LeMonolith, a personal Network HSM (pNHSM) for the Ethereum community

Transcript

[Musique] Hi everybody Pascal Rener C of the Earth company and I am also emerit professor Paris part of institute polytechnique France topic of talk is le monolite personal network HSM PNHSM for the EM community so this presentation focus on trusted

key storage and secure signatures to critical areas for community present open Arduino Java card low personal network HSM included EL6 plus securement and supporting communication interface such as USB bluetooth and wifi in January 2025 the PNSM project receives the consumer embeded Iotic trophy awarded by the edited friends association PNHSM is volt for secure Ethereum for Ethereum users every Ethereum account is

tied to couple of public and private key of which size is 32 byte secure storage for the private key is essential each etherum transaction is signed with a priv key protection Bard modules electronic passports requirements.

Le monolite is secure element with multiple communication interfaces protected by N2 TLS 1.3 pressure key PSK channel. The size of PSK secret is 256 bits. Some key word we use in this talk TLSC stand for TLS in security it is TLS 1.3 free PSK server for secure element stand for secure element name. It is a name that identify TLS server TLS IM

stand for TLS identity module it is token that perform two procedures involving pressure key. structols2 system chip and java card32 is quite popular in 202 overlion worldwise of Javaardion Javaarducely Javaardone

Java pulls. Javaardware integrated environment ID monolit.in it includes SCI library that we develop it for many years and that is compatible with multiple hardware platforms

on the Java card sides applications such as TLA. Java, TLSC.java Java CC for cryptourrency Java are developed with Oracle Java car development kit on the right side and on the top you see the upper size of the board with a Java card which seem to FF classical format on the bottom sides of the board is the SCP 32 sock the board is inserted in the in a case and this constitutes le monolite white 45 gr and size about 5 by 2 cm.

There is a development kit which is L for monolite development kit is set tools performing operation software downloading for soft and Java card. Javaard use the USB interface to say it is Javaard reader smart card use TLS interface over wifi to say un TLS session with the secure element wifi TLS server secure by TLSIM software

Javaard reser is available over WiFi and it is used to download Javaard TSS server services over Bluetooth. Well, the USB interface is used to download code le monolit. softwarec and cc software downloading secur is protected by dedicated symmetric keys according to

global platform standards like bank cards for example every contact payment required for rsc calculation javacard software may include pair of public private key and certificate. So it's possible to prove at run time that securement is green according to the following procedures. read public key read and check certificate and third s random number and verify signature generated with the application private key two classes of Etherum services are

available over the USB interface smart cards interface over serial USB cryptocurrency CC Java card application key store facilities such as key set key, generate key delete key sign and so on through ISO 7816 commands dedicated serial USB shell a shell based on text command line support key store facilities such set key generate del key sign and recoverble compute etum

legis type updated here isation of ser USB shell for ethereum on the left number one you see a set of command to generate key and to collect address numbericated website crypton for the blockchain which is Ethereum test blockchain now able number to generate transaction with the key

index 2 and afterise number four you get the headecimal form of the transaction and you post it to dedicated website. API finally number the transaction is forwarded to the blockchain and inserted in the ledger is description of personal HSM for Ethereum over WiFi on the right you see the TLSC application which TLS PSK server on the top of accessore facilities server

identification use the shell to remotely access to thebed key store. PS client protect PSK key client on client side use TLS identity module multiform authentication token compute two procedures needed for TLS

PSK in order to avoid malware interaction blinking indicate to the user use authentication session to be sure that secur according to the following procedures read the public key read certificate s random verify the response as signatures with priv key of the random secret

in summary are interface to the etherum key store the first deal with ISO 78 command it is a set of binary request used to create set key and compute signatures the second work with shell it is a set of text line for example on the secure TSC establish session secure elementp IDC words

multiform authentication token. If you need to achieve a security level for remote connection with TLS secur securement, we introduce features improving the integrity insurance for the MFA token which protects the PSK secret. First is physical identification of the token microcontroller using dynamic puff technique with zero knowledge. Second JavaScript software authentication based on PI means PI means such as spear of public private key certificates and proof of knowledge of private key.

microcontroller firmware integrity time using testation procedure name time stamped objective mac let's talk now about remote Java card administration which is an optional features inside the Java card there is TLSIM application which can be used to protect another TLS PSK server running enable application to dicell sops server in the monolite one tsc is running in the secure element and the

other in the 32 stock many way can be used to differentiate them for example based on cit identity and server Regarding Bluetooth services, we use RFC profile which provid serial por emulation. So again you use a dedicated shell based on text command lines which supports key facilities such as set key, generate key, delete key, sign and recover.

It is also compute etherum transaction. is illustration of mobile application included in the l the mobile use rfc and the shell in order to generate an etherum transaction and afterwards to post it to the blockchain and so there is YouTube and at last but not least it is also

possible over Bluetooth to use TLSS and TLS 1.3 PSK server it means that on mobile there is an etherum application which is able for the shell and TLSPSK client to access to Kistore facilities in order to generate Ethereum transaction and to post it to a dedicated server. TS identity module module may be located in some trusted place in the mobile phone and I wish my conclusion thank you for your attention additional information available on the website

le monolite.com for this very nice thank you very much de guien. [Applaudissements] So signing is happening where exactly? So that does the private key leave the secure element? Uh it never leaves the secure element. Ok. So what if you want to implement another

signature scheme like ED25519 or something else? It's not an issue. You put it in the secure element. So depend on Java card you have several API and last two days the level we use is ECDS but new level 3.0.5 support and some of them also support IDs and so mean it's already supported by Java Carl and after even if you need some specific

crypto blockchain we have partners able to implement whatever crypto you want in fact in Javaard but what will happen when you have a Java card Java card we use fact are compatible with quite all the Java card except you are working with the at least the minimum level we need is 3.0.4 But this Javaard are in France certified by the national security agency NC.

So mean if you modify the software inside what happens that you are going to lose your certification critification up to you not all provider crypto provider need criteria specification not the market certification issard in fact we are more interested what happen today because we is differ that support is

security with that is certified with proven protocols like TLS use TLS every secure internets is broken mean internet broken and today we let more interested to support postantum cryptography as it is today this variant of ts is resistant to attack because it kind of cryptography one symmetri can broken quantum

computer of security and is used for key diversification and this is based on elliptic curve the same thing ethereum and this can be broken by quantum computers in futures to be established and we are thinking to support postantum crypto exchange for man for the next generation but we are not in for that because even standardation there is not common vision today what is needed and

what kind of cryptography is needed even if you have some cryptoorm the vision many debate for that security community Thank you very much. Yeah.