Shhh - Stop Sharing Secrets, a Secure Mindset for Embedded Development
Talkat Embedded Linux Conference @ Open Source Summit North America 2022 · on Wednesday, 2022-06-22· at 11:50· Room 201/202 (Level 2), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701·
summary
Argues that shipping unencrypted credentials on devices is unacceptable and demonstrates concrete fixes: deploy mutual TLS backed by a PKI, keep private keys in an HSM or secure element (NXP SE05x) accessed via PKCS#11, and bind keys to hardware with OP-TEE integration so boot is measured and keys are nonextractable. Shows a working integration (SE05x + OP-TEE + PKCS#11 + OpenSSL engine), warns about ECIES library incompatibilities (Go/ethereum), and documents common failures like exposed JTAG, root accounts, and unhashed credentials.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 2:06Whats the big deal
- 2:53Our industry has a superpower
- 4:31Different dimensions to security
- 5:30Building blocks of security
- 7:40Root Certificate Authority
- 10:15Mutual TLS
- 11:55Asymmetric Encryption
- 13:28Elliptical Curves
- 15:31HS Systems
- 16:40The Bad News
- 17:57Security in General
- 19:04Additional Layers
- 22:01Good Practices
- 23:54Trusted Execution Environment
- 26:40Questions
- 26:56NXP
- 29:03Summary
- 30:02AWS IoT
- 32:44Key Rolling
- 40:16OS
related talks
40mKeeping secrets in your opponent's hands
30mImplementing a third layer of security (do we need it?)
29mEnabling a secure IoT from design to deployment
27mSecurity++: Hide Your Secrets via a Distributed Hardware Security Mod...
32mELC 2013 Security: Best Practices for Embedded Systems
17mEmbedded Security's Weakest Link: Lessons From Simple Mistakes
18mBeyond the Default Password: Building Trustworthy IoT Products
14mHow not to secure your embedded system, lessons from automotive testing