{"title":"Cryptech Project - AlphaBoard","link":[{"@attributes":{"href":"https:\/\/wiki.cryptech.is\/","rel":"alternate"}},{"@attributes":{"href":"https:\/\/wiki.cryptech.is\/feeds\/alphaboard.atom.xml","rel":"self"}}],"id":"https:\/\/wiki.cryptech.is\/","updated":"2019-01-24T14:37:00+00:00","entry":[{"title":"Using ST-Link on the Alpha Board","link":{"@attributes":{"href":"https:\/\/wiki.cryptech.is\/UsingSTLink","rel":"alternate"}},"published":"2017-05-13T03:37:00+00:00","updated":"2019-01-24T14:37:00+00:00","author":{"name":"Joachim Str\u00f6mbergson"},"id":"tag:wiki.cryptech.is,2017-05-13:\/UsingSTLink","summary":"

ST-LINK is STM's implementation of the | Serial Wire Debug (SWD)<\/a> protocol.\nThink of it as JTAG if you're more comfortable with that.<\/p>\n

Getting an ST-LINK programmer<\/h2>\n

ST-LINK is built into all(?) of STM's Nucleo and Discovery evaluation\nboards, which can be had for as little as US$10 from Mouser \u2026<\/a><\/p>","content":"

ST-LINK is STM's implementation of the | Serial Wire Debug (SWD)<\/a> protocol.\nThink of it as JTAG if you're more comfortable with that.<\/p>\n

Getting an ST-LINK programmer<\/h2>\n

ST-LINK is built into all(?) of STM's Nucleo and Discovery evaluation\nboards, which can be had for as little as US$10 from Mouser<\/a>\nor element14<\/a> (Newark<\/a> in\nthe Americas, Farnell<\/a> in Europe).<\/p>\n

We have tested with STM32F0DISCOVERY and STM32F4DISCOVERY (both with ST-LINK\nv2.0) and NUCLEO-F411RE (with ST-LINK v2.1).<\/p>\n

Connecting the ST-LINK programmer to the Alpha<\/h3>\n

On the STM board, remove the pair of ST-LINK jumpers (CN4 on the F4DISCO,\nCN2 on the F0DISCO and NUCLEO). Then locate the 6-pin SWD header (CN3 on\nthe F0DISCO, CN2 on the F4DISCO, CN4 on the NUCLEO), and connect it to J1\non the Alpha board (top, just left of center).<\/p>\n

This photo shows the correct orientation of the cables (both boards\noriented so that the logo is right-side up):<\/p>\n

\"IMG_20170512_205557_s.jpg\"<\/p>\n

NOTE: The STM boards have an unfortunate tendency to short unexpectedly, so\nI recommend putting them in an enclosure. In this case, I've cut holes in\nthe original packaging.<\/p>\n

Install OpenOCD and the debugger<\/h2>\n
<\/span>$ <\/span>apt-get <\/span>install <\/span>gdb-arm-none-eabi <\/span>openocd\n<\/code><\/pre><\/div>\n\n
Get the debug<\/code> and flash-target<\/code> scripts<\/h2>\n
If you don't already have a cryptech source tree somewhere, get the source distribution, e.g.<\/p>\n
<\/span>$ <\/span>apt-get <\/span>source<\/span> <\/span>cryptech-alpha\n<\/code><\/pre><\/div>\n\n
The scripts are in sw\/stm32\/bin<\/code>.<\/p>\n
Re-flashing the Alpha<\/h2>\n
To reflash with our binary firmware<\/h3>\n
<\/span>$ <\/span>tar <\/span>xfz <\/span>\/usr\/share\/cryptech-alpha-firmware.tar.gz\n$ <\/span>flash-target <\/span>hsm\n<\/code><\/pre><\/div>\n\n
What you should see is something like:<\/p>\n
<\/span>** Programming Started **\nauto erase enabled\nInfo : device id = 0x20016419\nInfo : flash size = 2048kbytes\nInfo : Dual Bank 2048 kiB STM32F42x\/43x\/469\/479 found\ntarget halted due to breakpoint, current mode: Thread\nxPSR: 0x61000000 pc: 0x20000046 msp: 0x2002fffc\nwrote 524288 bytes from file projects\/hsm\/hsm.elf in 12.344705s (41.475 KiB\/s)\n** Programming Finished **\n** Verify Started **\ntarget halted due to breakpoint, current mode: Thread\nxPSR: 0x61000000 pc: 0x2000002e msp: 0x2002fffc\ntarget halted due to breakpoint, current mode: Thread\nxPSR: 0x61000000 pc: 0x2000002e msp: 0x2002fffc\nverified 509100 bytes in 0.953672s (521.320 KiB\/s)\n** Verified OK **\n** Resetting Target **\nInfo : Unable to match requested speed 2000 kHz, using 1800 kHz\nInfo : Unable to match requested speed 2000 kHz, using 1800 kHz\nadapter speed: 1800 kHz\nshutdown command invoked\n<\/code><\/pre><\/div>\n\n
To reflash with firmware you built from source<\/h3>\n
See BuildingFromSource.<\/p>\n
Debugging the Alpha<\/h2>\n
This site shows several ways to use various debuggers to debug the\nfirmware in an STM32:<\/p>\n
<\/span>http:\/\/fun-tech.se\/stm32\/OpenOCD\/gdb.php\n<\/code><\/pre><\/div>\n\n
There is a shell script called 'bin\/debug' that starts an OpenOCD server\nand GDB:<\/p>\n
<\/span>$ <\/span>sw\/stm32\/bin\/debug <\/span>projects\/hsm\/hsm\n<\/code><\/pre><\/div>","category":{"@attributes":{"term":"AlphaBoard"}}},{"title":"Disaster Recovery on the Alpha Board","link":{"@attributes":{"href":"https:\/\/wiki.cryptech.is\/DisasterRecovery","rel":"alternate"}},"published":"2017-05-13T00:30:00+00:00","updated":"2017-05-13T00:30:00+00:00","author":{"name":"Paul Selkirk"},"id":"tag:wiki.cryptech.is,2017-05-13:\/DisasterRecovery","summary":"
This page covers a few likely (hopefully unlikely) oh-noes.<\/p>\n
Oh no, I bricked my device<\/h2>\n
Recovering from a bad firmware install<\/h3>\n
You can upload new firmware through the bootloader. On power-up or reset,\nthe bootloader flashes the blue LED for 10 seconds. During that time, start\ncryptech_upload<\/code>:<\/p>\n
<\/span>$<\/span> <\/span>cryptech_upload<\/span> <\/span>--<\/span>firmware<\/span> <\/span>--<\/span>user \u2026<\/span><\/code><\/pre><\/div>","content":"
This page covers a few likely (hopefully unlikely) oh-noes.<\/p>\n
Oh no, I bricked my device<\/h2>\n
Recovering from a bad firmware install<\/h3>\n
You can upload new firmware through the bootloader. On power-up or reset,\nthe bootloader flashes the blue LED for 10 seconds. During that time, start\ncryptech_upload<\/code>:<\/p>\n
<\/span>$<\/span> <\/span>cryptech_upload<\/span> <\/span>--<\/span>firmware<\/span> <\/span>--<\/span>user<\/span> <\/span>wheel<\/span>\nPIN<\/span>:<\/span> <\/span><<\/span>your<\/span>-<\/span>wheel<\/span>-<\/span>pin<\/span>><\/span>\n<\/code><\/pre><\/div>\n\n
Recovering from a bad bootloader install<\/h3>\n
Well, now you've done it. You'll need to buy an ST-LINK programmer.\nSee UsingSTLink<\/a>.<\/p>\n
Oh no, I'm locked out of my device<\/h2>\n
If you're staring at this thing for the first time, or if you ran\nkeystore erase<\/code>, then you have no PIN. Believe it or not, this is the\nbest case scenario. Log in as wheel with the default PIN\nYouReallyNeedToChangeThisPINRightNowWeAreNotKidding<\/code>, and you should be\nable to reset the PINs.<\/p>\n
If you forgot the PIN, I feel sorry for you. The only way out of this is\nvia ST-LINK<\/a>. The easiest way is to debug with gdb<\/code>, set a breakpoint on\nhal_rpc_login<\/code>, and issue the gdb command return 0<\/code>.<\/p>\n
Oh no, I forgot (or reset) the master key<\/h2>\n
As shipped, the Alpha doesn't include a battery backup for the Master Key\nMemory. So if power is interrupted, the MKM is wiped. (Also, if we had\ntamper protection more sophisticated than a Panic Button, it would wipe\nthe MKM when you opened the case to install the ST-LINK cable.)<\/p>\n
Sorry, there's nothing that can be done about that. All your keys are\nstill in flash memory, but encrypted with the KEK, which is now gone.\n(Unless you used the masterkey unsecure set<\/code> command to store the KEK in\nunprotected flash memory, but you wouldn't do that, would you?)<\/p>","category":{"@attributes":{"term":"AlphaBoard"}}},{"title":"Alpha Sealed Bags","link":{"@attributes":{"href":"https:\/\/wiki.cryptech.is\/AlphaSealedBags","rel":"alternate"}},"published":"2016-12-16T14:09:00+00:00","updated":"2016-12-16T14:12:00+00:00","author":{"name":"Fredrik Thulin"},"id":"tag:wiki.cryptech.is,2016-12-16:\/AlphaSealedBags","summary":"
Chain of custody<\/h2>\n
At present, we can't make any statements at all about the integrity of the hardware before it reached us - assembled and ready.<\/p>\n
We test and program the Alphas using a dedicated computer, but not in a secure facility by any means.\nA concerned user is advised to \u2026<\/p>","content":"
Chain of custody<\/h2>\n
At present, we can't make any statements at all about the integrity of the hardware before it reached us - assembled and ready.<\/p>\n
We test and program the Alphas using a dedicated computer, but not in a secure facility by any means.\nA concerned user is advised to reprogram the firmware with binaries built from source.<\/p>\n
To provide some assurance the devices have not been tampered with after they have been programmed we put them in sealed bags with individual serial numbers.<\/p>\n
As the model of bags might change over time, we will publish photos of the bags used here as well as PGP signed statements for what serial numbers can be expected.\nAt this time, we do not keep records of which exact unit was sent to whom.<\/p>\n
This is a picture of the currently used bags:<\/p>\n
\"Alpha_tamper_bag_2016-12-16.png\"<\/p>\n
<\/span>-----BEGIN PGP SIGNED MESSAGE-----<\/span>\nHash<\/span>:<\/span> <\/span>SHA512<\/span>\n\nAt<\/span> <\/span>2016-12-16,<\/span> <\/span>I<\/span> <\/span>put<\/span> <\/span>Cryptech<\/span> <\/span>Alpha<\/span> <\/span>units<\/span> <\/span>into<\/span> <\/span>sealed<\/span> <\/span>bags<\/span> <\/span>with<\/span> <\/span>the<\/span>\nfollowing<\/span> <\/span>serial<\/span> <\/span>numbers:<\/span>\n\n  <\/span>26<\/span> <\/span>0<\/span> <\/span>027<\/span> <\/span>233<\/span> <\/span>507<\/span>\n  <\/span>26<\/span> <\/span>0<\/span> <\/span>027<\/span> <\/span>233<\/span> <\/span>508<\/span>\n  <\/span>26<\/span> <\/span>0<\/span> <\/span>027<\/span> <\/span>233<\/span> <\/span>509<\/span>\n  <\/span>26<\/span> <\/span>0<\/span> <\/span>027<\/span> <\/span>233<\/span> <\/span>510<\/span>\n  <\/span>26<\/span> <\/span>0<\/span> <\/span>027<\/span> <\/span>233<\/span> <\/span>511<\/span>\n  <\/span>26<\/span> <\/span>0<\/span> <\/span>027<\/span> <\/span>233<\/span> <\/span>512<\/span>\n  <\/span>26<\/span> <\/span>0<\/span> <\/span>027<\/span> <\/span>233<\/span> <\/span>513<\/span>\n  <\/span>26<\/span> <\/span>0<\/span> <\/span>027<\/span> <\/span>233<\/span> <\/span>514<\/span>\n  <\/span>26<\/span> <\/span>0<\/span> <\/span>027<\/span> <\/span>233<\/span> <\/span>515<\/span>\n  <\/span>26<\/span> <\/span>0<\/span> <\/span>027<\/span> <\/span>233<\/span> <\/span>516<\/span>\n  <\/span>26<\/span> <\/span>0<\/span> <\/span>027<\/span> <\/span>233<\/span> <\/span>517<\/span>\n  <\/span>26<\/span> <\/span>0<\/span> <\/span>027<\/span> <\/span>233<\/span> <\/span>518<\/span>\n  <\/span>26<\/span> <\/span>0<\/span> <\/span>027<\/span> <\/span>233<\/span> <\/span>519<\/span>\n  <\/span>26<\/span> <\/span>0<\/span> <\/span>027<\/span> <\/span>233<\/span> <\/span>520<\/span>\n  <\/span>26<\/span> <\/span>0<\/span> <\/span>027<\/span> <\/span>233<\/span> <\/span>521<\/span>\n  <\/span>26<\/span> <\/span>0<\/span> <\/span>027<\/span> <\/span>233<\/span> <\/span>522<\/span>\n  <\/span>26<\/span> <\/span>0<\/span> <\/span>027<\/span> <\/span>233<\/span> <\/span>523<\/span>\n  <\/span>26<\/span> <\/span>0<\/span> <\/span>027<\/span> <\/span>233<\/span> <\/span>524<\/span>\n  <\/span>26<\/span> <\/span>0<\/span> <\/span>027<\/span> <\/span>233<\/span> <\/span>525<\/span>\n  <\/span>26<\/span> <\/span>0<\/span> <\/span>027<\/span> <\/span>233<\/span> <\/span>526<\/span>\n\n\/Fredrik<\/span>\n-----BEGIN PGP SIGNATURE-----<\/span>\nVersion<\/span>:<\/span> <\/span>GnuPG v2<\/span>\n\niQEcBAEBCgAGBQJYU\/MVAAoJEBmMGv1QUVLd+2gH\/jLZ7aUGlZ+Iwj6b746Hh6u1<\/span>\n2JAZ+2tk5tRooTwNb4A5P3ewRcbjA0jPJQQlpVqZcxdt0DDjS16AR0LEaH2rWL++<\/span>\nsj\/OtBm5rqAmVcf1NNvzpC8f8WWgRYhx4nNhWKnEcTBQXT9NbFQhQY0WH3ebupnn<\/span>\n8PK0mX8PpfsjM\/3vxtVVLmi+vBsxv0hBcdl+t4IPw\/UbzozicF6jZpxRXxVujTE6<\/span>\nWLGXaCnySS4T1zgtpewfgVMOMouGScUw5n2yHRZJpissGUVJtuPrOEmNFvDz7LRD<\/span>\ni00Rc4i2emsKTgKrkMIKyQWSqFIQ1nBUQ5B5ES1Q50432cppbyEW2rJJZjAuxgM=<\/span>\n=s2D5<\/span>\n-----END PGP SIGNATURE-----<\/span>\n<\/code><\/pre><\/div>","category":{"@attributes":{"term":"AlphaBoard"}}},{"title":"High resolution pictures of the Alpha board","link":{"@attributes":{"href":"https:\/\/wiki.cryptech.is\/AlphaBoardPictures","rel":"alternate"}},"published":"2016-12-15T22:44:00+00:00","updated":"2017-05-19T17:49:00+00:00","author":{"name":"Rob Austein"},"id":"tag:wiki.cryptech.is,2016-12-15:\/AlphaBoardPictures","content":"
Attached to this page are high resolution pictures.<\/p>\n
The current revision of the Alpha board is rev03.<\/p>\n
rev01 was the board known as the 'dev-bridge'.<\/p>\n
rev02 was functionally the same as the rev03, but in another form factor.<\/p>\n
\"Alpha_rev03_top_med.jpg\"<\/p>\n
\"Alpha_rev03_bottom_med.jpg\"<\/p>","category":{"@attributes":{"term":"AlphaBoard"}}},{"title":"Alpha Board Strategy","link":{"@attributes":{"href":"https:\/\/wiki.cryptech.is\/AlphaBoardStrategy","rel":"alternate"}},"published":"2016-12-15T22:43:00+00:00","updated":"2016-12-15T22:43:00+00:00","author":{"name":"Cryptech Core Team"},"id":"tag:wiki.cryptech.is,2016-12-15:\/AlphaBoardStrategy","summary":"
The Cryptech Alpha Board<\/h1>\n
Goal<\/h2>\n
Develop a first, custom HSM board that can be used to support a first set of applications as well as being used for further development of new functionality as well as security mechanisms such as tamper detection and protection, key storage etc. Deadline is to \u2026<\/p>","content":"
The Cryptech Alpha Board<\/h1>\n
Goal<\/h2>\n
Develop a first, custom HSM board that can be used to support a first set of applications as well as being used for further development of new functionality as well as security mechanisms such as tamper detection and protection, key storage etc. Deadline is to produce palpable results before summer, 2015.<\/p>\n