptographic keys, validate system integrity, or establish trust in a device. Roots of trust are often implemented in protected hardware or firmware, although trusted software components can also perform root-of-trust functions.

In authentication systems, the term Root of Trust may also be used in a more application-specific sense for an independently verified identity channel or credential that can be used to establish or recover trust. For example, a verified phone number or email address may be used as a trusted fallback if another authentication method cannot successfully verify the user.

TypingDNA Verify 2FA uses Root of Trust in this authentication context for its Standard integration. Before typing biometrics are used for verification, the organization verifies the user's phone number or email address as the Root of Trust. If typing verification fails or additional verification is required, Verify 2FA can fall back to an OTP sent through that trusted channel.

For example, if a user normally authenticates by typing the 4 words displayed by TypingDNA Verify 2FA but cannot be recognized because of a significant change in the way they type, the verified phone number or email can be used as the fallback Root of Trust. This provides another way to verify the user's identity without treating the typing biometric result as the only source of trust.

Learn more about how TypingDNA Verify 2FA uses typing biometrics and Root of Trust in authentication.