D4no0
Using SIM card as a secure storage
I was reading about security considerations of firmware for RPIs, namely when it comes to firmware encryption when deploying to sdcard.
The default solution seems to use a ATECC508A or similar as a secure storage for encryption keys. One of the issues I see with this is that the availability of these chips is not that great, so I would guess there are other models that are used for professional use-cases?
While I was thinking about this, I remembered that smartcards are mainly used to do the exact same thing, not to mention that most of the deployed devices on the field have already a SIM used for internet. Theoretically we should be able to use at the very least the key that the SIM uses to authenticate with the cellular tower, even a better thing would be to be able to deploy your custom key, but I guess this highly depends on the model of the SIM your operator uses.
The great thing about such a solution it’s extremely easy to implement both from development standpoint (as all sims should follow the same AT commands standard) and in terms of hardware.
Maybe anyone tried to do this already with Nerves? It would be really interesting to hear more about this.
Most Liked
D4no0
I have worked with other kind of smartcards before, the ones used by truck drivers in europe, so I am not entirely sure about the capabilities of current SIMs. Those cards follow the ISO standard for data signature and challenges and I’m more than positive that is a convention widely used by all other vendors too.
I have never used a modem for this before (I am actually thinking now on buying a few models to play around with them), but as long as your modem supports APDU protocol used for issuing commands to smartcard, you are good to go. At work, we were using USB smartcard readers, those are extremely easy to work with from your computer.
Once I get the hardware, I will definitely give it a try as I plan on deploying a few RPIs zero w2 and while I don’t care about encrypting the firmware, I don’t want anybody acquiring the keys used for authentication for firmware download from NervesHub. I will definitely share my findings!
lawik
Yeah, this is definitely interesting! Keep us posted if you try it.
The Redwire Labs folks are doing device certs with TPM 2.0.
I hope to do it in the near term using ARM TrustZone-protected keys.
Both of those can be used through a PKCS11 interface via OpenSSL engine support. And some other avenues.
Popular in Discussions
Other popular topics
Latest Nerves Threads
Latest on Elixir Forum
Sponsor Spotlight
Enabling companies to succeed by building software people love.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #javascript
- #code-sync
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #websockets
- #supervisor
- #advent-of-code
- #elixirconf-us
- #distillery
- #processes
- #forms
- #api
- #metaprogramming
- #security
- #performance
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Real-time error tracking, performance insights, and observability for devs.
Producing high quality Elixir screencasts since 2017.
Enabling companies to succeed by building software people love.
The deployment platform built for Elixir: PaaS ease, VPS control.
Courses that'll move you from confusion to "Aha, now I get it!"