tillitis-key/doc/threat_model/threat_model.md

# Threat model

## Introduction
The Tillitis Key 1 is a platform for running secure applications in a
restricted execution environment physically separate from the
device host. The secure applications provide functionality and
controlled access to derived secrets on the device. The purpose of the
device is to solve typical end user authentication problems.

This document describes the threat model for device. Based on the
system description and use cases, the threat model tries to capture and
describe the threats that needs to be mitigated in order for the
device to meet its purpose and objectives.


## Version information
The threat model will get updated and expanded for each release.

### engineering-release-1
This is an early release aimed at developers interested
in writing applications for Tillitis Key 1. The design allows easy access to
the board, and is even shipped with a programmer to download new FPGA bitstreams.


#### Known weakneses
The bitstream, which includes the Unique Device Secret (UDS) as well as the firmware
implementing the measured boot are stored as part of the bitstream in an external
Flash memory connected to the FPFGA.

The CH552 MCU providing USB host communication contains FW that implements the UART
communication with the FPGA. The firmware can be updated by performing *port knocking*.
The knock sequence is to apply 3.3V through a 10k resistor to the D+ line,
while powering on the device.

There may be possible buffer overflows via the USB host interface to the FW of the CH552,
allowing both execution and modification of the FW CH552.


#### Out of scope
- All physical and electrical attacks applied to the board, including:
  - Reading out of the UDS from the external Flash chip
  - Triggering of the FPGA warm boot functionality
  - Triggering FW update of the CH552 MCU, using the port knocking mechanism

- Glitching attacks including:
  - Faulting of the execution by the CPU in the FPGA and the CH552 MCU
  - Disturbance of the TRNG entropy generation

- EM leakage


#### In scope
(Attacks we really would like to have investigated.)

- Digital attacks from the host against the FW in the FPGA, and the FPGA design itself
  via the host interface.

- Timing attacks on the FW in the FPGA.