1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
|
Title: An Open Crypto Chip
Date: 2016-12-15 22:44
- RPKI/DNSSEC Signing
- Transport VPNs
- Routers and TCP/AO
- Email
- Federations, Identity Systems, SSO etc
- Password Stretching & HMAC:ing
- PGP and SSH Keys on a Stick
- High Quality Entropy Randomness
- A Communications Terminal Doing One Thing Well, Like Jabber w/o X11
- HSM for Pond, OTR identity keys, ssh private keys, etc. (i.e. key gen, store, import/export non X.509 packages)
- Password management
- Key Generation
- Key Storage
- Key Wrap
- Key Unwrap
- Hash
- Sign
- M of N Sign
- Verify Signature
- Encrypt
- Decrypt
- KDFs, e.g. Password Stretching (a la PBKDF2)
- Random (RO + noisy diode?)
We need to support key wrapping. Some pointers:
- https://en.wikipedia.org/wiki/Key_Wrap
- http://tools.ietf.org/html/rfc5297
- http://csrc.nist.gov/groups/ST/toolkit/documents/kms/key-wrap.pdf
- https://tools.ietf.org/html/rfc3394
- https://tools.ietf.org/html/rfc5649
- Tamper Protection (wipe on signal, suggest detectors, suggest potting features)
- Side Channel Attack Reduction
As a proof of concept, to validate as much as possible the assurance of the tools and methods, and as a demonstration of the project tools, team, and architecture, we have a proposed version 0.01 product as a proof of concept and a demonstration of the project tools, team, and architecture
- Security Target Description
- Performance Target(s)
- Tool-Chain Investigation
- Prototype Design
- Testing / Assurance Methods for all Components
- Verilog/RTL assurance, with open source and with proprietary
- Prototyping Platform(s)
- Documentation, Decision History, & Transparency
-
The Bunnie laptop Novena. Includes a Xilinx Spartan 6 LX45 FPGHA. The specs, drivers, source for Novena can be found here: http://www.kosagi.com/w/index.php?title=Novena_Main_Page
-
TerasIC C5G Cyclone 5 GX Starter Kit. Includes an Altera C5GX FPGA. This board is used for core, subsystem development and verification. Info, documentation and ordering of the TerasIC board can be found here: http://www.terasic.com.tw/cgi-bin/page/archive.pl?Language=English&CategoryNo=167&No=830
Here is a writeup on how to setup and run coretest_hashes on the C5G board.
- TerasIC DE0-Nano board. This tiny, USB powered board is used for core development and verification. Info, documentation, resources, ordering of the TerasIC board can be found here: http://www.terasic.com.tw/cgi-bin/page/archive.pl?Language=English&CategoryNo=139&No=593
- Overall Strategy
- Following the Tool-Chain
- Spec / ABI
- Development
- Documentationa and Testing
- DDC Compiler
- System Build
- Minimal Component Set
- Specification of v0.1 Goals and Feature Set
- Security Goals & Documentation Outline
- TRNG
- Assured Linux Platform - Initial Report
- Security Goals & Documentation Overall and v0.1
- RSA Signing on Bunnie Board
- Assured Linux Platform - Compiler
The v0.1 version of CrypTech is not the last version nor the only possible version. The project for example consider possible ASIC Implementations.
|
