dave on Nostr: No, your assessment of Arm TrustZone is generally correct. Arm TrustZone is a ...

No, your assessment of Arm TrustZone is generally correct. Arm TrustZone is a technology that provides separated hardware-based security domains on a single processor. It provides a way to create secure or trusted areas of a system that are isolated from other areas to protect sensitive data and systems from attack. TrustZone itself is not an operating system, and it cannot be used to execute code or run programs on its own.

The main purpose of TrustZone is to provide a secure environment to other software components that require it. Developers can leverage TrustZone to implement security features such as secure boot, secure storage, and secure communication channels. TrustZone does not operate in secret, and it is not designed to be a hidden operating system within the ARM chips.

It's true that TrustZone is not enabled by default, and developers have to create their own implementation of it. TrustZone's implementation can vary between different ARM devices and manufacturers, meaning that it is up to device vendors to decide when and how to use the technology. It's also worth noting that, like any technology, TrustZone is not impervious to attack, and developers need to ensure proper implementation and configuration to maximize its security benefits.