D4no0
I was reading about security considerations of firmware for RPIs, namely when it comes to firmware encryption when deploying to sdcard.
The default solution seems to use a ATECC508A or similar as a secure storage for encryption keys. One of the issues I see with this is that the availability of these chips is not that great, so I would guess there are other models that are used for professional use-cases?
While I was thinking about this, I remembered that smartcards are mainly used to do the exact same thing, not to mention that most of the deployed devices on the field have already a SIM used for internet. Theoretically we should be able to use at the very least the key that the SIM uses to authenticate with the cellular tower, even a better thing would be to be able to deploy your custom key, but I guess this highly depends on the model of the SIM your operator uses.
The great thing about such a solution it’s extremely easy to implement both from development standpoint (as all sims should follow the same AT commands standard) and in terms of hardware.
Maybe anyone tried to do this already with Nerves? It would be really interesting to hear more about this.
Where Next?
Trending in Discussions
Other Trending Topics
Latest Nerves Threads
Latest on Elixir Forum
Sponsor Spotlight
Courses that'll move you from confusion to "Aha, now I get it!"
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #ai
- #elixirconf-us
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #elixirconf-eu
- #metaprogramming
- #hex
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Master modern tools, write cleaner code, and tackle real-world challenges.
Producing high quality Elixir screencasts since 2017.
**Building the future of software with AI, trust, and human connection.**
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 3- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
fhunleth
I think this is an interesting idea. I looked into doing something like this during the supply chain shortages 4-5 years ago. I must have missed the AT commands or you have a different modem that has better commands. We were able to acquire ATECC parts, so we abandoned the investigation. If you have a PoC of doing this, I’d be super curious to see how you did it. I don’t think the Nerves part of this will be an issue.
D4no0
I have worked with other kind of smartcards before, the ones used by truck drivers in europe, so I am not entirely sure about the capabilities of current SIMs. Those cards follow the ISO standard for data signature and challenges and I’m more than positive that is a convention widely used by all other vendors too.
I have never used a modem for this before (I am actually thinking now on buying a few models to play around with them), but as long as your modem supports APDU protocol used for issuing commands to smartcard, you are good to go. At work, we were using USB smartcard readers, those are extremely easy to work with from your computer.
Once I get the hardware, I will definitely give it a try as I plan on deploying a few RPIs zero w2 and while I don’t care about encrypting the firmware, I don’t want anybody acquiring the keys used for authentication for firmware download from NervesHub. I will definitely share my findings!
lawik
Yeah, this is definitely interesting! Keep us posted if you try it.
The Redwire Labs folks are doing device certs with TPM 2.0.
I hope to do it in the near term using ARM TrustZone-protected keys.
Both of those can be used through a PKCS11 interface via OpenSSL engine support. And some other avenues.