Security hardware

Options for protecting a device's private key: NervesKey (ATECC608), TPM 2.0, ARM TrustZone, and other OpenSSL-engine-backed hardware.

Written By Josh Kalderimis

Last updated About 2 months ago

With certificate-based authentication, the strength of a device's identity comes down to how well its private key is protected. Secure hardware stores the key so it can't be extracted, even by someone with full access to the device's filesystem. This page compares the options.

For how authentication uses these keys, see Device authentication & mTLS.

Why it matters

If a device's private key is a plain file, anyone who can read the filesystem can copy the device's identity. Secure hardware generates and holds the key internally and only ever performs signing operations with it, so the key itself never leaves the chip.

The options

Option

Protection

Notes

NervesKey (ATECC608)

High

Purpose-built secure element. Key generated on-chip, never extractable. Read directly by NervesHubLink.

TPM 2.0

High

Common on many boards. Supported via the tpm library.

ARM TrustZone

High

Secure world on ARM SoCs; typically accessed through an OpenSSL engine.

File-based (LocalCertKey)

Low

Key stored on the filesystem. No special hardware needed.

NervesKey

NervesKey uses a Microchip ATECC608 secure element. It's the simplest option for Nerves: add the nerves_key dependency and NervesHubLink reads the certificate and key straight from the chip. The private key is generated inside the chip during provisioning and can never be read out.

TPM

A Trusted Platform Module is a standard secure key store found on many devices. With the tpm library, NervesHubLink can read the key and certificate from the module and set up TLS for you.

TrustZone and other hardware

Many SoCs include ARM TrustZone or other secure elements. In general, any hardware that exposes an OpenSSL engine can be used to hold the key and perform TLS signing, though the tooling and integration effort vary by platform. NervesKey and TPM are the supported, documented paths; others are possible but more hands-on.

Choosing

  • Production, and your hardware has a secure element? Use NervesKey (or TPM if that's what the board has). This is the recommendation.

  • No secure hardware? File-based storage works and needs nothing special, but treat the device identity as less protected and plan accordingly.

Related