Root-of-Trust IP - Enhanced-Assurance, Configurable Security for Scalable Semiconductor Designs

KSE3 is a silicon-proven, ultra-compact hardware Root-of-Trust IP for semiconductor manufacturers. Built on a proprietary 32-bit RISC-V secure processor and isolated as a secure enclave from the rest of the SoC, it delivers secure boot, secure updates, cryptographic services, random number generation, secure storage, key management, secure provisioning, and lifecycle security.

KSE3 is engineered to enable SoC and module certification at SESIP Assurance Level 3 and PSA Certified Level 3, targeting AVA_VAN.3 robustness (JIL attack quotation 21–24, "Enhanced Basic"). Crypto-agile and quantum-ready, it supports both classical and post-quantum cryptography, keeping designs ahead of evolving standards and future threats, while remaining among the smallest security IPs for its feature range.

Built for Configurable Security

If you're developing high-volume semiconductor designs where gate count, cost, and footprint are tightly constrained, KSE3 gives you a configurable root of trust that delivers higher-assurance protection matched precisely to each design, so security scales with your product, not against your gate budget.

• Configurable by design, enable only the security services and cryptographic capabilities each product needs, tailored to your requirements
• Optimize gate count, RAM, and ROM for area and cost-constrained designs
• Security platforms used across multiple products — configure the feature set per product without reworking the design each time

Fast, Efficient Integration

• Wrapped-key architecture — unlimited keys stored securely in host memory
• Fast startup — no firmware load at boot; services available immediately
• Compact KSSL software library (~20 KB, ~35 KB with PQC) for RTOS, TEE, or bare metal
• Native PSA / Trusted Firmware-M (TF-M) integration

Security & Cryptographic Services

• Key Management:
 Key generation, derivation, activation & revocation, key cache, and key wrapping — using a unique per-chip OTP secret
• Secure Storage:
 Host data/code protected with per-chip secret HW keys
• Secure Boot & Firmware: Update
 Authenticated with classical and/or post quantum cryptography
• Secure Provisioning:
 Wafer, factory, and in-field; zero-touch onboarding
• Lifecycle & Chipset Configuration Enforcement:
 Controlled access to host hardware resources
• Secure Debug:
 PKI-based debug authorization per the ADAC standard
• Multi-subsystem Isolation:
 Up to three hardware-isolated host subsystems
• Secure Attestation:
 Device and key attestation via IETF RATS / EAT with measured boot
• Monotonic Counters:
 OTP-based, for host secure-boot stages
• keyPROT / keyBUS
: Secure key transfer and communication with external cryptographic modules
• Cryptographic Services:
 Symmetric, Hashing, MAC & KDF, Asymmetric (RSA & ECC), Random Generation, PQC (LMS/ XMSS, ML-KEM, ML-DSA, SLH-DSA), Regional
• UWB Secure Ranging
: SCP11a, CCC, and FiRa key import and SCP11 AES session-key derivation Applications

• AVA_VAN.3 ("Enhanced Basic”): Resistance to attackers with enhanced-basic attack potential (JIL 21-24), strengthened side-channel countermeasures (SPA, CPA/DPA, incl. EM) and advanced fault injection, including electromagnetic and laser fault injection.
• Configurable Architecture: Tailor cryptographic and security services to specific platform requirements while maintaining consistent interfaces and integration flows.
• Certification-Ready Design: Supports SESIP Level 3, PSA Certified Level 3, FIPS 140-3, AVA_VAN.3 (JIL 21 24), IEC 62443, ISO/SAE 21434, and EU CRA (Important Product, "Class II").
• Quantum-Ready Security: Supports crypto agility and quantum resistant cryptography to help address future security requirements.

• Automotive
• Industrial Automation & Control
• Edge AI
• Data Centers
• Embedded MCUs
• IoT & Connected Devices
• Connectivity & Low-power Chipsets
• LoRa Key Protection
• Smart Homes & Cities
• Asset Tracking