What is a silicon root of trust?
The component a system's security ultimately depends on, placed in hardware so that device identity and boot integrity derive from the physical part rather than from software that could be replaced.
SECURE SILICON
A secure SoC whose identity is in the silicon, not in a file.
Hardware-anchored identity, a verified boot chain and cryptographic integration — completing inside the power a contactless field supplies, across the range of positions a card is actually presented at.
CONTEXT
Where this started.
A smart card has to establish that it is genuine, protect credentials valuable enough to attack, and complete a transaction fast enough that a person holding it near a reader does not notice a delay — on power drawn from the reader's field.
Those requirements pull against each other. Cryptographic operations cost energy and time. Countermeasures against physical and side-channel attack cost more of both. The power available in a contactless field is fixed, modest, and varies with how the card happens to be held. Architecture is the only place that conflict can be resolved.
Identity is the foundational piece. A credential is only as trustworthy as the assurance that it lives on the hardware it was issued to, which is why the anchor is placed in silicon rather than asserted by software that could be replaced.
CHALLENGES
4 problems, named.
Stated as the customer stated them, before any of them had an answer. A challenge that is only described after it was solved is a description of the solution.
01
A fixed, modest and variable power budget
Contactless field power is what it is, and it changes with card position and orientation. The transaction must complete across that range, not only at the optimum.
02
Security countermeasures cost time and energy
Every countermeasure against physical and side-channel attack consumes part of the same budget the cryptographic operation needs.
03
Test access versus security
Production test needs observability; a secure part must not offer observability to an attacker. Reconciling those has no generic answer.
04
Provisioning is an attack surface
Personalisation is where credentials enter the device, which makes the factory flow part of the security architecture rather than a manufacturing detail.
ARCHITECTURE
How the system was built.
The anchor layer is the part that cannot be replaced later: identity derived from the physical die, and a first stage that is mask-programmed and therefore permanent. Everything above it inherits whatever assurance those two provide, which is why they are settled before anything else in the architecture.
CONTRIBUTION
What Faststream did.
The specific scope, rather than a capability list. Where a stage was shared with the customer’s team, it is described as shared.
- Secure architecture — partitioning of the secure subsystem and its interfaces to the rest of the SoC.
- Identity anchoring — integrating the hardware identity mechanism into boot and authentication.
- Verified boot chain — from immutable first-stage code through to the application.
- Cryptographic integration — primitives, entropy and key handling inside the power and timing budget.
- Low-power design — energy budgeting across the whole transaction, not just at peak.
- Physical implementation — synthesis, timing closure and layout on a mature node.
- Test strategy — production observability that does not become an attack surface.
- Production transition — provisioning integration, qualification and yield analysis.
WHAT WAS HARD
The parts that consumed the schedule.
Rarely the subsystem that sounds difficult. Written out because a reader facing the same programme gets more from this than from a summary of what went well.
01
Energy budget against cryptographic work
Contactless power is limited and varies with position and orientation. The transaction has to complete across that whole range, which drove both the cryptographic implementation and the supply architecture.
02
Test access without exposure
Production test needs to see inside the part; a secure part must not let an attacker do the same. There is no generic answer, so this was designed specifically and reviewed as a security decision rather than a test one.
03
Provisioning as part of the security architecture
Personalisation is where credentials enter the device. Treating the factory flow as a manufacturing detail rather than an attack surface is a common and expensive error.
04
A mature node, chosen deliberately
Embedded non-volatile memory availability, analog performance and a long supply horizon made a mature node correct here. It was a decision, not a fallback.
OUTCOME
What resulted.
A part with identity in the silicon
Hardware-anchored identity and a verified boot chain, integrated with cryptographic capability and taken through implementation to production transition.
Transactions that complete across the real range
Energy budgeting across field variation rather than at the optimum, so the card works as it is actually presented.
An auditable provisioning flow
Credentials enter the device through a process that can be shown to be controlled, rather than trusted.
A platform, not a product
The same properties apply to secure microcontrollers, industrial controllers, IoT device identity and trusted edge hardware. Smart card is the most visible application, not the boundary.
Confidentiality
Customer projects are presented at property, capability, outcome and integration level. Customer names, internal architecture, register maps, state machines and confidential deliverables are not disclosed. Where a figure would identify a customer or a design, it is omitted rather than approximated. More detail is available under a non-disclosure agreement, within the limits each customer has agreed.
PRODUCTS AND CAPABILITY USED
What this was built from.
Every item links to its own page, with characteristics, applications and the maturity status stated honestly for that item.
PLATFORM
Faststream Secure
Silicon-rooted identity and secure boot.
TECHNOLOGYSilicon root of trust
Properties, threat model and its boundary.
TECHNOLOGYFirmware and boot
The verified chain in detail.
SOLUTIONSecure identity
The commercial offering.
KNOWLEDGEProcess node selection
Why mature nodes suit secure silicon.
CAPABILITYASIC & SoC design
Front end through physical implementation.
WHERE THIS APPLIES
Industries this serves.
COMMON QUESTIONS
Questions this programme gets asked.
Why is the mechanism not described here?
Mechanism, circuit architecture and implementation detail are discussed under a non-disclosure agreement. Public material covers properties, threat model, integration and assurance — which is what a buyer needs to decide whether a conversation is worth having.
Does a root of trust make the device secure?
No, and claiming otherwise is the common error. It establishes that the running code is the code that was signed and that the device is what it claims to be. It says nothing about whether that signed code contains an application-layer vulnerability.
Why build a secure part on a mature node?
Embedded non-volatile memory availability, analog performance, mask cost and a long supply horizon all favour mature nodes for secure identity silicon. Digital density is not the binding constraint.
FOUND THIS USEFUL?
Pass it on.
Written for engineers. Share it with one.
KEEP READING
Related work.
BUILD WITH FASTSTREAM
Bring us the difficult part.
Tell us the specification, the constraint and the deadline. Programmes that cross silicon, radio, embedded and AI are where Faststream is strongest.