I have a security concern about private key storage for SSL. According to documentation, AT+KPRIVKSTORE? can be used to read back the private key for the client certificate. Isn’t this a security problem? Like anyone who gets his hands on the module (or its UART lines, to be more specific) could read back the private key. Shouldn’t the private key be write-only? Or am I missing something?
Hi jakub.polonsky,
That’s the behavior on the HL78xx. AT+KPRIVKSTORE? can be used to read back the private key for the client certificate. I don’t find any command or option to private key be write-only.
OK, thank you for confirmation. It does not feel very secure. If we ship the product, then with some not-so-hard reverse engineering, the private key can be obtained. I know we should generate unique key for every device so only one can become compromised at a time but still…
Can I propose a feature that would prevent readout of the private key? For example a separate AT command that will block the readout until the key is overwritten or erased. Similar to a readout protection of a typical MCU.
Hi jakub.polonsky ,
Please contact your distributor directly to propose a feature.
Yes, that’s a valid concern. Ideally, the private key should be write-only to prevent exposure. If AT+KPRIVKSTORE? allows reading it back, then anyone with UART access could extract it, which is a security risk. Best practice is to disable read-back or use a secure element that enforces key confidentiality.
Hi,
I wanted to ask about secure element, it is mentioned for the modules HL7900 and HL7900E (in their product overview pages) that they have secure element, but I have not found it in the documentation available for these modules.
Can you specify which document has information and details about it or provide me with such a document ?
I have looked into:
- HL7900 AT Command Guide
- Product Technical Specification HL7900/HL7900E
- Cybersecurity Design Guidelines for Module Integration 2174395-Rev 2
But I could not find “secure element” specifically mentioned in any of these documents.
Kindly feedback.
Thanks,
Imran
How about at+kcertstore command for ssl communication?
I remember the firmware has secure boot feature, so only signed firmware can be downloaded to the module
What I want to confirm is that does HL7900 module provide built in “secure element” or it is provided separately ?
can you be more specific that what feature are you asking actually?
Sir, I am talking about “secure element” for HL7900 module as its page says, “Security keys encrypted are stored in a secure element.” So I am interested in knowing where it is documented, similarly I also want the related document for “secure boot” ?
i don’t see there is specific application note that is talking about this “secure element” or “secure boot”
But if you are talking about SSL communication, you can see AT command user guide for at+kcertstore command
For secure boot, it means the official firmware is signed by Sierra, you cannot download any other modem firmware to it for security concern.