Retrofitting Older Platforms for the CRA with a Software SRAM PUF

    • Upgrading legacy hardware to meet modern security standards doesn’t have to mean costly recalls or hardware redesigns. The wolfCrypt SRAM PUF derives a device-unique cryptographic key directly from the power-on state of a chip’s built-in SRAM. This provides a true hardware-rooted secret (100% in firmware) without adding a separate secure element.

    It is a practical, field-deployable solution to bring existing MCUs into alignment with the EU Cyber Resilience Act (CRA).

    How It Works & Key Benefits

    • Zero-Storage Key Generation: Derives a unique key from SRAM power-on noise using a BCH(127,k,t) fuzzy extractor combined with HKDF. Because no device-unique secrets are stored in flash, dumping the chip’s memory reveals only public helper data and never the key.
    • Pure Firmware Solution: Runs on virtually any MCU that can sample an uninitialized SRAM region at boot. It requires no physical secure elements, no one-time-programmable (OTP) fuses, and zero key-provisioning steps on the factory floor.
    • Ephemeral & Secure: The key is reconstructed on-demand at boot and can be zeroized immediately after use, minimizing the attack window.
    • Built-in Tamper & Health Checks: Includes integrated health monitoring that rejects any readout failing to display genuine SRAM power-on noise. If a board has biased or degraded SRAM, it fails loudly rather than producing a weak or predictable key.
    • Flexible Footprint: Tailor memory and performance requirements with configurable security profiles (–enable-puf=small|balanced|strong|strongest) to fit even severely constrained parts.

    Bridging the EU Cyber Resilience Act Gap

    The CRA requires manufacturers to protect data at rest and ensure every device carries a secure, verifiable identity. On legacy platforms engineered before these requirements existed, retrofitting dedicated security hardware is rarely viable.

    By leveraging the SRAM already present on the chip, wolfCrypt SRAM PUF turns existing hardware into its own root of trust; delivered entirely via a standard firmware update to devices already out in the field.

    Resources & Links

    Download wolfSSL Now