Veritize™ Security

Level 5 Security Posture

Hardware Root of Trust — The highest level of security where cryptographic operations are bound to dedicated, tamper-resistant security processors.

TPM • Secure Enclave • StrongBox • Secure Elements

Security Level Hierarchy

5

Hardware Root of Trust

Cryptographic keys stored in dedicated security chips (TPM, Secure Enclave, StrongBox, SE). Keys never leave the hardware. Tamper-resistant. This is what Veritize uses.

4

TEE (Trusted Execution Environment)

Software-isolated secure zone on the main processor. Better than software-only, but keys are technically accessible to the CPU.

3

Encrypted Keystore

Keys encrypted at rest on disk with OS-level protection. Vulnerable to memory attacks and privileged access.

2

Password-Protected Keys

Keys stored in files protected by password. Can be extracted with physical access or memory forensics.

1

Plain Text Keys

Keys stored unencrypted on disk or in config files. No security — anyone with access can copy them.

Hardware Root of Trust by Platform

PC (Windows/Linux)

TPM 2.0 (Trusted Platform Module)

What It Is

A physical chip (or firmware-based fTPM) soldered to the motherboard. Provides a hardware-isolated environment for cryptographic operations.

  • ISO/IEC 11889 international standard
  • Required for Windows 11
  • Available on most business PCs since 2016

Key Capabilities

  • RSA/ECC Key Generation — Keys created inside chip, never exportable
  • PCR Registers — Platform Configuration Registers measure boot integrity
  • Sealed Storage — Data encrypted to specific system state
  • Remote Attestation — Prove system integrity over network

Veritize Integration

The Verity Bridge signs the "Pulse" heartbeat using the TPM, ensuring the request came from the actual physical motherboard of an authorized device.

  • Verifies Endorsement Key (EK) against whitelist
  • Validates PCR measurements for OS integrity
  • Signs timestamps with non-exportable keys

Apple (iOS/macOS)

Secure Enclave Processor (SEP)

What It Is

A dedicated RISC processor with its own secure boot, completely isolated from the main CPU. Even Apple cannot extract keys from it.

  • Present on all Apple devices since A7 chip (2013)
  • Physical separation from application processor
  • Handles Face ID, Touch ID, Apple Pay

Key Capabilities

  • DeviceCheck — Permanent device identity bits
  • App Attest — Cryptographic proof of app authenticity
  • Secure Key Storage — Keys bound to Secure Enclave
  • Biometric Binding — Operations require Face/Touch ID

Veritize Integration

The Veritize mobile app uses App Attest to create permanent, hardware-bound keys that can only be used by your app on that specific iPhone.

  • Validates key_id generated by Secure Enclave
  • Prevents cloned or emulated devices
  • Biometric confirmation for high-value signatures

Android

StrongBox Keymaster

What It Is

A discrete physical chip (like Google's Titan M) with its own CPU, RAM, and secure storage — the equivalent of a "PC TPM" inside a smartphone.

  • Required for Android 9+ on high-security devices
  • Google Titan M, Samsung Knox, Qualcomm SPU
  • Separate from main application processor

Key Capabilities

  • Hardware Key Attestation — Proves keys are in secure hardware
  • TEE Fallback — Uses TEE if StrongBox unavailable
  • Key Use Authorization — Biometric/PIN required for operations
  • Anti-Rollback — Prevents downgrade attacks

Veritize Integration

Android uses a tiered approach. While many phones have TEE, high-security devices use StrongBox for the strongest guarantees.

  • Checks for STRONGBOX flag in attestation certificate
  • Falls back to TEE with appropriate trust level marking
  • Validates Google's attestation root certificate

IoT / Industrial

Secure Element (SE) / HSM

What It Is

Dedicated low-power cryptographic chips for devices without full operating systems. Provides immutable hardware identity for sensors and industrial equipment.

  • Microchip ATECC608 — Common in Arduino/IoT
  • STSafe — STMicroelectronics industrial SE
  • NXP SE050 — Edge computing SE

Key Capabilities

  • Hardware UUID — Unique, unclonable device identity
  • Secure Boot — Validates firmware before execution
  • Low Power — Operates on battery for years
  • Tamper Detection — Physical intrusion alerts

Veritize Integration

IoT devices store the "Golden Master" hash in the Secure Element. All sensor data is signed to prove it wasn't intercepted or modified.

  • Man-in-the-Middle (MITM) protection
  • Firmware integrity verification
  • Oyster sensor environmental data signing

Verity Bridge Integration

The verity_bridge_vsign module differentiates between hardware attestation types

Device Request

Sign request arrives

Detect Platform

Identify hardware type

Validate Attestation

Verify hardware proof

Issue Seal

Verity Time Seal™

# Verity Bridge Attestation Routing

attestation_type = detect_platform(request)

if attestation_type == "APPLE_SECURE_ENCLAVE":
    validate_key_id(request.key_id)

elif attestation_type == "ANDROID_STRONGBOX":
    verify_strongbox_flag(request.attestation_cert)

elif attestation_type == "PC_TPM_20":
    verify_endorsement_key(request.ek, whitelist)

elif attestation_type == "IOT_SECURE_ELEMENT":
    verify_se_signature(request.device_id, request.signature)

The Trust Trinity

Hardware Trust

TPM / SEP / StrongBox binds identity to physical device

+

Trusted Time

RFC 3161 TSA proves WHEN it happened

+

Blockchain Anchor

Immutable ledger proves it was never changed

= Verity Time Seal™ — Unbreakable chain of cryptographic proof

Standards & Certifications

ISO/IEC 11889

TPM 2.0 International Standard

FIPS 140-2

Cryptographic Module Validation

Common Criteria

EAL4+ Security Evaluation

GlobalPlatform

TEE/SE Specifications

RFC 3161

Time-Stamp Protocol

ETSI EN 319 421

Electronic Signatures

Ready for Level 5 Security?

Leverage hardware root of trust across all your devices with Veritize

Get Started Explore vSign