Google has announced that fabrication has begun on OpenTitan silicon, and it is being manufactured by the semiconductor manufacturer Nuvoton.
OpenTitan is an open source silicon Root of Trust (RoT), a secure microcontroller. According to Google, the key to securing devices is to “start where you have certainty and build up a chain of trust.” Web communications rely on Certificate Authorities (CAs) for this, whereas products that contain a multitude of interconnected hardware and software rely on RoTs.
Google began building OpenTitan six years ago because the existing solutions didn’t have the level of transparency and visibility needed. “Without full transparency, it is impossible to completely understand the security assurances for products using these proprietary parts. In addition, it was becoming harder to meet product needs with off-the-shelf RoT solutions, from footprint to function to cost – we needed a better solution for Chromebooks, Cloud, and later, Pixel,” the company wrote in a post.
OpenTitan was built in partnership with commercial, academic, and non-profit partners, and is hosted by lowRISC CIC in Cambridge UK.
Google and OpenTitan partners like Nuvoton, ETH Zurich, G+D Mobile Security, lowRISC, Rivos, Seagate, Western Digital, Winbond, and zeroRISC have provided hardware register-transfer level (RTL) and design verification (DV) code, integration guidelines, and reference firmware for driving adoption.
Since its inception, the OpenTitan project has over 24,200 commits, 176 contributors, and over 1.5 million lines of code, according to Google.
“With the introduction of production-ready OpenTitan chips, we are excited to welcome an era where security is based on transparency from the very beginning of the stack. OpenTitan is the first commercially available open source RoT to support PQC secure boot based on SLH-DSA (formerly known as SPHINCS+). Our vision is that these chips will help drive broader industry adoption not only of open designs and their security properties, but also of this innovative method of open source collaboration between organizations,” Google wrote.
