Your security key passed every test. The chip inside it hasn't.
Pillar 11 of 25 · 7 min read · FIDO2 certification proves the protocol. CC EAL6+ proves the chip. The gap between those two statements is where hardware supply-chain attacks live.
See how this applies to your environment
Book a 30-minute briefing with Ciptor. We'll walk through what live-fire validation typically uncovers in environments like yours.
Hardware Root of Trust — Volumes 11–15
Pillars 1 and 2 established what attackers can do when they own the endpoint or intercept the credential. Pillar 3 asks a harder question: what happens when the hardware you trust to prevent all of that is itself unverified? The next five volumes cover the chip, the supply chain, biometric liveness, passwordless architecture, and legacy compatibility — from silicon to session.
The Assumption
If a security key carries FIDO2 certification and comes from a reputable vendor, the chip inside it is trustworthy. Certification means it has been tested. Tested means it is secure.
The Reality
FIDO2 certification validates the authentication protocol — the handshake, the cryptographic exchange, the attestation format. It says nothing about the physical chip executing those operations. A key can pass full FIDO2 certification while running on a secure element that has never been tested against differential power analysis, electromagnetic probing, or fault injection. The two standards answer entirely different questions.
The Blueprint
Require hardware tokens whose secure element carries Common Criteria EAL6+ evaluation — the level that mandates physical side-channel testing, rigorous entropy source review, and laboratory-confirmed tamper resistance. For European deployments subject to NIS2 Article 21 supply-chain requirements, additionally require the ANSSI Security Visa, which extends CC evaluation with sovereign EU audit oversight.
Two Standards. Two Questions. One Gap.
When your procurement team shortlists hardware tokens, FIDO2 certification is usually the first filter applied. That is correct. FIDO2 tells you the device speaks the right authentication language: it generates the right key pairs, signs the right challenges, returns the right attestation. Your identity provider will recognise it. Your browser will trust it.
But that evaluation stops at the protocol boundary. It does not open the device. It does not test what happens to the cryptographic key material when an attacker connects a differential power analysis probe to the USB port. It does not verify the quality of the random number generator seeding the private key at enrollment. It does not confirm that a laser fault injection cannot force the chip into a debug mode that exposes protected storage.
Those questions belong to Common Criteria — specifically to the EAL6+ evaluation level, which is the threshold at which laboratories begin systematically testing physical attack resistance.
EAL 6+
The certification level where physical attack testing begins in earnest.
Below EAL5, Common Criteria evaluations focus primarily on software architecture and documentation. EAL5+ introduces penetration testing against physically present attackers. EAL6+ raises the attacker capability model to "high attack potential" — the standard used for national-security-grade hardware and the baseline Ciptor specifies for enterprise identity infrastructure.
The CC EAL Hierarchy: What Each Level Actually Tests
Most enterprise hardware procurement teams are familiar with FIPS 140-3 for cryptographic modules. Common Criteria EAL is less frequently understood, but it is the framework that governs whether a device's physical implementation of cryptography can be trusted — especially under adversarial physical conditions.
What Side-Channel Attacks Actually Look Like
Side-channel attacks do not break the mathematics of elliptic curve cryptography. They do not need to. Instead, they observe physical properties of the chip executing those operations — power consumption, electromagnetic emissions, timing variations — and reconstruct the private key from those observations. The math remains unbroken. The implementation leaks.
EAL6+ evaluation requires a certified laboratory to systematically attempt each of these attack classes against the physical device, using an adversary model that assumes high attack potential — a well-funded, technically sophisticated attacker with physical access and time. Chips that pass have been hardened at the silicon level, not just at the software level, against exactly these methods.
The ANSSI Security Visa: EU Sovereign Supply Chain
Why ANSSI Matters for NIS2 Article 21 Compliance
The French National Information Systems Security Agency (ANSSI) issues the Security Visa — a sovereign EU endorsement applied on top of Common Criteria evaluation. For organisations subject to NIS2's supply-chain risk management requirements under Article 21, the ANSSI Security Visa provides documented evidence that the hardware root of trust in your authentication infrastructure has been independently audited by an EU-authorised body. This is not a marketing certification. It is a formal government endorsement that appears in regulatory audit submissions and satisfies the supply-chain provenance requirements that NIS2 places on essential and important entities.
Three Questions to Ask Your Current Hardware Vendor
If you cannot get clear answers to all three of the following questions from your current hardware token vendor, the chip inside those tokens has not been evaluated to the standard your identity infrastructure requires.
1. What is the Common Criteria EAL level of the secure element inside this token — not the device, the chip?
Many vendors will quote device-level or platform-level certifications. The question must be directed at the secure element specifically: the hardware component generating, storing, and signing with the private key material. EAL6+ is the minimum acceptable answer for high-assurance enterprise identity infrastructure.
2. Where is the chip manufactured, and in which jurisdiction is the firmware developed and signed?
Third-country manufacturing introduces supply-chain injection risk at the firmware level — a risk that no protocol-layer certification can mitigate. For NIS2 Article 21 compliance, supply-chain provenance documentation must be available for audit. Western-manufactured chips with EU or US firmware signing chains are the baseline for sovereign deployments.
3. Has the entropy source in the random number generator been independently validated, and by which laboratory?
The security of every private key generated on your hardware token depends entirely on the quality of the randomness seeding that generation. A weak or predictable entropy source makes every key on every token recoverable regardless of the cryptographic algorithm in use. Independent entropy validation is mandatory at EAL6+ — and the certification report should name the laboratory that performed it.
