After six years of work on the project, Google announced the start of production of a chip based on the open-source platform OpenTitan. The chip is produced by Nuvoton and is marked as the first implementation of OpenTitan ready for use in real projects. Currently, a trial batch has been released for testing, with mass production scheduled to begin in spring this year.
OpenTitan is a platform for creating trusted hardware components (RoT, Root of Trust) used where it is necessary to guarantee the integrity of the hardware and software elements of the system. For example, to ensure that critical parts of the system have not been replaced and are built on verified and authorized code from the manufacturer. The project provides a ready, tested, and reliable framework that enhances trust in the developed solutions and reduces costs in the development of specialized security chips.
Chips based on OpenTitan can be used in server motherboards, network cards, consumer devices, routers, and Internet of Things devices for verifying firmware and loaded components, generating cryptographically unique system identifiers (protection against hardware tampering), providing security-related services, protecting cryptographic keys (isolating keys in case of physical access by an attacker), and maintaining an isolated audit log that cannot be edited or erased.
OpenTitan includes logical blocks required in RoT chips, such as an open microprocessor based on RISC-V architecture (RV32IMCB Ibex), cryptographic coprocessors, a hardware random number generator, a key manager with DICE support, a secure data storage mechanism in both persistent and volatile memory, protection technologies, I/O blocks, and secure boot components. The device also provides blocks with implementations of standard encryption algorithms like AES and HMAC-SHA256, along with a hardware accelerator for mathematical operations used in public key digital signature algorithms.
The project was initiated by Google but was handed over to the non-profit organization lowRISC, after which companies such as Western Digital, Seagate, Nuvoton Technology, Winbond, Rivos, zeroRISC, and G+D Mobile Security joined its development. The code and specifications related to the project are published under the Apache 2.0 license. The solutions used in OpenTitan are based on technologies already employed in Google Titan cryptographic USB tokens and TPM chips for ensuring verified boot. servers Google's infrastructure, as well as in Chromebook and Pixel devices.
Unlike existing implementations of Root of Trust, OpenTitan is developed according to the concept of "security through transparency," which implies open access to code and schematics, as well as the application of a fully open development process not tied to specific chip suppliers and manufacturers. OpenTitan has become the first open-market implementation of Root of Trust that supports a post-quantum secure boot mechanism based on the SLH-DSA (Sphincs+) digital signature generation algorithm, resistant to quantum computer attacks.
Source: opennet.ru
