As a preface, what I am asking is highly related to this question. That said, the question linked was asked in 2011 (7 years ago), and I imagine the microcontroller world has changed (at least to some degree) since that time.

I want to include sensitive info as part of a program on some sort of uC - AVR, ARM, whatever. I want to protect this data against people who obtain physical access to the device (if I lose it, or if it's stolen). I want to be able to easily reprogram/re-flash this device. I am assuming I have a perfect (but not otherwise useful) method of authenticating myself to the device that an attacker wouldn't have - so it knows it's me, but I can't use this authentication to, say, generate an encryption key or anything like that. How can I protect my code?

Additional information: I know there are fuses to prevent hex dumps, and may just have to use those depending on the answers to this question. I know they can be defeated by de-lidding and laser-probing the uC, but they'll keep your average hobbyist out. Unfortunately, those also make reflashing more difficult, requiring an external programmer (which is undesirable). I'm OK with having to add some additionally circuitry/components to the device, I really just need to see what's possible (and what's changed since 2011).


I have been asked for more clarity regarding my specific problem, so I'll add it in here. I'll note that I originally decided against it because (1) I don't want to bottleneck answers into a specific vein of thought, and (2) I figured I would get more "don't do this"-type answers that useful ones. With that said:

I'm working on a hardware password manager. I know, there are a bunch of these out right now. This one would read a fingerprint, and type a corresponding password (acting as a USB keyboard). If the source code on the uC is secure, then I feel (given my potential attack vectors) this will be secure enough for my own personal use - will I recommend it to a government agency? Obviously not. The uC uses a special key to communicate with the fingerprint scanner, and the fingerprint scanner can respond with a digital representation of the fingerprint that could be used to decrypt a password stored on the uC.

The main problem: If physical access to the device is obtained, an attacker could obtain the special key from the uC, get the fingerprint (stored on the scanner for comparison), and decrypt the password stored on the uC again. If the uC (or the hex from the uC) is not readable, an attacker cannot as easily obtain this information. Thus: how do I keep the information secure, while still being able to easily-enough reprogram the uC?

  • 3
    \$\begingroup\$ If you assume the existence of magic (perfect authentication), then anything is possible. But if you want anyone else to reason logically in your universe, you have to lay out the ground rules in a lot more detail. As it stands, this question is far too vague and/or broad to usefully address here. Perhaps you would do better to lay out the actual problem that you're trying to solve, rather than presupposing a solution. \$\endgroup\$ – Dave Tweed Nov 2 '18 at 2:11
  • 3
    \$\begingroup\$ Any serious attacker interested in the code would pay the <$2000 and have some specialist do it. Anyone else would only read out the code out of curiosity, not use it elsewhere. Maybe they find a bug in your software and send you a patch. How nice. This whole protection stuff has no use case. \$\endgroup\$ – Janka Nov 2 '18 at 2:12
  • \$\begingroup\$ @DaveTweed, I have edited the question to provide more details. \$\endgroup\$ – Helpful Nov 2 '18 at 2:24
  • \$\begingroup\$ @Janka, I have edited the question to provide more details. \$\endgroup\$ – Helpful Nov 2 '18 at 2:25
  • 1
    \$\begingroup\$ There are a couple of open source Bitcoin hardware wallets, I'd recommend you to look into those to see what makes them tick. \$\endgroup\$ – sx107 Nov 2 '18 at 2:44

Flash & lock the microcontroller with a bootloader which loads encrypted code from external flash into RAM. Then the external flash can be rewritten at will. For bonus points use a microcontroller with some high-security flash for storing the encryption key.

There are also microcontrollers with multiple flash regions- you can put the bootloader on one and lock it and have the encrypted code on the others (perhaps multiple, for safe updates).

If there are vulnerabilities in your code then it can be hijacked and read out from RAM.

  • \$\begingroup\$ A good answer, so is storing an array of various encryption keys in EEPROM to use as the hash for the encryption. But you need to un-encrypt it to be of use, and some of the best encryption schemes require government issued certificates to reverse the process. You can also insert 'garbage' bytes to confuse hackers-to a point. \$\endgroup\$ – user105652 Nov 2 '18 at 4:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.