|
| ▲ | chipweinberger 2 days ago | parent | next [-] |
| IMO it's better to ship preprogrammed ICs to the factory, so you can do your secure burning in-house. |
| |
| ▲ | swiftcoder 2 days ago | parent [-] | | Depends on where the ICs originally come from. No point shipping your ICs from China -> US, flashing them, shipping them back US -> China for assembly, and then ship them China -> US again to sell | | |
|
|
| ▲ | Hackbraten 2 days ago | parent | prev | next [-] |
| > For a big enough production run, you'd likely ship an HSM to the factory I figure that the factory is exactly the adversary in the whole threat model? So why give them the keys to the castle so they can moonlight their own genuine batch? |
| |
| ▲ | NBJack a day ago | parent [-] | | A few ways, if I understand them correctly. On-site people you employ (if you can afford it) auditing the process, connectivity to the HSM to record every key assigned (makes it easy to trace duplicated keys to their origin), and ideally assigning these keys at the very last possible step after the rest is assembled (to minimize 'defective' parts wandering off and being assembled elsewhere). | | |
| ▲ | swiftcoder a day ago | parent [-] | | Yeah, it's important that your own people are doing regular inspections of the production line, keys get burned at the final station (use temp keys for QA stages before that point), and you retain software control of the HSM. You probably aren't going to do this whole rigmarole for small runs of devices like in the OP. |
|
|
|
| ▲ | chrismorgan a day ago | parent | prev [-] |
| > Almost all commercial devices need a unique ID, private key, etc Serious question: why? |
| |
| ▲ | swiftcoder a day ago | parent [-] | | You want a unique ID so that you can track which units are experiencing issues, you want private keys to be able to securely connect to your backend service and/or mobile companion app. A local-only device with no telemetry can probably skip some of those |
|
