OpenTitan

Unlike proprietary RoT implementations, OpenTitan's register-transfer level (RTL) design, firmware, and verification collateral are publicly auditable. This eliminates the possibility of undocumented backdoors or obfuscated security vulnerabilities that plague closed-source secure elements. The design undergoes continuous third-party review, ensuring cryptographic primitives like AES-256, SHA-3, and ECDSA are correctly implemented without intentional weaknesses.

OpenTitan integrates a standards-compliant True Random Number Generator (TRNG) that extracts entropy from physical noise sources within the silicon. This entropy source is compliant with NIST SP 800-90B and provides the non-deterministic seed material for all on-chip key generation. The open design allows verification that no deterministic pseudo-random fallback is silently substituted, a critical assurance for generating unpredictable nonces and cryptographic key pairs.

The RoT implements a cryptographically enforced chain of trust anchored in immutable ROM. Each boot stage—from ROM to ROM_EXT to the first mutable firmware—is hashed and verified against a stored public key before execution. This prevents pre-boot malware and bootkits from compromising the system. The verification logic is implemented in hardware state machines, making it resistant to software bypass attempts.

OpenTitan natively supports the Device Identifier Composition Engine (DICE) standard. This layers boot state measurements to create a compound Compound Device Identifier (CDI). Each firmware layer receives a unique, cryptographically derived secret, enabling remote attestation without requiring persistent storage of the device's unique identity. This allows a remote verifier to cryptographically confirm the exact firmware version running on the silicon.

The design includes a dedicated key manager hardware block that derives and stores sensitive keys in a manner isolated from the main processor core. Keys are never exposed in plaintext to general-purpose firmware. The key manager enforces access control policies and can seal keys to specific system states, ensuring that decryption keys are only available when the correct, verified firmware is running. This provides robust protection against cold boot attacks and firmware extraction.

OpenTitan enforces anti-rollback protection using monotonic counters stored in non-volatile memory. When a firmware update is received, the RoT verifies its digital signature and checks that its version number is strictly greater than the current version. This prevents an attacker from reinstalling a previously patched, vulnerable firmware image. The update mechanism itself is a cryptographically authenticated state machine, ensuring authenticity and integrity of the new image.