Keeping secrets in your opponent's hands
summary
Builds an Apple Secure Enclave analogue for embedded Linux using a cheap security chip (Attek 608), ARM TrustZone where available, and a chain-of-trust from secure boot into dm-verity and dm-crypt. Demonstrates a power‑latch that makes keys vanish on power loss, desolders a capacitor to force fast forgetting, and integrates with the Nerves ecosystem via nerves_key and NervesHub. Reports hardware attacks that extract keys from similar chips in about one in three devices while destroying others.
AI-written summary · about
chapters (14)
- 0:00Hardware security challenges
- 4:48Chip capabilities and limits
- 10:14Cryptographic primitives
- 13:20Client-server vs embedded security
- 15:23Secure boot and trust chain
- 18:14Secure Enclave and TrustZone
- 22:30Raspberry Pi security gaps
- 24:14Hardware Security Modules
- 26:41ATECC608 vulnerabilities
- 30:34Bonding chip to device
- 33:23Persistent latch for power loss
- 35:50Nerves project security
- 37:17Software security beyond hardware
- 39:49Q&A
related talks
38mOne Ring -3 To Secure Them All: Computing with Hardware Enclaves
45mNavigating Security Tradeoffs in Embedded Linux Systems
43mShhh - Stop Sharing Secrets, a Secure Mindset for Embedded Development
53mSecure Embedded Linux Product - A Success Story
48mBetrusted: Better Security Through Physical Partitioning
34mAuthenticated and Encrypted Storage on Embedded Linux
24mSecurity through Transparency: Tales from the RP2350 Hacking Challenge
23mHardware security for critical national infrastructure