Show HN: The SC4-HSM, a fully open USB hardware secure module

Post by kosma » Sun, Jul 10, 2016, 9:37 AM UTC

lisper wrote: post #30

kosma wrote: post #26

Earlier quoted context omitted.

> there is readout protection built into the SoC I have managed to bypass readout protection on STM32F1 with just a few nights of hacking and $2 in parts; I suspect F4 isn't much different. I wouldn't trust any general purpose MCU in this regard.

The RDP on the F4 is more capable than the F1. The F1 only has level 1 RDP, the F4 has level 2 as well. If you can break level 2 without decapping the chip that would be big news (and probably result in a class action lawsuit against STM). Can you describe how you did it? [EDIT: Never mind, I see you already answered that in the other branch of this thread.]

I had a look at the documentation and it seems they finally made it a JTAG fuse and not just a value in program memory. Nice move.

Post by hellomoto998 » Mon, Jul 11, 2016, 1:03 PM UTC

captainmuon wrote: post #52

akiselev wrote: post #50

Earlier quoted context omitted.

> I doubt that any civilian technology would withstand a hardware attack e.g. by the NSA. You'd probably be wrong. There are several consumer accessible chips (i.e. from Atmel that you can order on digikey) that use tamper-proof silicon where the very act of opening up the package to inspect the die destroys the private key data. Even civilian tamper-proof tech is extremely robust, using physical phenomena to protect…

Well, that's probably true, but my only source for that is what people wrote on the internet. OTOH, I know e.g. the NSA has basically infinite resources. Anecdotally, I've heard that there are ways to destructively image complete chips, and not just the layout but also the internal charge state. I believe the technique used femtosecond lasers. Of course that is also hearsay and I can't validate it. My point is, as an…

Infinite resources don't exist.

Something I was told back when I was working around WikiLeaks is, "You can't make it impossible for them to get your goat, but you want to make it very, very expensive."

Re: Show HN: The SC4-HSM, a fully open USB hardware secure module

Re: Show HN: The SC4-HSM, a fully open USB hardware secure module