← Back
Home › Systems › Embedded and IoT

secure-element

secure element chip and OS

NXP SE050, Apple Secure Enclave, EMV and SIM chips

SystemTechniques · 7Primitives · 29 secure-element AKA (authentication and key agreeme…security · medium: Symmetric-key challenge-response in which a chip and its home server prove knowledge of one key, with a sequence number for freshness, and derive session keys.›Code signingsecurity · medium: Signing binaries/apps with certificate chains, entitlements, timestamping and notarizationFault attack countermeasuressecurity · medium: Resist glitch and laser faults with redundant computation, result verification, integrity checks on control flow and infective responsesHardware root of trustsecurity · medium: Secure elements/TPM/TEE holding device keys, attestation and monotonic countersPower side channel maskingsecurity · medium: Split secrets into random shares (Boolean or arithmetic masking) so power traces do not correlate with intermediate valuesWear levelingstorage · medium: Spread erases across flash blocks: dynamic and static wear leveling, read disturb refreshHardware security module (HSM)security · medium: A tamper-resistant device or service that generates keys, signs, decrypts and wraps with them internally, and releases a key only as ciphertext.›HKDF key derivation (extract-and-ex…security · low: HMAC-based two-step key derivation: extract a uniform pseudorandom key from any secret, then expand it into as many context-bound keys as you need.›Message authentication codes (HMAC,…security · low: A keyed short tag proving a message is unmodified and came from a key holder; pick HMAC, CMAC, KMAC or a one-time polynomial MAC by what primitive you already have.›ECDSA signaturessecurity · low: The elliptic-curve signature standardised in FIPS 186-5 (P-256) and used by secp256k1 ledgers; 64-byte signatures, but a repeated or biased nonce leaks the private key.›Secure boot chainsecurity · low: Each boot stage verifies the signature of the next before running it, anchored in an immutable ROM key hash, with version counters against downgrade and a TPM log of what ran.›Csprngsecurity · low: OS-backed cryptographically secure random numbers (getrandom), and when a fast PRNG is not enoughSecure memory zeroizationsecurity · low: Keep secrets in one locked, fixed-size, non-copyable region, erase them with writes the compiler must keep, and exclude them from dumps and swap.›Bytecode interpretercompilers · low: Register/stack VM dispatch loop for executing compiled plans or rules (SQLite VDBE, nftables)Memory protection unitembedded · low: A handful of base/size regions with permissions, checked on every access by the CPU, give microcontroller tasks isolation and stack-overflow traps without an MMU.›Emv cryptogramsfinance · low: EMV ARQC/ARPC and tokenized-card cryptograms: session key derivation and MAC verificationBig integer arithmeticnumerics · low: Multi-limb integer arithmetic (256-bit and up): carries, Karatsuba, Montgomery and Barrett reductionApdu smart card protocolsecurity · low: ISO 7816 APDU command/response exchange with smart cards, eUICCs and secure elementsConstant time codesecurity · low: Writing secret-dependent code without branches or memory lookups on secrets; constant-time compare and selectECDH key exchange (X25519, P-256)security · low: Each side multiplies the other's public curve point by its own scalar and both get the same point; always validate the peer key and run the result through a KDF.›Elliptic curve arithmeticsecurity · low: Point addition, doubling and constant-time scalar multiplication in projective coordinatesRsa cryptosystemsecurity · low: RSA key generation, OAEP encryption and PSS/PKCS#1 v1.5 signatures, key sizes and padding pitfallsWrite-ahead logstorage · low: Append each change to a checksummed sequential log and fsync it before touching data pages; the basis of crash durability in nearly every database.›+ 13 more primitives

Similar systems

Share the most building blocks with this one.

esim-provisioning 16 %hsm-service 16 %

In-house systems

Named systems of this kind at large companies, with their paper or write-up.

Secure EnclaveApple