Certified Wearable — Reference Hardware Concept (Shallow Draft)
Non-normative. Illustrates one plausible way to satisfy CPP-002 §5 (Hardware Requirements) in wearable form. Not a BOM, not a schematic — a starting point for a real hardware design partner.
| Attribute | Target |
|---|
| Shape | Closed-loop band puck or flat token, clip/strap-mountable |
| Diameter / size | ~26–30 mm disc, or 40×25 mm oblong puck |
| Thickness | ≤ 6 mm |
| Weight | ≤ 8 g |
| Ingress protection | IP68 (sealed, no serviceable interfaces post-manufacture) |
| Mounting | Interchangeable strap/clip/keyring adapter — the puck itself, not the strap, is the certified unit |
No display, no buttons except a single recessed pairing/wake contact (capacitive or magnetic reed), consistent with CPP-002 §5.5 (UI delegated to Companion Application) and §5.3 (no exposed debug surface).
2. Core Electronics
| Block | Candidate part class | Notes |
|---|
| Secure Element | EAL5+/6+ certified SE (e.g. NXP SE050-class, Infineon OPTIGA Trust M/Authenticate-class, or ST ST33-class) | Holds Device Root Key, instrument bearer keys, Attestation Key. On-die TRNG. Physically separate die from the MCU. |
| Application MCU | Low-power BLE SoC with secure boot support (e.g. Nordic nRF5340-class dual-core, or ST STM32WB-class) | Runs Verified Boot chain, BLE stack, application logic. MCU never sees raw private key material — all signing requests are relayed to the SE. |
| Connectivity | Bluetooth Low Energy 5.x, integrated radio on the application SoC | Sole offline transport for CPP-002 v0.1.0. NFC as optional secondary transport (Section 5, "MAY"). |
| Antenna | PCB trace or chip antenna, tuned for enclosed metal-free housing | Housing material must be radio-transparent in antenna zone. |
| Power management | Dedicated PMIC with brown-out and glitch detection feed to SE tamper logic | Ties into CPP-002 §5.3 tamper response. |
| Clock/glitch protection | Independent watchdog + voltage/clock monitor on SE | Required for tamper detection per §5.3. |
Two-die split (separate SE + MCU) is the safer default for early certification; a single SoC with an internally isolated secure enclave (TrustZone-M + on-die crypto island) is a plausible cost-reduction path for v2, but raises the certification bar to prove die-level isolation.
3. Power
| Attribute | Target |
|---|
| Battery | Solid-state or thin-film Li-polymer, 15–40 mAh |
| Charging | Contactless (Qi-lite / pogo-pin pad), sealed housing preserved |
| Expected battery life | 5–7 days typical use (BLE advertising duty-cycled, SE mostly idle) |
| Low-battery behaviour | Device MUST refuse to initiate an offline handoff below a safety margin sufficient to complete the atomic commit (CPP-002 §7.2) — brown-out mid-commit is a tamper/fail-closed event, not a soft failure |
4. Memory
| Block | Target | Notes |
|---|
| SE secure storage | ≥ 32 KB, hardware-encrypted | Device Root Key, per-instrument bearer keys, Attestation Key, DRL cache |
| MCU flash | 512 KB–1 MB | Verified Boot stages 2–3, BLE stack, application logic |
| MCU RAM | 64–256 KB | Runtime only; no persistent key material ever resident here |
5. Manufacture-Time Provisioning
- Boot ROM public key (or hash) fused at wafer/die level — immutable.
- Device Root Key generated on-die during a Foundation-audited provisioning step (CPP-002 §5.2); provisioning station never retains the private key.
- Attestation Key burned and Device Certificate chain (Vendor CA → Device) written to SE non-volatile storage.
- Debug/JTAG fused off as the last provisioning step (§5.3).
6. Certification Path (mapped to CPP-002 §5)
| CPP-002 requirement | Addressed by |
|---|
| §5.1 Secure Boot | ROM-rooted chain, MCU secure boot feature set |
| §5.2 SE + on-device key gen | Discrete EAL5+ SE, on-die TRNG |
| §5.3 Tamper resistance | SE die shield + glitch/voltage monitor, fused debug ports |
| §5.4 Remote attestation | SE-resident Attestation Key, boot measurement chain |
| §5.5 Connectivity/UI | BLE 5.x radio; no on-device display; Companion App required for confirmation |
7. Open Items for a Real Design Partner
- SE and MCU part selection depends on final BLE current-draw and provisioning-station availability at chosen contract manufacturer.
- Antenna performance in a sealed IP68 metal-free housing needs bench validation before tooling.
- Single-SoC (isolated enclave) variant is a v2 cost target, not v1.
- Charging pad / dock is a separate accessory, out of Certified Device scope.
Concept draft — not a Foundation-approved reference design. For discussion only.