organized in much the same way as application 400 is in fig4 an important difference between kernel extensions and applications however is that kernel extensions are stored in encrypted form such that they can only be decrypted using secure kernel 302 39 s private key which itself is only available when secure kernel 302 is loaded and executed immediately following a secure initialization using the secure initialization hardware public key cryptography makes it possible to update replace or add kernel extensions without compromising secure kernel 302 39 s private key the source manufacturer publisher distributor etc of a kernel extension need only be supplied secure kernel 302 39 s public key which unlike the private key is not a secret in order to encrypt a new kernel extension so that only that copy of secure kernel 302 with its unique private key can decrypt the kernel extension as stated above secure kernel 302 may delegate one or more of its powers responsibilities to a kernel extension secure kernel 302 does this by retaining i e not deleting the sensitive portions of secure kernel 302 needed to perform a particular privileged task when passing control to the kernel extension secure kernel 302 determines which portions to retain by examining the public key used to validate the kernel extension 39 s digital signature secure kernel 302 recognizes a pre defined set of u201c privileged public keys u201d used to sign kernel extensions each privileged public key is associated.