PSA Certified Level 2 is well established with silicon vendors as an independent evaluation for silicon chips that protect their PSA Root of Trust (PSA-RoT) assets against scalable software attacks. PSA Certified Level 2 + Secure Element is an additional PSA Certified certification which recognizes solutions that also have substantial physical protection for the cryptographic keys and cryptographic operations.
A Differentiated Chip Security Offering
Achieving PSA Certified Level 2 + Secure Element will enable silicon vendors to offer their OEM customers some physical protection of the assets they care most about – their secret crypto keys.
Widespread Applicability
Many OEMs use an external Secure Element or Trusted Platform Module (TPM) to enhance system security. PSA Certified Level 2 + Secure Element provides externally validated evidence of good-quality integration with the System-on-Chip using a secure channel. Chip vendors offering PSA Certified Level 2 + Secure Element with an integrated Secure Enclave can offer solutions with some physical protection of assets without the added cost of an external chip.
SESIP Evaluation Methodology Enables Certification Reuse
PSA Certified Level 2 + Secure Element is available using the GlobalPlatform SESIP Evaluation Methodology enabling chip vendors to achieve both the PSA Certified Level 2 + Secure Element Certification and the GlobalPlatform SESIP “Wheat ear” mark by using the shared Certification Body, TrustCB. By using the SESIP Evaluation Methodology silicon vendors can experience both time-efficient and cost-efficient certifications. This is aided by PSA Certified’s composition certification scheme where the trusted subsystem (integrated with the SoC or an external device) can be certified first, and the results reused in subsequent evaluations.
PSA Certified Level 2 + Secure Element at a Glance
| Audience | Chip Vendors |
| Scope | PSA Root of Trust using a Trusted Subsystem |
| Threats | See PSA Certified Attack Methods document |
| SRFs | Detailed in the PSA Certified Level 2 SESIP Profile |
| Evaluation Effort | Check with evaluation lab (white box) |
Scope of the evaluation
How it Works
This evaluation is a two-step process:
- If the external Secure Element or the on chip Secure Enclave is not already suitably certified it needs to be PSA Certified by an approved PSA Certified evaluation laboratory using the PSA Certified Level 3 RoT Component SESIP Profile. This provides the required augmented security assurance. A full list of necessary augmented Security Functional Requirements (SFRs) can be found in the PSA Certified Level 2 SESIP Profile v1.0 document.
- The evaluation labs will use vulnerability analysis and penetration testing using the PSA Certified Level 2 flow considering the PSA-RoT as the combination of on-chip trusted hardware and firmware together with the external Secure Element or the integrated Secure Enclave. The lab will review the test plan and the results with the Certification Body who will determine if the certificate is awarded.
Quote
Renesas is committed to PSA Certified as the foundation for IoT device security. Renesas’ RA MCU Family has already attained PSA Certified Level 1 and PSA Certified Level 2 certifications and we welcome the launch of PSA Certified Level 2 + Secure Element as next steps. Renesas provide a unique value proposition to customers who require PSA Certified Level 2 + Secure Element certification, having integrated secure element functionality inside our microcontrollers for many years. This integration ensures asset protection and simplifies product development with optimal performance/protection against both physical and remote attacks that target cost-sensitive IoT devices.
Quote
Infineon welcomes the prospect of the new PSA Certified Level 2 certification. It totally aligns with our commitment to make the IoT work by simplifying the integration and delivery of security – so OEMs can bring reliable products to market – more quickly. ‘PSA Certified Level 2 + Secure Element’ brings a number of compelling advantages to OEMs. Enabling scalable security across applications and products, it further simplifies the integration of security into IoT products while also increasing the level of coverage afforded by existing MCU or MPU architectures. Last but not least, precertification offers the added bonus of accelerated time-to-market and lower development costs