Google has announced the use of chips based on the open platform OpenTitan in Chromebook devices. Chromebooks are the first commercially available devices equipped with OpenTitan. Later this year, Google plans to implement server systems with OpenTitan in its data centers. Mass production of the chips is organized by Nuvoton. Additionally, work has begun on the second version of the chip, which will allow the use of post-quantum encryption algorithms ML-DSA and ML-KEM for secure booting and attestation, implementing cryptographic methods based on lattice theory problems.
The OpenTitan project provides a platform for creating trustworthy hardware components (RoT, Root of Trust) used where integrity of system hardware and software elements needs to be guaranteed. OpenTitan was founded by Google in 2018 but was transferred to the non-profit organization lowRISC in 2019, after which companies such as Western Digital, Seagate, Nuvoton Technology, Winbond, Rivos, zeroRISC, and G+D Mobile Security joined its development. The code and specifications related to the project are published under the Apache 2.0 license. The technologies used in OpenTitan are based on those already employed in Google's Titan cryptographic USB tokens and TPM chips for verified booting, installed in servers Google's infrastructure, as well as in Chromebook and Pixel devices.
Unlike existing implementations of Root of Trust, OpenTitan is developed according to the concept of "security through transparency," which implies open access to code and schematics, as well as the application of a fully open development process not tied to specific chip suppliers and manufacturers. OpenTitan has become the first open-market implementation of Root of Trust that supports a post-quantum secure boot mechanism based on the SLH-DSA (Sphincs+) digital signature generation algorithm, resistant to quantum computer attacks.
OpenTitan-based chips can be used in server motherboards, network cards, consumer devices, routers, and Internet of Things devices for verifying firmware and boot components (protection against modification of critical system parts), generating cryptographically unique system identifiers (protection against hardware spoofing), providing security-related services, protecting cryptographic keys (isolating keys in case an attacker gains physical access to the equipment), and maintaining an isolated audit log that cannot be edited or erased.
OpenTitan includes logical blocks required in RoT chips, such as an open microprocessor based on RISC-V architecture (RV32IMCB Ibex), cryptographic coprocessors, a hardware random number generator, a key manager with DICE support, a secure data storage mechanism in both persistent and volatile memory, protection technologies, I/O blocks, and secure boot components. The device also provides blocks with implementations of standard encryption algorithms like AES and HMAC-SHA256, along with a hardware accelerator for mathematical operations used in public key digital signature algorithms.
Source: opennet.ru
