ARM TrustZone secure execution for embedded projects

I don’t know if anyone else has worked with ARM TrustZone and the BEAM. I’d love to hear more if any of you have. Otherwise I’ll share notes in this thread.

@amclain and I have both moved towards implementing something with TrustZone from different directions. He brought a lot more to the table since he knows a lot more about embedded development. I primarily bring enthusiasm.

Some might have seen NervesKey which is a library for using an ATECC508 or 608 series secure element in a specific way. A thing it doesn’t do super well is manage secrets and it is a slow and inefficient little thing. Very practical for device certificates but it has several limitations when you go beyond that. Eventually I will have the recording of my NervesConf talk on this.

TrustZone is baked into the ARM CPU and is a way to run securely privileged code with separation from the regular world. It depends on having good hardware on the specific board as well to achieve an actually secure implementation. But used correctly it will allow secure storage of secrets, it will be a lot faster than NervesKey for auth and it has a lot of additional potential functionality.

To know more what level we are talking about, this Stack Overflow answer was pretty solid:

Anyone familiar with TrustZone ?