English
Menu

What is DICE (Device Identifier Composition Engine)?

A scheme defined by the TCG (Trusted Computing Group) that derives per-layer secrets and keys with one-way functions from a device-unique secret and the measurements of the firmware of each layer that boots. Each layer, after creating the next layer's secret, makes its own secret unreadable before handing over control. When firmware changes, the derived keys change too, so tampered firmware cannot use the correct keys. It provides device identity and attestation even on small microcontrollers without a TPM.

Japanese name: DICE(Device Identifier Composition Engine)

DICE (Device Identifier Composition Engine) appears in 1 practice question across 1 topic, including Hardware Security: Advanced Topics and Trends.

Field: Hardware Security: Advanced Topics and Trends

Deriving secrets layer by layer

At manufacturing, each device is given a unique secret (UDS: Unique Device Secret) in fuses, a PUF or similar. At power-on, the small piece of hardware or ROM code that runs first derives a secret called the CDI (Compound Device Identifier) from the UDS and the hash of the firmware that runs next using a one-way function, makes the UDS unreadable and hands over control. The next layer likewise derives the next CDI from its own CDI and the measurement of the following layer and erases its own CDI before moving on. In this way each layer's secret is bound to the contents of all firmware booted up to that layer.

Keys and certificates

Each layer can deterministically derive a signing key pair from its CDI. The device identity key (DeviceID) derived by the first layer does not change as long as that firmware stays the same, so the manufacturer can issue a certificate for it at production. For keys of higher layers (such as Alias keys) the layer below issues a certificate that includes the measurements, and the certificate chain shows to outsiders which device is running which firmware. This is the basis of attestation with DICE.

Benefits and caveats

The hardware needed is only a way to protect the UDS and a small circuit or ROM code that computes the one-way function, so it is easy to add even to inexpensive microcontrollers. Even if a later layer has a vulnerability and is taken over, the CDIs of earlier layers and the UDS have been erased and do not leak. On the other hand, because updating firmware changes the derived keys, procedures such as issuing new certificates after an update have to be designed in.

Try it: questions about DICE (Device Identifier Composition Engine)

Which correctly describes the mechanism of DICE (Device Identifier Composition Engine) defined by the TCG?

  1. AThe same secret value is placed in every device, and even when firmware is updated and changes, the same key as at manufacturing continues to be used forever
  2. BA new key is downloaded from a server over the network at every boot, and the device is made to hold no secret value at all
  3. CEach layer's secret is derived from the device-unique secret and the measurement of the next layer's firmware, and each layer makes its own secret unreadable before moving on
Show answer and explanation

Answer: C. Each layer's secret is derived from the device-unique secret and the measurement of the next layer's firmware, and each layer makes its own secret unreadable before moving on

In DICE, the small piece of hardware or ROM code that runs right after power-on derives a secret called the CDI with a one-way function from the device-unique secret (UDS) and the hash of the firmware that runs first. That firmware in turn uses the measurement of the next layer to derive the next layer's CDI and erases its own CDI before handing over control. If firmware is rewritten, the derived secrets change, so tampered firmware cannot claim the correct key, and even if a later layer is taken over, the secrets of earlier layers do not leak. Device identity and attestation can be realized with little hardware even on small microcontrollers without a TPM.

FAQ

What is the difference between DICE and a TPM?

A TPM is a separate component (or function) that stores keys, records measurements and signs, and it needs a fair amount of circuitry. DICE defines a procedure for deriving keys from measurements, can be realized with very little hardware, and reflects the measurements in the keys themselves rather than in a log. The goals are similar, but the means of protection and the required scale differ.

Is it a problem that keys change when firmware is updated?

The change is itself a security benefit: keys of old firmware can no longer be used after an update. In practice the device identity key is derived from a layer that does not change, and new certificates are issued for the keys of layers that do change at every update, so different layers are treated differently.

DICE (Device Identifier Composition Engine) in the explanations

Questions that mention DICE (Device Identifier Composition Engine) (1)

  1. Which correctly describes the mechanism of DICE (Device Identifier Composition Engine) defined by the TCG?

Books on Hardware Security: Advanced Topics and Trends Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

Trusted Platform Module (TPM) Arm CCA (Confidential Compute Architecture) CHERI Confidential computing Control-flow integrity FIPS 140-3 Hardware bill of materials (HBOM) Laser fault injection Logic locking Memory Tagging Extension (MTE)

Back to the glossary