I am looking for a way to perform symmetric and/or asymmetric encryption on a separate chip (HSM) which can securely store encryption keys (write them to secure memory, perform encryption/decryption with them, but not ever be able to read them out.)
I know that there are chips out there from OEMs like Atmel which can do AES, ECDSA, etc, but I don't know where to begin with communicating with them. I understand that there are I²C options which might be the correct approach, but I have been unable to find a specific example of how this might be done.
If I want to push a request to a hardware chip like these and ask it to perform an operation, what might the best approach be? At a minimum I would like to submit a packet of data and ask the question "was this encrypted with a key stored in the chip?" Either symmetric or asymmetric.
An example of this would be using a Yubikey (which has a write-only AES key) plugged into the Raspberry pi's USB port, and routing it through the GPIO to the encryption chip, where a matching AES key would be stored, have the chip decrypt the one time password, and send back the result. With that example, my objective is to expose the pi's USB port publicly, but be certain nothing could hack the system through the USB port to retrieve the key, even if they were capable of compromising the OS.
Any ideas on where to start with a project like this? The software on the pi isn't a concern for me, just how to bring a security chip into communication with the pi.