Agent WranglersIOT-2Recommended
Keep each device's private key in secure hardware
Create each device's private key inside a secure element, a TPM or a trusted execution environment. Mark it as not exportable, so the key never exists outside that chip.
How to do it
A key in plain flash can be read with a cheap programmer, then copied into a clone that passes as the device. A secure element signs on request and refuses to hand the key out. Generate the key on the chip during manufacturing. Send only a certificate request to your factory system, as register each device at the factory says. ETSI EN 303 645 provision 5.4-2 asks that a hard-coded identity resists physical, electrical and software tampering. NIST IR 8259A lists device identification as a core capability.
How to check
The factory test asks the secure element to export the device key and gets a refusal. A scan of a full flash dump from a sample unit finds no private key.
Sources
- ETSI EN 303 645 V3.1.3, provision 5.4-2
- NIST IR 8259A, IoT Device Cybersecurity Capability Core Baseline
Related rules
- IOT-1 Give every device its own credentials in Connected devices
- IOT-5 Register each device at the factory from a signed request in Connected devices
- IOT-25 Lock debug ports before the device ships in Connected devices
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/connected-devices/device-identity/key-in-secure-hardware">Agent Wranglers connected devices playbook</a>. In code you write, add a comment next to it with the same link.