Hardware Secure Element Support? ATECC608A/B Specifically?

[24601]

Confirm by changing [ ] to [x] below:

• [X ] I've searched for previous similar issues and didn't find any solution

Known Issue

• [X ] I'm using ATS data type endpoint: the endpoint should look like <prefix>-ats.iot.<region>.amazonaws.com

Platform/OS/Hardware/Device
What are you running the sdk on?

Linux, ARM64 (Pocketbeagle)

Describe the question

Is there a pattern or recommendation for using certificates stored in a hardware secure element such as the ATECC608A? AWS IoT Greengrass supports this element and is an AWS certified solution and it exposes a PCKS#11 interface and is well supported on Linux and storing private key materials on filesystems on Linux machines no matter how "secure" does not appeal or work for most applications.

[jmklix]

I believe you are looking for Amazon FreeRTOS. A detailed guide for getting started can be found here.
I'm not an expert on this so please let me know if this does not fit your needs and why.

[JonathanHenson]

Are you looking for something like pkcs#11 support? We have this queued in the backlog but it hasn’t made it to the top of the priorities list yet. If that’s what you’re looking for could you let us know so we can update the priority?

[JonathanHenson]

Alternatively the SDK has an api for doing this from in-memory. That doesn’t help with the most secure requirements where you can’t even load to memory, but if you can that would provide a work around for the time being.

[24601]

Hey @jmklix, thank you! FreeRTOS does seem to have support for the ATECC608A/B but we need/want to access its functions in JavaScript applications running on operating systems other than FreeRTOS (including but not limited to Electron applications on Linux on arm64, but that is the main target).

We evaluated using FreeRTOS and other RTOSes (Zephyr, namely) but the project has some Thread Border Gateway requirements which currently do not run on MCUs and/or RTOSes, so Linux is a requirement (Thread Border Gateway does a lot of IPv6, NAT, etc so a full TCP/IP stack is important).

And, given this is a JavaScript library, I think limiting the use case to FreeRTOS which likely doesn't have good (if any?) JavaScript components may not be possible, I don't know the exact intent of Amazon in building and targeting this lib, but I am assuming (like most JS libs) are targeted to cross-platform use in browser, browser-packaged apps/SPAs, or CLI apps cross-platform on full-blown OSes and not MCUs or SoCs running RTOSes (but, again, I can't speak authoritatively here, but if I was a betting man, I'd make this bet).

I believe you are looking for Amazon FreeRTOS. A detailed guide for getting started can be found here.
I'm not an expert on this so please let me know if this does not fit your needs and why.

[24601]

@JonathanHenson - YES! That definitely would help and complete the requirement, as the ATECC608A is a PCKS#11 compliant device with CryptoAuthLib being Microchip's implementation of that that is officially supported on Linux that can take the PCKS#11 layer down to I2C and back.

As for the in-memory workaround, that was our thought for development purposes where an external process can manage that and we can load creds into memory actually totally circumventing any ATECC608A/B and just getting keys out of a shared (insecure) store for development purposes that we can then just drop PKCS#11 into.

Are you looking for something like pkcs#11 support? We have this queued in the backlog but it hasn’t made it to the top of the priorities list yet. If that’s what you’re looking for could you let us know so we can update the priority?

[jmklix]

@24601 FreeRTOS was designed with IoT in mind:

This includes securely connecting your small, low-power devices to AWS cloud services like AWS IoT Core...

But I understand that it might not be the best for your use case. As Jonathan Henson mentioned adding PCKS#11 support is in our backlog. I am going to change this to a feature request so we can update you when it is finished

[24601]

Great, thank you! Yeah, FreeRTOS is definitely great for MCU powered devices, but I think in the stack/ecosystem it lives orthogonal/next to the JS lib, as it's really an operating system for a very, very specific set of devices. At any rate, thank you, yes, I will stay apprised here as soon as there's PKCS#11 support we'll adopt the library, in the mean time we're using direct calls for one or two things we need, so if there's a PR/branch where this dev starts to happen, we're happy to contribute as we can. Basit

…

On Tue, Dec 8, 2020 at 12:41 PM Joseph Klix ***@***.***> wrote: @24601 <https://github.com/24601> FreeRTOS was designed with IoT in mind <https://aws.amazon.com/freertos/>: This includes securely connecting your small, low-power devices to AWS cloud services like AWS IoT Core... But I understand that it might not be the best for your use case. As Jonathan Henson mentioned adding PCKS#11 support is in our backlog. I am going to change this to a feature request so we can update you when it is finished — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#114 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAI2QVYRARSOAPOW63MTJPDSTZ6N7ANCNFSM4URMWRFA> .