GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → Infineon → optiga-trust-m

Infineon / optiga-trust-m

Licence: MIT license
OPTIGA™ Trust M Software Framework

Programming Languages

c
50402 projects - #5 most used programming language

Labels

cryptographyaeseccrsaecdsahsmhardware-accelerationpublic-key-cryptographyecdhebrainpoolhardware-securityprotected-i2csecurity-chip

Projects that are alternatives of or similar to optiga-trust-m

dtls
Datagram Transport Layer Security (DTLS) client.
Stars: ✭ 72 (-16.28%)
Mutual labels:  aes, rsa, ecdsa, ecdhe
oseid
Microchip AVR based smartcard/token with ECC and RSA cryptography
Stars: ✭ 17 (-80.23%)
Mutual labels:  aes, ecc, rsa, ecdsa
interesting-keys
Interesting collected (leaked) encryption/decryption keys
Stars: ✭ 33 (-61.63%)
Mutual labels:  aes, ecc, rsa, ecdsa
Jsrsasign
The 'jsrsasign' (RSA-Sign JavaScript Library) is an opensource free cryptography library supporting RSA/RSAPSS/ECDSA/DSA signing/validation, ASN.1, PKCS#1/5/8 private/public key, X.509 certificate, CRL, OCSP, CMS SignedData, TimeStamp, CAdES JSON Web Signature/Token in pure JavaScript.
Stars: ✭ 2,760 (+3109.3%)
Mutual labels:  aes, rsa, ecdsa
Phpseclib
PHP Secure Communications Library
Stars: ✭ 4,627 (+5280.23%)
Mutual labels:  aes, rsa, ecdsa
Practical Cryptography For Developers Book
Practical Cryptography for Developers: Hashes, MAC, Key Derivation, DHKE, Symmetric and Asymmetric Ciphers, Public Key Cryptosystems, RSA, Elliptic Curves, ECC, secp256k1, ECDH, ECIES, Digital Signatures, ECDSA, EdDSA
Stars: ✭ 2,400 (+2690.7%)
Mutual labels:  aes, ecc, public-key-cryptography
Oscrypto
Compiler-free Python crypto library backed by the OS, supporting CPython and PyPy
Stars: ✭ 257 (+198.84%)
Mutual labels:  aes, rsa, ecdsa
enigma
A fast, native, cryptographic engine for the web
Stars: ✭ 101 (+17.44%)
Mutual labels:  aes, ecc, rsa
Swcrypt
RSA public/private key generation, RSA, AES encryption/decryption, RSA sign/verify in Swift with CommonCrypto in iOS and OS X
Stars: ✭ 632 (+634.88%)
Mutual labels:  aes, rsa
Dbtransitencryption
Secure data before sending it over the internet
Stars: ✭ 20 (-76.74%)
Mutual labels:  aes, rsa
Low Latency Android Ios Linux Windows Tvos Macos Interactive Audio Platform
🇸Superpowered Audio, Networking and Cryptographics SDKs. High performance and cross platform on Android, iOS, macOS, tvOS, Linux, Windows and modern web browsers.
Stars: ✭ 1,121 (+1203.49%)
Mutual labels:  aes, rsa
Hybrid Crypto Js
RSA+AES hybrid encryption implementation for JavaScript. Works with Node.js, React Native and modern browsers.
Stars: ✭ 87 (+1.16%)
Mutual labels:  aes, rsa
Heimdall
Heimdall is a wrapper around the Security framework for simple encryption/decryption operations.
Stars: ✭ 369 (+329.07%)
Mutual labels:  aes, rsa
Mirage Crypto
Cryptographic primitives for MirageOS
Stars: ✭ 39 (-54.65%)
Mutual labels:  aes, rsa
Netcore.encrypt
NETCore encrypt and decrpty tool，Include aes，des，rsa，md5，sha1，sha256，sha384，sha512
Stars: ✭ 339 (+294.19%)
Mutual labels:  aes, rsa
Goencrypt
go语言封装的各种对称加密和非对称加密，可以直接使用，包括3重DES，AES的CBC和CTR模式，还有RSA非对称加密,ECC椭圆曲线的加密和数字签名
Stars: ✭ 297 (+245.35%)
Mutual labels:  aes, rsa
Encryptlab
A Free and Comprehensive Encrypt and Decrypt Tools Website with example code in Node.js, Website is looking for a new server.
Stars: ✭ 69 (-19.77%)
Mutual labels:  aes, rsa
Encryptor4j
Strong encryption for Java simplified
Stars: ✭ 92 (+6.98%)
Mutual labels:  aes, rsa
Cry
Cross platform PoC ransomware written in Go
Stars: ✭ 179 (+108.14%)
Mutual labels:  aes, rsa
crypto.js
base on crypto module
Stars: ✭ 13 (-84.88%)
Mutual labels:  aes, rsa
View All Similar Projects ➔

Infineon OPTIGA™ Trust M

Quick navigation

  1. Security Solution
  2. Get Started
  3. Documentation
  4. Contributing
  5. License

Security Solution

Description

This repository contains a target-agnostic Software Framework for the OPTIGA™ Trust M security solution. It is a base for other application notes. Be aware that this software comes without any security claims and shall be used for evaluation purpose.

Key Features and Benefits

  • High-end security controller
  • Common Criteria Certified EAL6+ (high) hardware
  • Turnkey solution
  • Up to 10kB user memory
  • PG-USON-10 package (3 x 3 mm)
  • Temperature range (−40°C to +105°C)
  • I2C interface with Shielded Connection (encrypted communication)
  • Cryptographic support:
    • ECC : NIST curves up to P-521, Brainpool r1 curve up to 512,
    • RSA® up to 2048
    • AES key up to 256 , HMAC up to SHA512
    • TLS v1.2 PRF and HKDF up to SHA512
  • Crypto ToolBox commands for SHA-256, ECC and RSA® Feature, AES, HMAC and Key derivation
  • Configurable device security monitor, 4 Monotonic up counters
  • Protected(integrity and confidentiality) update of data, key and metadata objects
  • Hibernate for zero power consumption
  • Lifetime for Industrial Automation and Infrastructure is 20 years and 15 years for other Application Profiles

Features table

Features Supported Curve/Algorithm V1 V3
ECC ECC NIST P256/384 ✓ ✓
ECC NIST P521, ECC Brainpool P256/384/512 r1 ✓
RSA RSA® 1024/2048 ✓ ✓
Key Derivation TLS v1.2 PRF SHA 256 ✓ ✓
TLS v1.2 PRF SHA 384/512 ✓
HKDF SHA-256/384/512 ✓
AES Key size - 128/192/256 (ECB, CBC, CBC-MAC, CMAC) ✓
Random Generation TRNG, DRNG, Pre-Master secret for RSA® Key exchange ✓ ✓
HMAC HMAC with SHA256/384/512 ✓
Hash SHA256 ✓ ✓
Protected data (object) update (Integrity) ECC NIST P256/384
RSA® 1024/2048
Signature scheme as ECDSA FIPS 186-3/RSA SSA PKCS#1 v1.5 without hashing 		✓ ✓
ECC NIST P521,
ECC Brainpool P256/384/512 r1
Signature scheme as ECDSA FIPS 186-3/RSA SSA PKCS#1 v1.5 without hashing		 ✓
Protected Data/key/metadata update (Integrity and/or confidentiality) ECC NIST P256/384/521
ECC Brainpool P256/384/512 r1
RSA® 1024/2048
Signature scheme as ECDSA FIPS 186-3/RSA SSA PKCS#1 v1.5 without hashing		 ✓

Provisioning Options (V1, V3, Express)

Confgiurations

There are three main provisioning options/confgiurations availble:

Note: All three configuration options have no effect on the corresponding features. For example, OPTIGA™ Trust M Express has the same features as OPTIGA™ Trust M V3, also the same API and hostcode can be used to work with all three solutions.

  1. OPTIGA™ Trust M V1/V3 - a provisioning configuration which comes as a standard for all shipped devices. Unless mentioned differently all OPTIGA Trust M chips on the market have this configuration.
  2. OPTIGA™ Trust M Custom - a custom provisioning option done on demand upon reaching a MoQ. Fully customisable solution including Security Monitor Configuration
  3. OPTIGA™ Trust M Express - a provisioning configuration which can be ordered standalone. This variant comes with three certfiicates/private keys pre-provisioned by Infineon. Certificates and communication secrets data can be downloaded through the CIRRENT™ Cloud ID

Comparison Table

V1 V3 Express
Certificate -
Private Key		 Certificate -
Private Key		 Certificate* - Private Key
Object IDs E0E0 - E0F0 E0E0 - E0F0 E0E0 - E0F0 E0E1 - E0F1 E0E2 - E0FC
PKI Top Level ECC Root CA1 ECC Root CA2 ECC Root CA2 ECC Root CA2 RSA Root CA2
PKI Intermediate Level Int. CA 101 Int. CA 300 Int. CA 306 Int. CA 306 Int. CA 309
PKI Bottom Level: Key Algorithm NIST P-256 NIST P-256 NIST P-256 NIST P-256 RSA2048
Possible to Readout Yes Yes Yes With PBS* Yes
Possible to Update Only Certificate Only Certificate Only Certificate with PBS* and Auth.Ref.* Only Certificate with PBS* and Auth.Ref.* Only Certificate with PBS* and Auth.Ref.*
Default Lifecycle State Creation Creation Operational Operational Operational

* Certificate, Platform Binding Secret (PBS) and the Authorization Reference (Auth.Ref.) can be downloaded from CIRRENT™ Cloud ID by claiming a Reel QR Code

In addition to the certificates and private keys each OPTIGA™ Trust M Express comes with a chip unique Platform Binding Secret* and an Authorization Reference*. The latter are two unique per chip 64 bytes long data objects which serve the following purposes:

  • Platform Binding Secret (PBS) used to establish a Shielded Connection between a Host MCU and OPTIGA™ Trust M. Should be transfered from CIRRENT™ Cloud ID to the respective MCU to run a protected I2C connection; e.g. readout a protected Certificate located in the 0xE0E1 Object ID (see table above). For more details about Shielded Connection read here.
  • Authorization Reference (Auth. Ref.). Used to update/change Certificate, PBS and the Authorization Reference itself. Similar to the PBS shall be tranfered to the Host MCU to be used. Find more details in the Solution Reference Manual

Get Started

Boards

OPTIGA™ Trust M Evaluation Kit OPTIGA™ Trust IoT Security Development Kit

Get started with the OPTIGA™ Trust M evaluation kit or with the OPTIGA™ Trust IoT Security Development kit using this Application Note

Examples

  1. Get started guide
  2. ModusToolbox™ Code Examples
  3. Off-Chip TLS example (mbedTLS)
  4. Linux Command Line Interface
  5. Cloud:
    1. AWS FreeRTOS example
    2. Microsoft Azure IoT example
  6. Zephyr OS driver
  7. Secure Firmware Update and Secure Boot (link is pending)
  8. Arduino library
  9. Personalize OPTIGA™ Trust
  10. Python package
  11. I2C Utilities

Software Framework overview

  1. See Trust M Crypt API and Trust M Util API to know more about CRYPT and UTIL modules
  2. Information about the OPTIGA™ Trust M Command Library (CMD) can be found in the Solution Reference Manual In the same document you can find explanation of all Object IDs (OIDs) available for users as well as detailed technical explanation for all features and envisioned use cases.
  3. Infineon I2C Protocol implementation details can be found here
  4. Platform Abstraction Layer (PAL) overview and Porting Guide are presented in the Wiki

For more information please refer to the Wiki page of this project

Evaluation and developement kits

External links, open in the same tab.

  • OPTIGA™ Trust M evaluation kit

  • OPTIGA™ Trust M Shield2Go Notes to the S2Go Security OPTIGA M:

    • Supply voltage VCC is max. 5.5 V, please refer to the OPTIGA™ Trust M datasheet for more details about maximum ratings
    • Ensure that no voltage applied to any of the pins exceeds the absolute maximum rating of VCC + 0.3 V
    • Pin out on top (head) is directly connected to the pins of the OPTIGA™ Trust M
    • If head is broken off, only one capacitor is connected to the OPTIGA™ Trust M
    S2Go Security OPTIGA M Pinout drawing
    S2Go Security OPTIGA M Schematic drawing

Documentation

Usefull articles

Datasheet and Co.

For high level description and some important excerpts from the documentation please refer to Wiki page

Other downloadable PDF documents can be found below:

  1. OPTIGA™ Trust M Datasheet v3.40 (PDF)
  2. OPTIGA™ Trust M Solution Reference Manual v3.50 (PDF)
  3. OPTIGA™ Trust M Keys and Certificates v3.10 (PDF)
  4. Infineon I2C protocol specification v2.03 (PDF)

Board assembly recommendations

If you are planning to integrate OPTIGA™ Trust M in your PCB design have a look at the recommendations found here (external, opens in the same tab).

Contributing

Please read CONTRIBUTING.md for details on our code of conduct, and the process for submitting pull requests to us.

License

This project is licensed under the MIT License - see the LICENSE file for details

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].