Secure bootloader

[simgei]

Does CI+ require that we have secure bootloader? If so, is it sufficient to do the first authenticity check in the bootloader? That is, is it acceptable to not check the integrity of the bootloader itself.

[Daihj]

You as the licensee needs to complete the robustness checklist and declare that you product is implemented to meet the CIplus specification, compliance and robustness rules. So you need to be happy with you have implement your product to answer questions 1.11, 1.12, 3.1, 3.2 and 3.3 to ensure at it adequately secure your product.