↓ Skip to main content
Home
  1. Posts/

Large Project: Hardware-Backed TLS for IoT with SE050 and PSA Crypto

·4 mins·
Embedded Systems IoT Security Cryptography MbedTLS PSA Crypto NXP SE050 Secure Element MQTT Arduino Portenta
Author
Virgola
AI & Cybersecurity Student @ University of Udine X University of Klagenfurt.
Go enthusiast & CTF player @ Madrhacks
Table of Contents

I am excited to present my MSc Large Project, where I developed a hardware-backed TLS solution for IoT environments by integrating the NXP SE050 Secure Element with Arm PSA Crypto and mbedTLS. This project focused on bridging the gap between low-level hardware drivers and standardized cryptographic APIs to protect sensitive key material in resource-constrained devices.

Project Overview
#

The Large Project focused on enhancing device-level security and resilience against key extraction and side-channel attacks. Core components developed include:

  • PSA Crypto Wrapper – Custom C++ abstraction layer mapping standard PSA APIs to the underlying SE05X driver, ensuring hardware-level key opacity.
  • mbedTLS Integration – Configuration and custom glue code to route mbedTLS cryptographic operations transparently through the PSA hardware backend.
  • MQTT-over-TLS Demonstration – End-to-end secure communication setup between the Arduino Portenta C33 and a Mosquitto broker.

This architecture ensures that private keys and critical entropy never leave the secure element, mitigating risks associated with software-only cryptographic implementations.

Technical Details
#

PSA SE05X Wrapper
#

The wrapper bridges the gap between the standardized Arm PSA Crypto API and the hardware-specific SE05X driver. Highlights:

  • Opaque Key Management – Maps psa_key_id_t handles directly to SE050 object IDs, ensuring private keys remain hidden in tamper-resistant storage.
  • Hardware Offloading – Delegates True Random Number Generation (TRNG), SHA-256 hashing, and ECDSA/RSA signing directly to the secure element.
  • Attribute Mapping – Translates PSA key policies, usage flags, and algorithms into SE050 object constraints.

It runs as a transparent middleware layer, allowing applications to interact solely with standard PSA APIs.

mbedTLS & TLS Handshake
#

The integration configures mbedTLS to use PSA Crypto as its primary backend via MBEDTLS_USE_PSA_CRYPTO. Key aspects include:

  • Custom RNG Glue – Bridges mbedTLS entropy requirements with the PSA Crypto random generation interface.
  • Hybrid Execution – Offloads transcript hashing and client random generation to hardware, while keeping ephemeral ECDH and AES-GCM in software due to SE050C2 hardware constraints.
  • Initialization Sequence – Orchestrates secure element boot, persistent key provisioning, and TLS context setup.

Designed for seamless integration, requiring zero hardware-specific code modifications at the application layer.

MQTT Demonstration & Validation
#

To validate the architecture, a complete IoT communication scenario was deployed:

  • Custom MQTT Client – Manually constructed MQTT packets over a TLS 1.2 socket to bypass standard library limitations.
  • Certificate Infrastructure – Utilized self-signed OpenSSL CAs embedded directly in the firmware as C headers.
  • Stress Testing – Validated system stability through a continuous 4-hour test, successfully exchanging 481 messages without cryptographic errors or drops.

This provides a real-world proof of concept for hardware-secured publish-subscribe messaging.

Results
#

The system successfully demonstrated transparent hardware-backed cryptography in a real-world IoT scenario. Observed limitations and challenges include:

  • Hardware Constraints – The SE050C2 variant integrated into the Portenta C33 lacks AES-GCM support, forcing symmetric TLS encryption to remain software-based.
  • ECDH Integration Complexity – mbedTLS internal state machine made fully hardware-offloaded ephemeral key exchange impractical within the project timeframe.
  • Driver Maturity – The baseline SE05X driver lacked detailed error reporting and multi-part operations, complicating debugging and object lifecycle management.

Despite these, the project proved that standardized APIs like PSA Crypto can effectively abstract secure elements, providing robust key protection without rewriting application logic.

Future Directions
#

Potential enhancements:

  • Full ECDH Offloading – Deep integration with mbedTLS internals to move ephemeral key exchange entirely into the SE050.
  • Expanded Cipher Support – Evaluating newer SE050 variants (e.g., SE050E) to enable hardware-accelerated AES-GCM and complete TLS offloading.
  • Client Certificate Authentication – Extending the demo to use hardware-protected keys for mutual TLS (mTLS).
  • Driver Enhancements – Improving the SE05X driver with better error codes, AES-CBC/CTR modes, and multi-part hashing.

This MSc Large Project provided deep insights into embedded security, cryptographic API design, and TLS protocol internals, laying a solid foundation for building resilient, hardware-secured IoT ecosystems.

Learn More
#

For a technical deep dive, including full implementation details, design choiches and system validation, see the Project Report.

Explore the Code: GitHub

Related