Skip to content

secure element documentation #403

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
May 15, 2025
Merged

secure element documentation #403

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f1d8f95
added all files from previous repo
nitrosimon Feb 23, 2025
9f29025
added suggestions
nitrosimon Feb 24, 2025
33a63b0
Update secure-element.rst
jans23 May 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions source/components/nitrokeys/nitrokey3/index.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ and the product guides:
LED and Touch Button <led>
nitropy <nitropy>
Reset <reset>
Secure Element <secure-element>
Troubleshooting <troubleshooting>

or check out the features:
Expand Down
66 changes: 66 additions & 0 deletions source/components/nitrokeys/nitrokey3/secure-element.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,66 @@
Secure Element SE05x
====================

.. contents:: :local:

The Secure Element `SE050 <https://www.nxp.com/products/SE050>`__ is a tamper-resistant chip by NXP Semiconductors that provides advanced security features. It offers hardware-based security functions including cryptographic operations, secure key storage, and protection against physical and logical attacks. The SE05X Secure Element is certified to Common Criteria EAL 6+ security level and implements algorithms like RSA, ECC, AES, and SHA, making it ideal for the Nitrokey 3.

Cryptographic keys of PIV are stored in the Secure Element. OpenPGP Card can be configured to store cryptographic keys in the Secure Element or not in which case a software-only implementation is used. Password Safe and FIDO2 don't use the Secure Element except for additional randomness.


Activation/Deactivation for OpenPGP
-----------------------------------
The Secure Element is enabled by default if no cryptographic key in OpenPGP Card and PIV is already saved on the device.
This is automatically the case after resetting the OpenPGP Card or the entire Nitrokey.

.. warning::
Manually activating the Secure Element for the OpenPGP Card will delete all existing keys.

To check whether the Secure Element for OpenPGP is activated run:

* nitropy nk3 get-config opcard.use_se050_backend

To enable the Secure Element:

* nitropy nk3 set-config opcard.use_se050_backend true

To disable the Secure Element:

* nitropy nk3 set-config opcard.use_se050_backend false

Algorithms
----------

+-----------------------------------------+---------------------+------------------------+
| Algorithm | With Secure Element | Without Secure Element |
+=========================================+=====================+========================+
| RSA 2048 bit | ✓ | ✓ |
+-----------------------------------------+---------------------+------------------------+
| RSA 3072 bit | ✓ | ⨯ |
+-----------------------------------------+---------------------+------------------------+
| RSA 4096 bit | ✓ | ⨯ |
+-----------------------------------------+---------------------+------------------------+
| AES 128/256 bit | ✓ | ✓ |
+-----------------------------------------+---------------------+------------------------+
| SHA 256/384/512 bit | ✓ | ✓ |
+-----------------------------------------+---------------------+------------------------+
| NIST P-256 (secp256r1/prime256v1) | ✓ | ✓ |
+-----------------------------------------+---------------------+------------------------+
| NIST P-384 (secp384r1/prime384v1) | ✓ | ⨯ |
+-----------------------------------------+---------------------+------------------------+
| NIST P-521 (secp521r1/prime521v1) | ✓ | ⨯ |
+-----------------------------------------+---------------------+------------------------+
| Ed25519/Curve25519 | ✓ | ✓ |
+-----------------------------------------+---------------------+------------------------+
| brainpoolP256r1 | ✓ | ⨯ |
+-----------------------------------------+---------------------+------------------------+
| brainpoolP384r1 | ✓ | ⨯ |
+-----------------------------------------+---------------------+------------------------+
| brainpoolP512r1 | ✓ | ⨯ |
+-----------------------------------------+---------------------+------------------------+
| HOTP (RFC 4226) | ✓ | ✓ |
+-----------------------------------------+---------------------+------------------------+
| TOTP (RFC 6238) | ✓ | ✓ |
+-----------------------------------------+---------------------+------------------------+
| Physical random number generator (TRNG) | ✓ | ✓ |
+-----------------------------------------+---------------------+------------------------+