EdgeLock SE050/SE051 Capability Inquiry for Ed25519/X25519-Based IoT Device

[SahilPai]

Hello NXP Team,

We are evaluating the EdgeLock SE050/SE051 family for a Raspberry Pi based IoT device and would appreciate guidance on the most suitable part number.

Our primary requirements are secure storage and hardware execution of cryptographic operations.

The device is a Raspberry Pi 4 - running Raspberry Pi OS (Linux).

We would like clarification on the following points:

1. Key Storage
  
   - Can the SE050/SE051 securely store non-exportable private keys?
   - Can certificates and public keys be stored in the secure element?

2. Key Generation
  
   - Can the secure element generate key pairs internally?
   - Specifically, does it support generation of Ed25519 and X25519 key pairs within the secure element?

3. Ed25519 Operations
  
   - Can Ed25519 signing and signature verification be supported inside the secure element?

4. X25519 Operations
  
   - Can X25519 key agreement (ECDH shared secret computation) be performed inside the secure element using a non-exportable private key?

5. AES Operations
  

   - Does the secure element support AES encryption and decryption operations?
   - If so, which AES modes are supported?

6. Storage read/write

   - Storing/removing/accessing files like wifi passwords?

7. Linux / Raspberry Pi Integration
  
   - Is there an SDK or middleware available for Raspberry Pi OS?
   - Are there example applications demonstrating the above operations?

8. Product Selection
  
   - Which EdgeLock SE050/SE051 variant would you recommend for the above requirements?
   - What are the major differences between the recommended variants?
   - Are there any newer EdgeLock products that would be a better fit for these requirements?

Our intended use case is:

- Ed25519 signing for device authentication / JWT generation
- X25519 key agreement for mobile-device provisioning
- AES encryption/decryption using derived session keys

- Storage and handling of security files like Wifi passwords etc
- Large-scale deployment of IoT devices

If available, we would also appreciate links to any of these:

- Relevant datasheets
- Application notes
- SDK documentation
- Evaluation boards
- Linux/Raspberry Pi examples

Thank you for your assistance.

Best regards,
Sahil Pai

[Kan_Li]

Hi @SahilPai ,

Please kindly have my comments as below:

1. Key Storage
  
   - Can the SE050/SE051 securely store non-exportable private keys? //Yes, private keys are non-exportable on SE05x.
   - Can certificates and public keys be stored in the secure element? // Yes, certs are stored as binary files within the SE , and public key can be stored standalone or together with the private key in SE05x.

2. Key Generation
  
   - Can the secure element generate key pairs internally?// Yes, it supports.
   - Specifically, does it support generation of Ed25519 and X25519 key pairs within the secure element?// Yes, Ed25519 and X25519 key pairs are supported.

3. Ed25519 Operations
  
   - Can Ed25519 signing and signature verification be supported inside the secure element?// Yes, Ed25519 signing and signature verification are supported inside the SE05x.

4. X25519 Operations
  
   - Can X25519 key agreement (ECDH shared secret computation) be performed inside the secure element using a non-exportable private key? //Yes, ECDH is performed with a private key within SE05x and an external  public key which can be stored in SE05x as well.

5. AES Operations
  

   - Does the secure element support AES encryption and decryption operations? //Yes,
   - If so, which AES modes are supported?// Support for AES Modes:CBC, ECB, CTR, GCM, CCM.

6. Storage read/write

   - Storing/removing/accessing files like wifi passwords?//Yes, SE050/SE051 can store binary objects in its secure object store, including Wi-Fi credentials.

7. Linux / Raspberry Pi Integration
  
   - Is there an SDK or middleware available for Raspberry Pi OS?// Yes, please refer to https://www.nxp.com/webapp/Download?colCode=SE05x-PLUG-TRUST-MW&appType=license for details.
   - Are there example applications demonstrating the above operations?//Yes.

8. Product Selection
  
   - Which EdgeLock SE050/SE051 variant would you recommend for the above requirements?// Either SE050E2 or SE051C2 can be used.
   - What are the major differences between the recommended variants?// They both have the latest applet version, but SE051 supports applet upgrade while SE050 doesn't.
   - Are there any newer EdgeLock products that would be a better fit for these requirements?//not yet so far.

Please kindly refer to https://www.nxp.com/products/SE050 and https://www.nxp.com/products/SE051 for more details.

Hope that helps,

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------