Humanoid Security Platform — Cryptographic Key Hierarchy

Zero Plaintext Key Architecture: SoftHSMv2 Build Pipeline & Secure World Isolation

Humanoid Security Platform — Cryptographic Key Hierarchy Zero Plaintext Key Architecture: SoftHSMv2 Build Pipeline & Secure World Isolation OEM Root CA Key · RSA 4096 / P-384 · Tier 1: Offline Signing Environment (SoftHSMv2 / Enterprise HSM) · Offline Vault OEM Root CA Key RSA 4096 / P-384 Offline Vault Kernel Module Key · RSA 3072 / SHA-256 · Tier 1: Offline Signing Environment (SoftHSMv2 / Enterprise HSM) · pkcs11 URI Kernel Module Key RSA 3072 / SHA-256 pkcs11 URI dm-verity Key · RSA 3072 / PSS · Tier 1: Offline Signing Environment (SoftHSMv2 / Enterprise HSM) · pkcs11 URI dm-verity Key RSA 3072 / PSS pkcs11 URI IMA Signing Key · ECDSA P-384 · Tier 1: Offline Signing Environment (SoftHSMv2 / Enterprise HSM) · pkcs11 URI IMA Signing Key ECDSA P-384 pkcs11 URI Device CA Key · ECDSA P-256 · Tier 1: Offline Signing Environment (SoftHSMv2 / Enterprise HSM) · mTLS Issuer Device CA Key ECDSA P-256 mTLS Issuer fTPM Primary Seed · EPS / SPS in RPMB · Tier 2: Device Hardware & Secure World (OP-TEE & fTPM) · Hardware Bound fTPM Primary Seed EPS / SPS in RPMB Hardware Bound Attestation Key (AK) · Restricted TPM Key · Tier 2: Device Hardware & Secure World (OP-TEE & fTPM) · Quote Signer Attestation Key (AK) Restricted TPM Key Quote Signer Robot Identity Key · ECDSA P-256 Non-extract · Tier 2: Device Hardware & Secure World (OP-TEE & fTPM) · OP-TEE TA Robot Identity Key ECDSA P-256 Non-extract OP-TEE TA Kernel Public Keyring · X.509 OEM & Module Certs · Tier 3: Public Artifacts (Safe to distribute) · Built-in Kernel Public Keyring X.509 OEM & Module Certs Built-in Robot Device Certificate · Signed by Device CA · Tier 3: Public Artifacts (Safe to distribute) · Public Cert Robot Device Certificate Signed by Device CA Public Cert Issues Issues Issues Cross-signs Derives AK Issues Cert Public Pair Public Cert Public Cert Tier 1: Offline Signing Environment (SoftHSMv2 / Enterprise HSM) Tier 2: Device Hardware & Secure World (OP-TEE & fTPM) Tier 3: Public Artifacts (Safe to distribute) Legend Frontend Backend Security