4 ms·

Cost is around $150 for those who don't want to click around to find it. Hardware specs: SoC: NXP i.MX6ULZ ARM® Cortex™-A7 900 MHz RAM: 512 MB DDR3 Storage:

by 83 7y ago

Cost is around $150 for those who don't want to click around to find it. Hardware specs: SoC: NXP i.MX6ULZ ARM® Cortex™-A7 900 MHz RAM: 512 MB DDR3 Storage: internal 16 GB eMMC + external microSD Bluetooth module: u-blox ANNA-B112 BLE USB-C ports: DRP (Dual Role Power) receptacle + UFP (Upstream Facing Port) plug, USB 2.0 only (no video support) LEDs: two Slide switch: for boot mode selection between eMMC and microSD External security elements: Microchip ATECC608A + NXP A71CH Physical size: 66 mm x 19 mm x 8 mm (without enclosure, including USB-C connector)

KMnO4 7y ago
Interesting. That's a $2 SoC, part of NXP's "Ultra Low Cost" line. The whole BOM cost is probably around $10-15, so hopefully F-Secure can sell enough of these to bring consumer cost down. I can see a lot of use for these guys, but it's hard to justify when as Pi Zero outspecs it for 5% of the cost. I'd pick it up just to hack around if it was closer to the $50 range.
- RL_Quine 7y ago
  I wonder if it's one of the chips that has a bootloader vulnerability. All of the trustzone stuff was completely broken on their original, and nobody ever implemented working code for it anyway. The BOM cost is probably pretty high because of the BGA package, the original was like a 8 layer board or something absurd. Those processors, as you pointed out, are comically slow even compared with the raspberry pi.
  - lcarsip 7y ago
    We took part of in the original HAB disclosure process for the NXP i.MX series and we carry on testing these parts. Please see https://github.com/f-secure-foundry/advisories https://github.com/f-secure-foundry/advisories Of course all P/Ns used for the Mk II have a patched boot ROM, please see https://github.com/f-secure-foundry/usbarmory/wiki/Secure-boot-(Mk-II)#security-information https://github.com/f-secure-foundry/usbarmory/wiki/Secure-bo.... The original Mk I was 6 layers in the end, the Mk II is also 6 layers. And yes the BOM cost is considerable due to its specifications. The i.MX SoC core we use is comparable to a 1st gen Raspberry PI in speed, but of course slower than newer multi-core ones. However security and form factor, rather than pure speed, is our goal. For the intent and purposes of the board performance is more than adequate. Some benchmarks here: https://github.com/f-secure-foundry/usbarmory/wiki/Benchmarks-(Mk-II) https://github.com/f-secure-foundry/usbarmory/wiki/Benchmark...
    - RL_Quine 7y ago
      I have deep respect for you disclosing issues in a processor you're using in your own product.
- wahern 7y ago
  The ATECC608A is a very nice feature. I have an older version of the USB Armory--i.MX53 and USB-A. The cryptographic engine (SCCv2), and in particular the AES module with unique, secret eFUSE'd key (for creating a proper HSM) was poorly documented. NXP only made security component documentation available under NDA, and to achieve that you needed to work with a reseller, which after repeated attempts over many weeks I never managed to accomplish. Plus, even if I got the documentation, the keyed AES module only worked properly if you had secure boot working, otherwise it used a fixed test key rather than an alternative unique key. This was such a steep hill to climb that none of the example or open source applications ever made proper use of the AES module, AFAIK. I ended up simply buying a Pi 3, a Mikroe Click shield, and Mikroe ATECC608A board (for the shield), though by that time I had already run out of steam so I never had a chance to bring it up. So, the ATECC608A is very nice and I'd like to see it more widely included in hardware.[1] And the armory is much smaller than my literal Pi 3 hardware stack. Bonus points if documentation for i.MX6ULZ and related bits are publicly available, but I'm not keen on risking another goose chase so I probably wouldn't even factor that in one way or another. [1] I believe an ATECC chip is what AWS originally used for end-to-end hardware attestation of EC2 servers. And maybe still do. Though, this is speculation on my part based on some AWS developer blog posts discussing the chip.
  - hlandau 7y ago
    The ATECC608A itself has an NDA'd datasheet, though.
    - ktm5j 7y ago
      I think that's his point, and that's why he's glad to see it in the newer version.
      - wahern 7y ago
        I didn't know the ATECC608A had an NDA'd datasheet. But as far as I remember all documentation needed to utilize it from software (e.g. I2C protocol) was available, in PDF or in code (https://github.com/MicrochipTech/cryptoauthlib/ https://github.com/MicrochipTech/cryptoauthlib/).
- zokier 7y ago
  > Pi Zero outspecs it for 5% of the cost Does Pi do USB device "emulation" (has it "gadget" drivers)?
  - gruturo 7y ago
    Not all of them, but the A, A+ and zero do. Basically all models _without_ a built-in USB hub work. The Pi 4 is capable of OTG only over the USB-C port, and only with a recent firmware. They support a bunch of modes, like Mass Storage, Ethernet, Serial, HID, etc. Example: https://gist.github.com/gbaman/50b6cca61dd1c3f88f41 https://gist.github.com/gbaman/50b6cca61dd1c3f88f41
- lcarsip 7y ago
  The production costs are way more than 15 USD, you have to account for the 6 layers PCB, assembly and a BOM which is higher than what you suggest. We can take costs down a little more with larger numbers but not by a great margin. The assembly process of Type-C plugs is also time consuming and therefore costly.
deleted 7y ago
[deleted]

by 83 7y ago

KMnO4 7y ago

Interesting. That's a $2 SoC, part of NXP's "Ultra Low Cost" line. The whole BOM cost is probably around $10-15, so hopefully F-Secure can sell enough of these to bring consumer cost down. I can see a lot of use for these guys, but it's hard to justify when as Pi Zero outspecs it for 5% of the cost. I'd pick it up just to hack around if it was closer to the $50 range.

RL_Quine 7y ago
I wonder if it's one of the chips that has a bootloader vulnerability. All of the trustzone stuff was completely broken on their original, and nobody ever implemented working code for it anyway. The BOM cost is probably pretty high because of the BGA package, the original was like a 8 layer board or something absurd. Those processors, as you pointed out, are comically slow even compared with the raspberry pi.
- lcarsip 7y ago
  We took part of in the original HAB disclosure process for the NXP i.MX series and we carry on testing these parts. Please see https://github.com/f-secure-foundry/advisories https://github.com/f-secure-foundry/advisories Of course all P/Ns used for the Mk II have a patched boot ROM, please see https://github.com/f-secure-foundry/usbarmory/wiki/Secure-boot-(Mk-II)#security-information https://github.com/f-secure-foundry/usbarmory/wiki/Secure-bo.... The original Mk I was 6 layers in the end, the Mk II is also 6 layers. And yes the BOM cost is considerable due to its specifications. The i.MX SoC core we use is comparable to a 1st gen Raspberry PI in speed, but of course slower than newer multi-core ones. However security and form factor, rather than pure speed, is our goal. For the intent and purposes of the board performance is more than adequate. Some benchmarks here: https://github.com/f-secure-foundry/usbarmory/wiki/Benchmarks-(Mk-II) https://github.com/f-secure-foundry/usbarmory/wiki/Benchmark...
  - RL_Quine 7y ago
    I have deep respect for you disclosing issues in a processor you're using in your own product.
wahern 7y ago
The ATECC608A is a very nice feature. I have an older version of the USB Armory--i.MX53 and USB-A. The cryptographic engine (SCCv2), and in particular the AES module with unique, secret eFUSE'd key (for creating a proper HSM) was poorly documented. NXP only made security component documentation available under NDA, and to achieve that you needed to work with a reseller, which after repeated attempts over many weeks I never managed to accomplish. Plus, even if I got the documentation, the keyed AES module only worked properly if you had secure boot working, otherwise it used a fixed test key rather than an alternative unique key. This was such a steep hill to climb that none of the example or open source applications ever made proper use of the AES module, AFAIK. I ended up simply buying a Pi 3, a Mikroe Click shield, and Mikroe ATECC608A board (for the shield), though by that time I had already run out of steam so I never had a chance to bring it up. So, the ATECC608A is very nice and I'd like to see it more widely included in hardware.[1] And the armory is much smaller than my literal Pi 3 hardware stack. Bonus points if documentation for i.MX6ULZ and related bits are publicly available, but I'm not keen on risking another goose chase so I probably wouldn't even factor that in one way or another. [1] I believe an ATECC chip is what AWS originally used for end-to-end hardware attestation of EC2 servers. And maybe still do. Though, this is speculation on my part based on some AWS developer blog posts discussing the chip.
- hlandau 7y ago
  The ATECC608A itself has an NDA'd datasheet, though.
  - ktm5j 7y ago
    I think that's his point, and that's why he's glad to see it in the newer version.
    - wahern 7y ago
      I didn't know the ATECC608A had an NDA'd datasheet. But as far as I remember all documentation needed to utilize it from software (e.g. I2C protocol) was available, in PDF or in code (https://github.com/MicrochipTech/cryptoauthlib/ https://github.com/MicrochipTech/cryptoauthlib/).
zokier 7y ago
> Pi Zero outspecs it for 5% of the cost Does Pi do USB device "emulation" (has it "gadget" drivers)?
- gruturo 7y ago
  Not all of them, but the A, A+ and zero do. Basically all models _without_ a built-in USB hub work. The Pi 4 is capable of OTG only over the USB-C port, and only with a recent firmware. They support a bunch of modes, like Mass Storage, Ethernet, Serial, HID, etc. Example: https://gist.github.com/gbaman/50b6cca61dd1c3f88f41 https://gist.github.com/gbaman/50b6cca61dd1c3f88f41
lcarsip 7y ago
The production costs are way more than 15 USD, you have to account for the 6 layers PCB, assembly and a BOM which is higher than what you suggest. We can take costs down a little more with larger numbers but not by a great margin. The assembly process of Type-C plugs is also time consuming and therefore costly.

deleted 7y ago

[deleted]