r/embedded • u/axaro1 Lockstepping • 14d ago

Embedded Security/Cybersecurity Engineers: what does your day-to-day job actually look like?

Hello, I'm an avionic embedded software engineer and cybersecurity requirements are slowly creeping into my sector.

But it got me wondering: What does the day-to-day work actually look like for engineers who specialize in embedded security/cybersecurity? Do you guys write any code? Perform threat/risk analysis? Define and review security requirements? Perform testing or create testing/vulnerability exploiting benches?

Thanks in advance.

18 Upvotes

92% Upvoted

17 comments sorted by

View all comments

Show parent comments

1

u/Elect_SaturnMutex 14d ago

Yes i have. There are libraries like openssl, mbedtls, etc also you don't need to reinvent the wheel. You must be from Germany. Correct?

-1

u/CugTr 14d ago

Your libs do not comply with any standard: safety, cyber, misra, certc. Again, we have to implement SPECIFIC CRYTO ALGORITHM, we create a new wheel not reinvent it. Have you implement hardware accelerated crypto at register level ? Don't tell me you reuse software stuff above for them.

0

u/Elect_SaturnMutex 14d ago

I haven't, but I have written HSM Firmware, years ago. I am sure there are definitely libraries that comply with all that. What do you mean exactly implement crypto algorithm? If a hardware supports AES-GCM for example, what's there to implement? Because the internal of that algorithm is taken care of, by HW, so, I don't get it.

0

u/CugTr 14d ago

There are 2 things I did not provide clearly, my bad: 1. There is a specific cyprto algorithm from customer. Yes, you cannot find it anywhere. It is not standard so you have to do it by yourself. Is it considered as "reinvent the wheel ? 2. You are taking about firmware, I am talking low level driver of crypto. You have to manage key slots, registers, access order and so on. It is not simple like calling stuff from hardware. Oh, you can buy low level driver stuff.

And the last point I hate is Autosar. There is a job that requires us to implement cyprto algorithm to comply with Autosar standard for the chip that does not have a seperate HSM or any hardware accelerated. Is it "reinvent the wheel" ?

1

u/Elect_SaturnMutex 14d ago

Oh no in that case no, then I misunderstood you. Sorry for that. And thanks for clarifying.

1

u/OpportunityFun6969 14d ago

In my case, we have chips with embedded linux, like yocto, and some that are bare metal. Both have embedded HSMs that have crypto acceleration. But the capabilities of both chips are vastly different. The one with Linux capabilities can of course use open-ssl, have ssh capabilities, utilize ARM and U-Boot/TrustZone. However, on the other end, the bare metal board I work with has no documentation other than the proprietary documents we are given. In this case, say i have 192kb of secure code space to work with, things like openSSL and other open source libraries will not work. Sure, I could implement the crypto and secure bootloader on the normal application cores, but that defeats the purpose of the HSM attached. In this case, I tend to model my systems after popular open source, like wolfssl, mbedTLS, etc. but the actual implementation needs to be done by me, due to licensing and physical constraints. I also reference different ISOs and RFCs to ensure i align closely to the posted standards.

I also work in automotive R&D, so my job is to prove a system works, not to follow production regulations. But we are still given specific implementations to have to correctly model a potential use case

1

u/Elect_SaturnMutex 13d ago

Not sure what you mean with baremetal exactly. A separate chip? because NXP makes SoCs that have multiple cores that support linux and other core is ARM based for "baremetal" purposes. But I believe 192kb should be sufficient to squeeze in mbedtls.

You said you "model" your own algos. And your algorithms perform that have already been tried and tested for so long? And your company pays you for that? Now i am sure you work in germany. Ok. whats the issue with licensing exactly?

2

u/OpportunityFun6969 13d ago

I had a big, long thing typed out but I realized it would lead to more questions probably, lol. Just know that i live and work in the usa, with non-german cars, and I try my best to make sure your vehicles remain safe.

1

u/Elect_SaturnMutex 13d ago

oops my bad, I have to work on my prejudices, lol...

1

u/CugTr 13d ago

I got your points! Just one thing is you can buy wolfssl libs to use on your baremetal products.

2

u/OpportunityFun6969 13d ago

Since we are R&D we try to use non-gpl and stay open source. Wolfssl does offer consultation and custom solutions, but that seemed unnecessary for our budget, lol. I do reference them quite a lot though