Documentation on The Ashen Open Source HSM Stack

Heartbeat Protocol Specification

Mon, 01 Jan 0001 00:00:00 +0000

Protocol Stack

The ashen heartbeat protocol serves multiple purposes. It enables the payload system and the tamper sensor to ascertain each other's cryptographic identity. Further, it allows the payload to continuously monitor the tamper sensor's state to ensure secrets within the payload are quickly deleted when the sensor detects a tampering attempt. Finally, it serves as the cryptographically secured transport layer for any higher level cryptographic functions such as key management services that the tamper sensor may provide to the payload.

Secure Commissioning Guide

Mon, 01 Jan 0001 00:00:00 +0000

In Ashen's security model, the commissioning of the system, i.e. acquiring, assembling, programming, and configuring its components, is explicitly out of scope and up to you, the user. This guide will help you get to a secure Ashen setup. It highlights what you need to keep in mind, and which steps are the most likely to result in a security problem.

There is no absolute security, especially in hardware. A sufficiently determined and well-funded attacker will be able to overpower any defence you mount, even if just by sheer luck, tenancy, or brute force. However, by implementing all of these suggestions, you can make it a lot more annoying and much more expensive for an attacker to achieve their goals, and thus discourage attacks before they happen.

Executive Summary

Make sure your IT infrastructure is airtight.
Keep your supply chains short and trustworthy. Avoid sketchy stops in your component's journey to you.
Verify hashes and signatures of software downloads.
Do the final assembly and programming in house.

Hardware Assembly

Component Procurement

Depending on the kinds of adversaries you are facing, you may need to consider supply-chain attacks. There's no one way to fully prevent them, but there are some things you can do to make them much more difficult to implement in practice. A basic assumption we make here is that unless we all are exceptionally unlucky, an attacker likely will not have a backdoor pre-installed into all components of a type such as SBC or microcontroller. Instead, we estimate it's reasonable to assume that the most likely supply-chain attack will be targeted, with the attacker modifying one or a few components on the way to the victim.

The Linux Wipe System

Mon, 01 Jan 0001 00:00:00 +0000

When a HSM detects that an attacker is tampering with its hardware, it must respond by quickly wiping (deleting) all secrets. The point of this is to discourage attackers from attempting to read out secrets using hardware attacks, or else they will risk destroying all contents of the HSM. In conventional HSMs, wiping the secrets is usually done by just removing the power supply of the memory that they are stored inside. In our Linux-based HSM, we can't do that and we have to spend a little more effort.

Threat model

Mon, 01 Jan 0001 00:00:00 +0000

System Description

This page contains a semi-formal analysis of the security of a typical Ashen-based HSM. The HSM we describe here is a generic setup based on a typical Linux Single-Board Computer (SBC) running Ashen on Linux that is connected to a Yanartas tamper sensor. You can use this threat model as a starting point for tailoring a more comprehensive threat model covering your particular use of Ashen.

Scope

The following parts are in scope for this analysis: