Is there a PUF in the SE050?

[le_lathrop]

Hello,

I recently read the SE050 Common Criteria Security Target. https://www.commoncriteriaportal.org/files/epfiles/[ST-LITE]%20JCOP4_P71_SecurityTargetLite_v3.4.pdf

One of the features it describes to increase security is a PUF (e.g. on pages 6, 72, and 85). 

However, there is no mention of a PUF in the SE050 datasheet or the APDU specification AN12413. 

Does the SE050 have a PUF in it to increase security? 

Thank you in advance for answering my question. 

[le_lathrop]

Dear Kan,

we would like to have the PUF function to protect from invasive physical attacks such as probing attacks. Is the presence of a PUF in the SE050 not a yes or no question? I thought that the SFRs listed in the Security Target have to be included in the actual product. Is this incorrect? If it is not, did I perhaps not indicate the link to the correct Security Target? In which case, could you direct me to the correct Security Target?

Thank you for your effort. 

Best Regards.

[Kan_Li]

Hello @le_lathrop ,

I just got the feedback from the expert, please kindly refer to the following for details.

A secure element like SE050 is already by default built to be highly resistant against probing attacks. See CC EAL6+ cert at AVA_VAN5 covering also probing attacks.

Although the PUF functionality is available in SE050 HW it is not enabled on SW level for the targeted IoT use cases as the additional protection provided by PUF is not needed.

Hope that helps,

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[Kan_Li]

Hi @le_lathrop ,

Why do you need a function like PUF to increase the security? Is there any special requirement for your application? Please kindly clarify.

Thanks for your patience!

Best Regards,

Kan