Zero Assumptions · Week 11 of 25 · Pillar 3 begins: Hardware root of trust
Your security key passed every test.
So the chip inside it is trustworthy.
Every control in Pillars 1 and 2 assumed a trustworthy hardware credential at the base of the identity stack. This week we examine what "trustworthy" actually means — at the chip level. The answer determines whether every other control in your architecture is standing on solid ground or shifting sand.
|
|
Welcome to Pillar 3 — Hardware root of trust
Pillars 1 and 2 covered what attackers target and the operational stack that determines whether your controls respond in time. Pillar 3 goes deeper — to the hardware layer that all of it rests on. Volumes 11–15 cover secure element certification, post-quantum readiness, firmware integrity, biometric binding vs device possession, and FIDO2 + PIV convergence. This is the layer most CISOs never examine — and the one attackers increasingly do.
|
We are sending this on a Friday — outside our usual Tuesday schedule — because Pillar 3 opens a different kind of conversation. The adversary tactics in Pillar 1 and the operational gaps in Pillar 2 are problems you can address with configuration changes, process improvements, and policy updates. The hardware root of trust is different. It is a procurement decision — one that most organisations made without full information and that is very difficult to reverse once tokens are deployed at scale.
The assumption that most hardware security key deployments rest on: if the key is FIDO2-certified and comes from a reputable vendor, the chip inside it is trustworthy. The certification proves the security.
The reality: FIDO2 certification tests protocol compliance. It says nothing about what happens inside the chip — how cryptographic operations are isolated, whether the secure element is resistant to physical attack, whether a side-channel can extract a private key, or whether the firmware can be modified after manufacture. Those questions are answered by an entirely different certification hierarchy — one that most procurement processes never reach.
|
EAL6+
The Common Criteria Evaluation Assurance Level at which formal mathematical verification of the security design is required — not just testing against a threat model. EAL6+ is the highest level achieved in production authentication hardware. FIDO2 certification imposes no CC EAL requirement whatsoever. The gap between a FIDO2-only certified key and a CC EAL6+ certified key is the gap between a protocol compliance test and a formal security proof.
Source: Common Criteria Recognition Arrangement (CCRA); ISO/IEC 15408
|
What a secure element actually is — and what it protects against
A secure element (SE) is a tamper-resistant microcontroller designed to execute cryptographic operations and store sensitive data in an environment that is physically isolated from the host system. In a hardware security key, the SE is the chip that generates the private key, stores it, and performs the cryptographic signing operation that authenticates the user. The private key never leaves the SE. The host computer never sees it.
The security guarantee of the entire FIDO2 architecture rests on this isolation. If the SE is truly tamper-resistant, the private key cannot be extracted — not by malware on the host, not by a physical attack on the device, not by a compromised firmware update. But "tamper-resistant" is not a binary property. It is a spectrum — and what determines where a given SE sits on that spectrum is the certification it has been evaluated against, not the marketing language of the vendor who manufactured it.
| CC EAL level |
What it evaluates |
Physical attack resistance? |
| FIDO2 only |
Protocol implementation — does the key correctly implement the FIDO2 spec? |
✗ Not tested |
| CC EAL4+ |
Systematic testing against a defined threat model — methodically designed, tested, and reviewed |
✗ Limited |
| CC EAL5+ |
Semi-formal design and testing — side-channel resistance begins here |
△ Partial |
| CC EAL6+ Feitian FT-JCOS / NeoWave
|
Formal mathematical verification of the security design — the highest standard applied to production smart card and authentication chips |
✓ Full — including side-channel and physical penetration testing |
The physical attack resistance tested at EAL6+ matters because a nation-state adversary or a sophisticated criminal organisation does not need to break your cryptographic algorithm to steal a private key from a hardware token. They need to get the device, a lab, and enough time to measure the power consumption or electromagnetic emissions during a signing operation. These side-channel attacks extract cryptographic secrets by analysing what the chip does during computation — not what it outputs.
EAL4+ does not certify resistance to this class of attack. EAL6+ does — with formal verification and mandatory penetration testing that specifically targets side-channel vulnerabilities. A CC EAL6+ secure element chip means an independent laboratory has subjected the physical device to the full range of known side-channel and fault injection attacks and verified that the cryptographic secrets remain protected under adversarial physical access.
|
ANSSI
The French Agence nationale de la sécurité des systèmes d'information Security Visa is the only EU-sovereign hardware authentication certification that formally validates the supply chain — not just the chip's security properties in isolation, but where it was designed, manufactured, and assembled, and whether any part of that process passed through a jurisdiction with adversarial intelligence relationships. It is the standard required for hardware deployed in French government and critical national infrastructure, and the benchmark increasingly referenced by Nordic and Baltic regulators under NIS2.
Source: ANSSI Security Visa programme; NIS2 Directive Article 21 implementation guidance
|
|
The blueprint — three questions every CISO should ask before hardware token procurement
1. What is the CC EAL level of the secure element — not the key, the chip? FIDO2 certification and CC EAL certification are evaluated separately and by different bodies. A key can be FIDO2-certified and have an EAL4+ chip, an EAL6+ chip, or no CC evaluation at all. Ask specifically for the CC EAL certificate for the secure element inside the device — not the FIDO2 Alliance certificate for the key itself.
2. Where was the chip designed, manufactured, and assembled — and what is the intelligence relationship between that jurisdiction and your threat model? For most commercial applications this question does not arise. For regulated industries, critical infrastructure, defence supply chains, and any organisation operating under NIS2 Article 21, it is a board-level procurement consideration. The answer is not available on most vendor websites — you have to ask, and if the vendor cannot or will not answer with a specific country of manufacture, that itself is informative.
3. What happens when the private key is generated — who controls the entropy source? The security of asymmetric cryptography depends entirely on the randomness of the key generation process. A compromised or predictable entropy source — either by design or by supply chain manipulation — produces keys that appear random but are recoverable. This is the most technically sophisticated supply chain attack vector and the one most difficult to detect after deployment. CC EAL6+ evaluation includes the entropy source. EAL4+ evaluation typically does not.
|
Two keys that answer all three questions — for different deployment contexts
The hardware keys Ciptor recommends are not chosen because they pass FIDO2 certification — every key on the market does. They are chosen because they answer all three procurement questions above with documented, third-party-verified evidence.
|
Hardware root of trust — chip-level evidence
NeoWave — ANSSI Security Visa, CC EAL6+, designed and manufactured in France
The secure element is CC EAL6+ certified — formal mathematical verification, side-channel resistance, physical penetration testing, entropy source evaluation, all by an independent accredited laboratory. The ANSSI Security Visa certifies the full supply chain: designed in France, manufactured in France, assembled in France, under the oversight of the French national cybersecurity authority. For organisations in regulated industries, defence, and critical national infrastructure — where NIS2 Article 21 compliance requires not just phishing-resistant MFA but defensible supply chain provenance — NeoWave is the only key where a single certificate answers both the chip security question and the jurisdiction question. FIDO2 + PIV support means one token across cloud SSO, Windows domain, VPN, and physical access control. No biometric — authentication is PIN-bound to the certified hardware device.
Answers to the three procurement questions: EAL6+ ✓ | France (EU sovereign) ✓ | Entropy source evaluated in ANSSI certification ✓
Feitian BioPass K49 — CC EAL6+ (FT-JCOS), on-device fingerprint, PQC-ready
Built on the FT-JCOS secure element — CC EAL6+ certified with full side-channel and physical penetration testing. The chip is the highest-assurance secure element available in production workforce authentication hardware today. The BioPass K49 adds on-device biometric verification: the fingerprint template is stored and matched entirely within the EAL6+ secure element — it never leaves the chip, is never transmitted, and cannot be extracted even under the same physical attack scenarios that EAL6+ evaluation tests for. Authentication is therefore user-bound rather than device-bound, closing the PIN-sharing and physical token-handover residual risks that remain in non-biometric deployments. The dedicated ML-KEM/ML-DSA hardware co-processor provides post-quantum cryptographic readiness — the credentials issued today will remain secure when quantum computing reaches the capability level required to attack RSA and ECC, satisfying DORA's long-term digital resilience obligation and NIST FIPS 203/204 compliance for organisations beginning PQC migration planning now. FIDO2 + PIV support covers cloud, on-premises, and physical access control from a single certified token.
Answers to the three procurement questions: EAL6+ ✓ | Feitian manufacturing (EAL6+ chip evaluation covers entropy source) ✓ | Biometric adds user-bound proof beyond device possession ✓
|
|
Where we are — three pillars in view
Pillar 1 (Weeks 1–5) complete: EDR blind spots, AiTM bypass, deepfake helpdesk, hardware supply chain, hybrid Kerberos blindspots.
Pillar 2 (Weeks 6–10) complete: Risk assessment gaps, session vulnerability, board NIS2 liability, signal isolation, physical/logical convergence.
Week 11 — The chip is the control: CC EAL levels, secure element physical attack resistance, the three procurement questions every CISO must ask.
Week 12 (next Tuesday): Post-quantum readiness. Harvest Now, Decrypt Later attacks are already in progress. The credentials your organisation issues today will still be in circulation when quantum computers can break RSA and ECC. The transition window is closing faster than most procurement cycles can move.
|
Back to Tuesdays from next week
Week 12 — Post-quantum readiness (Tuesday 29 September)
Nation-state adversaries are already harvesting encrypted data today — including your authentication traffic — to decrypt it when quantum computing reaches sufficient capability. The window to transition to quantum-resistant credentials before the harvest window closes is measured in years, not decades. We will cover the NIST FIPS 203/204 standards, what ML-KEM and ML-DSA mean in practice, and why hardware keys with dedicated PQC co-processors are the only deployment that does not require a full credential replacement when the transition becomes mandatory.
Week 13 — Firmware integrity and secure boot
The chip can be perfect. The firmware running on it can still be compromised. We examine how firmware update mechanisms become attack vectors, what secure boot actually guarantees, and why supply chain integrity checks cannot stop at the hardware certification level.
|
Free passwordless audit
Do you know the CC EAL level of the secure element inside your current hardware tokens?
In a free 30-minute passwordless audit we'll review your current hardware token deployment, identify the actual assurance level of the chips in your environment, map any gaps against your regulatory obligations, and show you what upgrading to CC EAL6+ looks like operationally — including migration path for existing deployments.
No sales deck. No follow-up unless you ask.
|
Every authentication control in your stack — phishing resistance, session binding, cross-tool correlation, physical/logical convergence — rests on the assumption that the chip at the base of the identity stack is genuinely trustworthy. CC EAL6+ is the only certification that formally verifies that assumption. Everything built above a chip that has not been evaluated to that standard is built on something that has not been tested under adversarial physical conditions. That is not a risk most CISOs have explicitly accepted — because most CISOs were never asked to consider it.
Mikael Rodin
Managing Director, Ciptor
P.S. Ask your current hardware key vendor for the CC EAL certificate of the secure element chip — not the FIDO2 Alliance certificate for the key. If they cannot produce it, or if the answer is EAL4+ or below, book a free audit. We will show you what EAL6+ means operationally for your deployment and what the migration path looks like.
New to the series? Start at ciptor.com/zero-assumptions/zero-assumptions-vol-1/