Assumed-Immutable Data is Stored in Writable Memory

Core security features like secure boot, code authentication, and device attestation rely on trusted assets such as initial boot code, cryptographic keys, and reference integrity measurements. These assets must be stored in truly immutable hardware like read-only memory (ROM), fused circuits, or one-time programmable (OTP) memory. This hardware-level protection creates a reliable root of trust, ensuring these critical components cannot be tampered with. If these assumed-to-be-permanent assets are stored in rewritable memory like flash or EEPROM, the entire security model collapses. An attacker with sufficient access could modify the bootloader, replace authentication keys, or alter device identity, bypassing security checks and compromising the system. The integrity of the security chain is only as strong as the immutability of its foundational components.