We're working with a microcontroller that is not secure enough to store secrets. The ROM could be dumped in a properly equiped lab.
This is why we considered integrating a certified Secure Element that would store the secrets we need for our infrastructure (some keys and certificates). This way the secret would be stored in a valid device regarding security standards.
However, in this new architecture, the Secure Element would be deported from the host microcontroller, which requires to secure the communication between the SE and the Host.
Yet, all the current authentication methods we know require to store something (a secret, a key a certificate), what we cannot do because the microcontroller is not secure enough...
That leads to two questions:
- What is the purpose of integrating a Secure Element or Secure Access Module to address the needs of secret storage for an infrastructure if it requires another secret for connection?
- Is there any authentication method that would not require secret, but would garantee anyway identities?