#Taiwan #Winbond #Taichung #TrustME #W77Q

Winbond’s New CRA Kit for TrustME® W77Q Secure Flash

Winbond Electronics Corporation, a prominent global supplier of semiconductor memory solutions, has recently introduced the CRA Conformance and Integration Kit tailored for its TrustME® W77Q Secure Flash family. This comprehensive kit is crafted to facilitate manufacturers in their efforts to align with the evolving demands of the European Union's Cyber Resilience Act (CRA).

The CRA enforces rigorous cybersecurity standards throughout the product lifecycle, covering various crucial aspects such as secure design, development, production, and maintenance of digital products. Winbond’s new kit simplifies the process by compiling all necessary resources, from hardware security features to software integration guidance, under a single umbrella. This strategic initiative is crucial for manufacturers aiming to meet these stringent requirements efficiently.

Key Features of the CRA Integration Kit

The TrustME® W77Q Secure Flash has successfully earned SESIP Level 2 certification. This certification provides reliable security evidence essential for customers who are verifying their compliance processes at the product level. It's pivotal to note that while the component-level certification bolsters security confidence, it does not automatically imply that the final product meets the CRA's demands.

For products that currently utilize external NOR Flash, the W77Q offers a seamless transition route, aligning with existing package, voltage, interface, and system specifications. Although some degree of hardware and software adaptation will be necessary, the W77Q enhances memory security without necessitating the integration of an additional security component or a complete platform overhaul.

Comprehensive Resource Package

The CRA Conformance and Integration Kit is designed to bring together essential assets to aid implementation, testing, and documentation. Some of its defining components include:
1. CRA Security Objective Mapping: This tool links relevant CRA Annex I security objectives to the security capabilities of the W77Q.
2. Hardware Integration Guidelines: Detailed instructions for incorporating the W77Q as an external NOR Flash solution while minimizing board-level modifications.
3. Low-Level Security Library and Sample Code: Provides software libraries and practical examples for secure data storage, authentication procedures, and software update mechanisms.
4. CRA Integration Test Suite: A suite that includes various positive and negative test cases tailored for system validation.
5. CRA Conformance Collateral: Contains templates for risk assessments, vulnerability management documents, and reusable security evidence.
6. Conformity Checklists and Reference Designs: Offers implementation guidance and practical examples that combine W77Q with selected microcontroller units (MCUs).
7. Open-Source Resources: Features selected open-source implementations, Linux drivers, and components for remote secure software updates.

Emphasizing Long-Lifecycle Security

The CRA Integration Kit is also a testament to Winbond's advancements in post-quantum cryptography (PQC) applied to Secure Flash technology. The W77Q devices leverage the Leighton-Micali Signature (LMS) scheme as defined in NIST SP 800-208, facilitating secure authentication for firmware and software updates. With capabilities such as protected storage, authenticated updates, version enforcement, and rollback protection, the W77Q ensures robust security throughout the product lifecycle. These attributes empower OEMs to comply with security mandates for long-lasting connected devices, all while paving the way for PQC-protected updates, contingent on device and system architecture.

José Pulido, Director at jtsec Beyond IT Security, emphasized, “Complying with the EU Cyber Resilience Act can be daunting, as manufacturers must scrutinize how third-party elements satisfy overarching security mandates. Winbond successfully addresses this challenge with its W77Q Secure Flash and CRA Integration Kit, which bundles hardware-enforced security with invaluable integration advice, testing resources, and meticulous documentation. This streamlined compliance evidence simplifies due diligence and significantly mitigates the engineering efforts required for both internal assessments and third-party audits.”

Aiming for Broad Industry Application

The Winbond CRA Conformance and Integration Kit is ideally suited for connected products across various sectors, including industrial automation, IoT applications, networking, smart building technologies, HVAC, energy management, electric vehicle charging, smart home devices, and other areas where secure lifecycle management and CRA compliance are paramount.

To discover more about Winbond's Secure Flash offerings and solutions, explore the official Winbond website.

About Winbond

Founded in 1987 and publicly listed in 1995, Winbond Electronics Corporation is headquartered in Taichung, Taiwan, featuring two state-of-the-art 12-inch wafer fabs. The company is dedicated to offering comprehensive IC solutions globally, with key product lines that include Code Storage Flash, Customized Memory Solutions, and assorted logic integrated circuits.