---
title: "NanoROOT"
source_url: https://dev.digicert.com/trustcore-sdk/nanoroot.html
---

NanoROOT is DigiCert® hardware-anchored security solution for embedded devices, built on TrustCore SDK (FIPS-certified, hardened, and field-tested for over a decade). At its core, NanoROOT uses **Physical Unclonable Function** (*PUF*) technology to create immutable device identity. This root of trust underpins secure provisioning, counterfeit resistance, and long-term data protection.

For federal compliance details, see [Compliance and regulations](https://dev.digicert.com/en/trustcore-sdk/compliance-and-regulations.html).

## Why NanoROOT?

Connected devices face unique challenges, such as long lifespans, very few patching options, and exposure to hostile environments. NanoROOT addresses these by providing:

- PUF-compatible immutable identity — Can utilize immutable hardware-derived identities. While NanoROOT does not implement PUF itself, it is designed to work with PUF-based or similar identity sources provided by the device
- Secure data protection — encrypted storage, authenticated telemetry
- Counterfeit resistance — tamper-proof fingerprinting
- Interoperable APIs — consistent interface across hardware SKUs

NanoROOT is available in two models:

## License

This project is available under a **dual-license model**:

- **Open Source License**:
  [GNU Affero General Public License v3 (AGPL v3)](https://github.com/digicert/trustcore/blob/main/LICENSE.md): This license allows you to use, modify, and distribute the code for free in accordance with AGPL terms.
- **Commercial License**:
  If you wish to use TrustCore SDK in a proprietary or commercial product (e.g., embedded in closed-source firmware or commercial SaaS applications), a commercial license is available under DigiCert’s [Master Services Agreement](https://www.digicert.com/master-services-agreement/) (MSA). Contact us at [sales@digicert.com](mailto:sales@digicert.com) for commercial licensing details.

## Core capabilities

- **PUF-compatible immutable identity**:
  NanoROOT is compatible with PUF-derived identities and other forms of immutable hardware identity. This flexibility allows it to integrate with a range of device-level identity mechanisms without requiring a specific implementation:
  - **Device fingerprinting** — uses entropy sources such as die-level randomness, fingerprint hashes, MAC addresses, serial numbers, and CPU UUIDs
  - **Security profile enforcement** — enables crypto operations, secure transport, and content protection bound to device identity
  - **Root of trust migration** — supports migration when hardware changes, for example, NIC or serial numbers, while maintaining identity through persistent fingerprints
- **Data and file protection**:
  NanoROOT keeps sensitive data safe even in untrusted environments. It uses industry-standard algorithms for all on-device data.
- **Integration and compatibility**:
  NanoROOT is implemented as an **SMP Provider module**, enabling applications that integrate with TrustCore SDK and TrustEdge to interface with the **NanoTAP** API layer for trusted service functionality.
  - Devices equipped with in-built physical secure elements, such as TPM2, SIM, and TEE
  - Devices relying solely on NanoROOT for secure operations

## NanoROOT SMP

**Security context**:

The cryptographic security context initialization/creation is based on a proprietary algorithm that leverages the device’s unique, immutable characteristics to generate:

- A unique device identity
- A corresponding cryptographic context, derived using a Key Derivation Function (KDF)
  This ensures that the cryptographic context is:
  - Unique per device
  - Bound to the device and cannot be replicated externally
  - Created only on the originating device

**Service functionality**:

NanoROOT SMP provides the following security services:

- Data protection/secure storage
- Seal/unseal data
- Sign and verify
- Key management
- Ephemeral cryptographic keys

## NanoTAP application integration

NanoTAP provides a set of TAP APIs that enable applications (TrustEdge or customer-defined) to perform trusted operations such as secure storage, key management, signing, and decryption.

**Available TAP APIs**:

- **Secure storage**:
  - `TAP_sealWithTrustedData`
  - `TAP_unsealWithTrustedData`
- **Key management**:
  - `TAP_importKeyFromID`
  - `TAP_asymSign`
- **Cleanup APIs**:
  - `TAP_unloadKey`
  - `TAP_freeKey` (for extended memory cleanup)

**Supported asymmetric key algorithms**:

| Algorithm | Key size | Index value |
| --- | --- | --- |
| RSA | 2k<br>3k<br>4k<br>8k | 0x100000002<br>0x100000003<br>0x100000004<br>0x100000005 |
| ML-DSA | 44<br>65<br>87 | 0x200000001<br>0x200000002<br>0x200000003 |
| ECDSA | 256<br>384<br>521 | 0x300000001<br>0x300000002<br>0x300000003 |

## Configuration

A sample NanoROOT configuration file is available at (https://github.com/digicert/trustcore/blob/main/samples/nanoroot/config/nanoroot_smp.conf).

```
providertype=15
[module]
modulenum=1
modulename=digi-nanoroot
moduleidstr=FCDB4B423F4E5283AFA249D762EF6AEF150E91FCCD810D43E5E719D14512DEC7
credfile=default-fingerprint.json
```
Copy this sample NanoROOT configuration file and place it under `/etc/digicert/`

Where:

`providertype` -  defines the NanoROOT SMP provider type.

`credfile` - specifies the credential file name.


**Credential file** (**default-fingerprint.json**):

This credential file [default-fingerprint.json] defines device-specific immutable attributes. These attributes are used to generate a unique cryptographic context per device.

A sample credential file is available at (https://github.com/digicert/trustcore/blob/main/samples/nanoroot/config/default-fingerprint.json).

Copy this credential file and place it under `/etc/digicert/`

```
{
  "attributes": [
      {
          "attribute_name": "INTERNATIONAL MOBILE IDENTITY",
          "attribute_value": {
              "type": "ENV",
              "variable_name": "INTERNATIONAL_MOBILE_IDENTITY" 
          }
      },
      {
          "attribute_name": "MOBILE EQUIPMENT IDENTIFIER",
          "attribute_value": {
              "type": "ENV",
              "variable_name": "MOBILE_EQUIPMENT_IDENTIFIER"
          }
      },
      {
          "attribute_name": "ELECTRONIC SERIAL NUMBER",
          "attribute_value": {
              "type": "ENV",
              "variable_name": "ELECTRONIC_SERIAL_NUMBER"
          }
      },
      {
          "attribute_name": "INTERNATIONAL MOBILE SUBSCRIBER IDENTITY",
          "attribute_value": {
              "type": "ENV",
              "variable_name": "INTERNATIONAL_MOBILE_SUBSCRIBER_IDENTITY"
          }
      },
      {
          "attribute_name": "MAC ADDRESS",
          "attribute_value": {
              "type": "program",
              "path": "/etc/digicert/get_mac_address.sh",
              "argument": "eno1"
          }
      },
      {
          "attribute_name": "SERIAL NUMBER",
          "attribute_value": {
              "type": "ENV",
              "variable_name": "SERIAL_NUMBER"
          }
      },
      {
          "attribute_name": "SECURE ANDROID ID",
          "attribute_value": {
              "type": "ENV",
              "variable_name": "SECURE_ANDROID_ID"
          }
      },
      {
          "attribute_name": "UUID",
          "attribute_value": {
              "type": "ENV",
              "variable_name": "UUID"
          }
      },
      {
          "attribute_name": "CPUID",
          "attribute_value": {
              "type": "program",
              "path": "/etc/digicert/get_cpuid.sh"
          }
      }
  ]
}
```

The credential file path can be specified in the configuration file as either an absolute or relative path:

- **Absolute path**: The file is read directly from the specified location.
- **Relative path**: The file is resolved relative to the default directory:
  ```
  /etc/digicert/
  ```

**Examples**:

Absolute path:

```
/opt/device/creds/default-fingerprint.json
```

Relative path:

```
default-fingerprint.json
```

Interpreted as: `/etc/digicert/default-fingerprint.json`

**Notes**:

- Ensure all the required environment variables referenced in the credential file are properly set on the device
- The credential file is critical for deriving device-unique cryptographic context

## Build and run

For instructions on building and running the NanoROOT library and the sample program, see  [BUILD_RUN.md](https://github.com/digicert/trustcore/blob/main/samples/nanoroot/BUILD_RUN.md).