I am using BeableBone Black devices running Debian which communicate securely with an AWS server over TLS using signed certificates.

I need to store my private keys securely on the devices. The best way to store these is by using a separate hardware security module or TPM connected to the BeagleBone which I don't have just yet.

Just by using the available flash memory, what would be the most secure way that I can store the keys? My applications will of course need access to the keys without any user intervention.

Does encrypting the keys make any sense, for example by using dm-crypt? Decryption of the keys I guess will require a password, but then this password must be stored securely too? What about an encrypted partition?

  • dm-crypt/encrypt partitions is for physical security; in run-time you are good as a sitting duck. Just design the network parameter security for those machines being able to go out, but not getting any (direct) connections from the Internet. Mar 9 '19 at 16:07
  • @RuiFRibeiro I don't understand sorry Mar 9 '19 at 16:36

There is no truly safe solution to what you ask for. Especially if anyone gets physical access to the device.

Anything you will do will be pure 'security by obscurity'.

You could start out by defining a "threat model". What scenarios do you want to specifically defend against? Physical access? Remote exploitation? Cloneability? Once you clarify that it becomes easier to see if specific threats can be mitigated.

Ultimately, if you consider a TPM already, you will most likely end up with an AT97SC3205T + oscillator on a breakout board. That's a known to work device in combination with a BBB. Also the chip itself is cheap at 2-3$ already in 'onesies'.

  • Thanks for that. I guess it makes no sense to encrypt the private keys on the device? My application which uses MQTT to communicate with the cloud, it will need access to the keys always, and so by encrypting them, that will not work? Mar 11 '19 at 11:48
  • Correct. I'd focus on getting a sufficient quantity of TPM PCBs produced. There are services like MacroFab, Seeed FusionPCB, PCBWay, PCBCart. All you need to do is get a design done. The laziest option would be to take github.com/sparkfun/CryptoCape and simply NOPOP everything except the TPM section. Add the Cape EEPROM if you need to be able to detect the cape without probing for the TPM.
    – TBR
    Mar 11 '19 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.