pico-hsm

dearsky/pico-hsm

Fork 0

RSS Feed

v3.0 1e39558fbc

Compare
Version 3.0 Stable

polhenarejos released this 2022-10-10 06:40:00 +08:00 | 650 commits to master since this release
This is a major release.

New tool: pico-hsm-tool.py

It initializes the Pico HSM device and manages multiple options:
- First time of usage, the device must be initialized with this tool to upload the signed device certificate, attestated by an external PKI.
- It performs a report to attestate any key of the device, imported or generated inside.
- It sets and gets the datetime for Real Time Clock operations.
- It allows to modify dynamic options, like enable/disable press-to-confirm button or internal key usage counter for every key.
Internal security refactoring

Previously, the device used the PIN to encrypt safely the stored private and secret keys. However, with the addition of PKA, which does not use PIN, the internal keys were vulnerable, as they were not encrypted with a random passphrase. To solve it, a new method is added.
When the device is initialized with pico-hsm-tool, a unique device certificate is uploaded based on an internal device key (key id 0). This initial key is used to attestate the rest of the keys generated by the user and all of them are encrypted safely with a PIN provided during the initialization.
After this first initialization, the device can also be reinitialized to enable other advanced features, such as PKA.

XKEK

XKEK is a new way to exchange secret and private keys between two Pico HSM devices, in a more sophisticated and secure way. Previously, with DKEK, the keys were exported and encrypted with a secret, shared between all the participations. However, it may break the security is the secret is compromised.

With XKEK, the Pico HSM creates a secure zone (named key domain), where a certificate from a specific Pico HSM device is imported. Then, all keys generated and exported from/to this domain are tied to these Pico HSM devices. These keys cannot leave the domain without creating another domain. Definitively XKEK adds a more robust and secure way to exchange keys.

MKEK

A Master Key Encryption Key (MKEK) is added to the device. This MKEK is generated the first time is initialized and is encrypted with a PIN. MKEK is used to encrypt all generated keys, keeping them safe from unauthorized memory dumps. Though a Pico HSM is an open hardware platform that can be examined by an attacker and dump its flash memory, all keys are encrypted with the MKEK, which is in turn encrypted with PIN.

Other enhancements:
- Upgraded to Pico SDK 1.4
- Added ECDH algorithms for XKEK
- Added key usage counter to link a usage counter for every generated key. It can be used to audit a particular key.
- Using mbedtls_zeroize to zeroing memory zones.
- Device key uses SECP256R1 key.
- Removed 3DES support as it is considered insecure.
- Added a persistent memory zone, which survives after multiple reinitializations.
- Upgraded to Mbedtls 3.2.1
Bug fixes:
- CVC are self-signed (chr=car) by default.
- Fix DKEK status report on multiple boots.
- Fix DKEK deletion.
- Fix wrap/unwrap keys with specific allowed algorithms.
- Fix VID/PID patcher.
- Fix session with SO-PIN.
- Fix changing SO-PIN.
Downloads
- pico_hsm_adafruit_feather_rp2040-3.0.uf2
  433 KiB
  2022-10-10 06:47:01 +08:00
- pico_hsm_adafruit_itsybitsy_rp2040-3.0.uf2
  433 KiB
  2022-10-10 06:47:02 +08:00
- pico_hsm_adafruit_kb2040-3.0.uf2
  432 KiB
  2022-10-10 06:47:03 +08:00
- pico_hsm_adafruit_macropad_rp2040-3.0.uf2
  432 KiB
  2022-10-10 06:47:04 +08:00
- pico_hsm_adafruit_qtpy_rp2040-3.0.uf2
  432 KiB
  2022-10-10 06:47:04 +08:00
- pico_hsm_adafruit_trinkey_qt2040-3.0.uf2
  431 KiB
  2022-10-10 06:47:05 +08:00
- pico_hsm_arduino_nano_rp2040_connect-3.0.uf2
  433 KiB
  2022-10-10 06:47:05 +08:00
- pico_hsm_datanoisetv_rp2040_dsp-3.0.uf2
  433 KiB
  2022-10-10 06:47:06 +08:00
- pico_hsm_eetree_gamekit_rp2040-3.0.uf2
  432 KiB
  2022-10-10 06:47:07 +08:00
- pico_hsm_garatronic_pybstick26_rp2040-3.0.uf2
  433 KiB
  2022-10-10 06:47:08 +08:00
- pico_hsm_melopero_shake_rp2040-3.0.uf2
  433 KiB
  2022-10-10 06:47:09 +08:00
- pico_hsm_pico_w-3.0.uf2
  432 KiB
  2022-10-10 06:47:09 +08:00
- pico_hsm_pico-3.0.uf2
  436 KiB
  2022-10-10 06:47:10 +08:00
- pico_hsm_pimoroni_badger2040-3.0.uf2
  433 KiB
  2022-10-10 06:47:11 +08:00
- pico_hsm_pimoroni_interstate75-3.0.uf2
  432 KiB
  2022-10-10 06:47:12 +08:00
- pico_hsm_pimoroni_keybow2040-3.0.uf2
  432 KiB
  2022-10-10 06:47:12 +08:00
- pico_hsm_pimoroni_motor2040-3.0.uf2
  432 KiB
  2022-10-10 06:47:13 +08:00
- pico_hsm_pimoroni_pga2040-3.0.uf2
  432 KiB
  2022-10-10 06:47:13 +08:00
- pico_hsm_pimoroni_picolipo_16mb-3.0.uf2
  433 KiB
  2022-10-10 06:47:15 +08:00
- pico_hsm_pimoroni_picolipo_4mb-3.0.uf2
  433 KiB
  2022-10-10 06:47:14 +08:00
- pico_hsm_pimoroni_picosystem-3.0.uf2
  433 KiB
  2022-10-10 06:47:15 +08:00
- pico_hsm_pimoroni_plasma2040-3.0.uf2
  432 KiB
  2022-10-10 06:47:16 +08:00
- pico_hsm_pimoroni_servo2040-3.0.uf2
  431 KiB
  2022-10-10 06:47:16 +08:00
- pico_hsm_pimoroni_tiny2040_2mb-3.0.uf2
  433 KiB
  2022-10-10 06:47:17 +08:00
- pico_hsm_pimoroni_tiny2040-3.0.uf2
  433 KiB
  2022-10-10 06:47:18 +08:00
- pico_hsm_seeed_xiao_rp2040-3.0.uf2
  433 KiB
  2022-10-10 06:47:18 +08:00
- pico_hsm_solderparty_rp2040_stamp_carrier-3.0.uf2
  433 KiB
  2022-10-10 06:47:19 +08:00
- pico_hsm_solderparty_rp2040_stamp_round_carrier-3.0.uf2
  433 KiB
  2022-10-10 06:47:19 +08:00
- pico_hsm_solderparty_rp2040_stamp-3.0.uf2
  432 KiB
  2022-10-10 06:47:20 +08:00
- pico_hsm_sparkfun_micromod-3.0.uf2
  433 KiB
  2022-10-10 06:47:20 +08:00
- pico_hsm_sparkfun_promicro-3.0.uf2
  432 KiB
  2022-10-10 06:47:21 +08:00
- pico_hsm_sparkfun_thingplus-3.0.uf2
  433 KiB
  2022-10-10 06:47:21 +08:00
- pico_hsm_vgaboard-3.0.uf2
  436 KiB
  2022-10-10 06:47:22 +08:00
- pico_hsm_waveshare_rp2040_lcd_0.96-3.0.uf2
  432 KiB
  2022-10-10 06:47:22 +08:00
- pico_hsm_waveshare_rp2040_plus_16mb-3.0.uf2
  433 KiB
  2022-10-10 06:47:23 +08:00
- pico_hsm_waveshare_rp2040_plus_4mb-3.0.uf2
  433 KiB
  2022-10-10 06:47:23 +08:00
- pico_hsm_waveshare_rp2040_zero-3.0.uf2
  432 KiB
  2022-10-10 06:47:24 +08:00
- pico_hsm_wiznet_w5100s_evb_pico-3.0.uf2
  433 KiB
  2022-10-10 06:47:24 +08:00
- Source Code (ZIP)
- Source Code (TAR.GZ)

26 Releases 32 Tags

Version 3.0 Stable

New tool: `pico-hsm-tool.py`

Internal security refactoring

XKEK

MKEK

26 Releases 32 Tags

Version 3.0 Stable

New tool: pico-hsm-tool.py

Internal security refactoring

XKEK

MKEK

New tool: `pico-hsm-tool.py`