4

I am looking for a way to perform symmetric and/or asymmetric encryption on a separate chip (HSM) which can securely store encryption keys (write them to secure memory, perform encryption/decryption with them, but not ever be able to read them out.)

I know that there are chips out there from OEMs like Atmel which can do AES, ECDSA, etc, but I don't know where to begin with communicating with them. I understand that there are I²C options which might be the correct approach, but I have been unable to find a specific example of how this might be done.

If I want to push a request to a hardware chip like these and ask it to perform an operation, what might the best approach be? At a minimum I would like to submit a packet of data and ask the question "was this encrypted with a key stored in the chip?" Either symmetric or asymmetric.

An example of this would be using a Yubikey (which has a write-only AES key) plugged into the Raspberry pi's USB port, and routing it through the GPIO to the encryption chip, where a matching AES key would be stored, have the chip decrypt the one time password, and send back the result. With that example, my objective is to expose the pi's USB port publicly, but be certain nothing could hack the system through the USB port to retrieve the key, even if they were capable of compromising the OS.

Any ideas on where to start with a project like this? The software on the pi isn't a concern for me, just how to bring a security chip into communication with the pi.

2

Actually Infineon Technologies (my employer) does even have a TPM daughterboard for the RPI2/3 and an application note how to set some stuff up. See: https://www.infineon.com/cms/de/product/security-and-smart-card-solutions/optiga-embedded-security-solutions/optiga-tpm/channel.html?channel=5546d462503812bb015066de24291768#ispnTab3

  • Infineon SLB 9645 / SLB 9670 TPM 1.2 with Embedded Platform Integration on a Raspberry Pi® 2
  • Infineon SLB 9670 TPM 2.0 on a Raspberry Pi 3 EN

Infineon's sub-company Hitex now has them the eval boards for RPI in stock or as a lower cost alternative the german Raspberry Pi distributor buyzero/pi3g has it's own Infineon SLB9670 TPM SPI board in stock: https://buyzero.de/products/letstrust-hardware-tpm-trusted-platform-module

p.s.: even the drivers are upstream and included in the rpi kernel sources :) (Just have to enable them and add a suitable device tree entry)

Disclaimer: I work for Infineon (and wrote the driver (and am the TPM subsystem maintainer))

1

Take a look at this UPS add on board for Pi

http://www.pimodules.com/

It comes with xtea (firmware yet to be released) which I think will do exactly what you want.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.