Zero One Blog Forum Development

Universal 2nd Factor

Is there any secure memory for storing private keys for authentications?

3 Likes

I think it is stored in STM32 MCU flash memory. So theoretically it could be read by any user application.
But probably it would be sufficient if user won’t install any third party untrusted applications and there will be any device locking feature (disallowing to use device without password) and mcu readout protection is enabled so flash could not be dumped with programmer, only erased and reprogrammed.

Some MCUs have secured memory partitions for storing private keys or something else, so even APP have no access to them. These partition can only be accessed by security modules. I don’t know which exactly MCU will be used, but if it’s not determined at this moment - would be nice to select that one, which will have security modules. Or at least external IC with such ability.

1 Like

AFAIK that’s STM32L4 series MCU, and according to this presentation it has some kind of memory protection unit, so maybe it’s possible to protect secret key with this feature. It also has TRNG & AES accelerator but it isn’t useful for secp256r1 public key encryption.

1 Like

Example of such security module with secure key storage in MCU: https://www.nxp.com/design/training/benefit-from-csec-peripheral-module-in-s32k-mcus:TIP-S32K-CSEC
But as far as I know, same can be done by external IC.

I think if this Flipper function designed to provide more security for users, it should be done properly. And private keys should not be stored at flash or EEPROM.

1 Like

Example of external IC with elliptic curves support: https://www.microchip.com/wwwproducts/en/ATECC508A
But it’s not recommended for new designs.
Is U2F uses ECDH?

UPD:
Newer version of this IC:
https://www.microchip.com/wwwproducts/en/ATECC608A

At 1000pcs it costs about €0.50

1 Like

Oh, another idea. It should be possible with such an IC to implement SmartCard functionality for the device, for example to sign git commits/store and use SSH RSA keys/protect your mail/etc.

2 Likes

Similar ICs from other vendors:
https://www.st.com/content/st_com/en/products/secure-mcus/authentication/st33tphf20i2c.html#overview - priceless

1 Like

Oh, this one supports both RSA and ECC keys, cool

there is an open source code for U2F and FIDO2