Most secure silicon is closed. The chip vendor designs the silicon, ships it, and publishes high-level documentation. Detailed implementation, schematics, and verification artifacts are proprietary. Customers trust the vendor's claims based on certification, audit history, and reputation. For most use cases this is acceptable, but for high-assurance applications and for research, transparency matters.
OpenTitan is the answer to that demand. It is an open-source silicon root of trust designed and developed publicly under the lowRISC organization. The project includes the hardware design, the firmware, the verification environment, and the documentation, all available under permissive licenses. Anyone can read the design. Anyone can build a chip from the design. Anyone can audit the implementation.
The project started in 2019 with Google as a primary contributor. Other partners include Western Digital, Seagate, ETH Zurich, Nuvoton, and several smaller companies. The lowRISC organization, based in Cambridge, hosts the project. As of 2024 and 2025, OpenTitan has reached significant milestones, with first commercial silicon shipping and post-quantum extensions actively in development.
This article walks through what OpenTitan is, what it does, and where the public roadmap points for post-quantum cryptography.
OpenTitan architecture
OpenTitan is a system-on-chip with several major components. A 32-bit Ibex CPU implements the RISC-V instruction set. The CPU runs the firmware that orchestrates security operations. Around the CPU sit cryptographic accelerators, memory blocks, communication peripherals, and security-specific features.
The cryptographic accelerators include AES, SHA-2, SHA-3, HMAC, and a key derivation engine. Each accelerator has hardware countermeasures against fault injection and side-channel attacks. Public key operations are handled by a dedicated big number coprocessor that supports RSA and elliptic curve operations.
Memory blocks include ROM for the boot code, flash for the firmware, and SRAM for working memory. The flash has confidentiality and integrity protection through dedicated hardware. The SRAM has scrambled storage to defeat cold boot attacks.
Security-specific features include a true random number generator with extensive validation, a key manager that derives keys from chip-unique secrets, an alert handler that detects and responds to security events, and an entropy source compliant with NIST SP 800-90B.
What OpenTitan is for
OpenTitan is designed for security-critical applications that need a hardware root of trust. The project's documented use cases include server motherboard security, network device firmware integrity, IoT device security, and various embedded applications.
For each use case, OpenTitan provides a small computer that can verify firmware signatures, store keys, perform cryptographic operations, and resist physical attacks. The chip can be a separate package on a circuit board, or its design can be integrated into a larger SoC as one of several blocks.
The reference platform is the Earl Grey configuration, which is the typical OpenTitan SoC layout. Other configurations are possible, with different memory sizes and accelerator subsets.
Why open source matters for security
Open-source software has been a fixture of cybersecurity for decades. Open-source cryptographic libraries like OpenSSL, BouncyCastle, and libsodium have been audited extensively, and their security properties are publicly debated. The same logic applies to silicon, although open-source silicon has been less common until recently.
For OpenTitan, the open-source nature provides several benefits. Researchers can audit the design without NDAs. Security agencies can verify the implementation matches the specification. Customers can choose to manufacture chips themselves rather than relying on a single vendor. Bugs and vulnerabilities can be reported and fixed through the standard open-source workflow.
The trade-off is that open source does not automatically mean secure. The design must still be implemented correctly in silicon, validated against attacks, and operated in environments where the inherent guarantees hold. OpenTitan addresses this through formal verification, rigorous testing, and partnerships with security-focused manufacturers.
OpenTitan and post-quantum cryptography
OpenTitan's current cryptographic accelerators implement classical algorithms. RSA, ECC, AES, and SHA-2 are all supported. Post-quantum cryptography is on the project roadmap, with active development happening in public repositories and discussion forums.
The post-quantum direction includes both ML-KEM and ML-DSA. The big number coprocessor that handles RSA and ECC can be extended to support the polynomial arithmetic that lattice-based algorithms require, although the extensions are not trivial. Hash-based signatures like SLH-DSA can use the existing SHA accelerators with appropriate firmware support.
The OpenTitan team has published design notes describing how post-quantum support could be added. The implementation is happening incrementally, with software-level support coming first and hardware acceleration following as the design stabilizes.
For users who want a publicly verifiable post-quantum hardware root of trust, OpenTitan is unique. No other major secure silicon project has the same level of public transparency for its post-quantum direction.
RISC-V cryptographic extensions
The RISC-V instruction set has been adding cryptographic extensions over the last several years. The K extension covers cryptography, with subsets for symmetric and asymmetric primitives. The B extension covers bit manipulation, useful for many cryptographic operations.
For post-quantum, the RISC-V community has been discussing extensions specifically for lattice cryptography. Number-theoretic transform instructions, polynomial multiplication instructions, and Gaussian sampling instructions are all candidates. As these extensions are standardized, OpenTitan can incorporate them.
The Ibex CPU at the heart of OpenTitan is a relatively small RISC-V implementation. Adding cryptographic extensions to Ibex requires verification work but is straightforward in principle. Other RISC-V implementations may bring full lattice acceleration sooner, with the Ibex variant catching up as the standard stabilizes.
Comparison with proprietary secure silicon
OpenTitan is not the only secure silicon option. Microchip Technology, NXP, STMicroelectronics, Infineon, Maxim Integrated, and several other vendors offer secure microcontrollers and secure elements. Each has its own architecture, firmware ecosystem, and certification path.
For users who need certified silicon, proprietary options often have longer histories and more mature certification stories. OpenTitan is being designed with certification in mind, but achieving Common Criteria or FIPS 140-3 certification takes years and significant investment.
For users who need transparency, OpenTitan is uniquely positioned. The complete design is public, the implementation is auditable, and the development happens in the open. For research institutions, security agencies, and organizations with high assurance requirements, this transparency is valuable.
For users who need a turnkey solution, proprietary silicon may be easier to deploy. OpenTitan-based products require more integration work because the project is younger and the ecosystem is smaller. As OpenTitan matures, this gap will narrow.
Lowrisc and the project ecosystem
LowRISC, the organization that hosts OpenTitan, also hosts the Ibex CPU and several other open-source silicon projects. The organization's mission is to enable open-source silicon development through community-driven projects.
Beyond OpenTitan, lowRISC has been involved in projects related to formal verification, RISC-V tooling, and silicon supply chain security. The post-quantum work in OpenTitan benefits from this broader ecosystem, with formal verification techniques and tooling shared across projects.
The community around OpenTitan includes individual contributors, academic researchers, and corporate partners. Code contributions go through public review on GitHub. Design discussions happen on the project's mailing lists and public forums. Major design decisions are documented in design notes that anyone can read.
OpenTitan and the supply chain
One of the goals of OpenTitan is to enable trustworthy silicon manufacturing. By making the design open, customers can choose where to manufacture the chips and can verify that the manufactured chips match the design.
Supply chain attacks against silicon have been a concern for security agencies for decades. The classic threat model includes a malicious foundry that introduces backdoors during manufacturing. Open-source silicon design does not eliminate this threat, but it provides additional means of detection. Customers can manufacture at multiple foundries and compare results. Researchers can audit specific manufactured chips against the design.
For organizations that operate under specific security frameworks like CMMC or FedRAMP, the supply chain story matters. OpenTitan provides one option in the toolkit, alongside trusted manufacturer relationships and certification of specific lots.
Formal verification and assurance
OpenTitan emphasizes formal verification, where mathematical proofs establish that the design behaves correctly. Formal verification is more rigorous than testing because it covers all possible inputs rather than a sampled set. For security-critical silicon, formal verification provides confidence that the design does not have hidden bugs.
Several OpenTitan blocks have undergone formal verification, with results publicly documented. The verification covers properties like memory protection, key isolation, and correct cryptographic operation. As post-quantum primitives are added, the verification methodology extends to cover them.
For organizations that need verifiable assurance, formal verification provides evidence that goes beyond traditional testing. Combined with the open-source design, formal verification gives a strong basis for trust in OpenTitan-based products.
OpenTitan in research and education
Beyond commercial deployment, OpenTitan serves as a research platform. Academic groups use OpenTitan to study security properties, develop new countermeasures, and prototype new cryptographic algorithms. The open-source nature makes it possible to modify the design and observe the effects without proprietary licensing barriers.
Research output from OpenTitan-based work feeds back into the project. Side-channel attack studies inform countermeasure development. Implementation optimizations get contributed back to the codebase. Cryptographic primitive research informs the post-quantum direction.
This research ecosystem is one of OpenTitan's strengths. Proprietary silicon does not benefit from the same level of academic engagement because researchers cannot easily modify the designs. The open-source approach turns OpenTitan into a moving target that improves through continuous community contribution.
How QNSQY relates to OpenTitan
QNSQY is software that runs on commodity hardware. It does not require a specific silicon root of trust to function. The hybrid post-quantum file format provides protection independent of platform hardware.
QNSQY does not integrate with OpenTitan or any other hardware root of trust today. Its keys are protected in software: private keys are encrypted under a passphrase and stored in files readable only by their owner.
OpenTitan and QNSQY address different layers. OpenTitan is an open-source silicon root of trust for the platform, and QNSQY protects files with post-quantum encryption in software, using a published file format.
NIST FIPS guide covers the underlying standards that both QNSQY and OpenTitan target.
Future direction
The OpenTitan roadmap includes several near-term post-quantum milestones. Software implementations of ML-KEM and ML-DSA running on the Ibex CPU. Performance optimization through firmware tuning. Hardware acceleration for specific operations through dedicated accelerators or RISC-V extensions.
Longer-term direction includes full integration of post-quantum primitives into the OpenTitan key manager, supporting hybrid key derivation chains that combine classical and post-quantum components. This would enable applications using OpenTitan to benefit from post-quantum protection without modifying their key handling code.
The pace of progress depends on community contributions and corporate priorities. As major partners increase their post-quantum focus, OpenTitan's post-quantum work accelerates. Organizations that want to influence the direction can contribute through code, design review, and use case documentation.
Frequently asked questions
What is OpenTitan? An open-source silicon root of trust project hosted by lowRISC. It includes hardware design, firmware, verification environment, and documentation, all available under permissive licenses.
Does OpenTitan support post-quantum cryptography? Not yet in mainline. Post-quantum support is on the roadmap with active development. Software implementations of ML-KEM and ML-DSA are being added, with hardware acceleration following.
How does OpenTitan compare to a TPM? OpenTitan provides hardware root of trust functionality similar to a TPM but with additional features and a different command interface. The open-source nature is the key differentiator.
Can I buy OpenTitan-based products today? First commercial silicon based on OpenTitan is shipping from partners like Nuvoton. The ecosystem is growing as more manufacturers and integrators adopt the design.
Why open-source silicon? Transparency for security audit, choice of manufacturer, public verification of implementation, and resistance to supply chain attacks. Open-source silicon does not automatically mean secure but enables verification that closed silicon does not.
Sources
- OpenTitan Project, https://opentitan.org/
- LowRISC Organization, https://lowrisc.org/
- OpenTitan GitHub Repository, https://github.com/lowRISC/opentitan
- RISC-V Cryptographic Extensions, https://github.com/riscv/riscv-crypto
- NIST FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard, https://csrc.nist.gov/pubs/fips/203/final
- NIST FIPS 204, Module-Lattice-Based Digital Signature Standard, https://csrc.nist.gov/pubs/fips/204/final
- NIST SP 800-90B Recommendation for the Entropy Sources Used for Random Bit Generation, https://csrc.nist.gov/pubs/sp/800/90/b/final
Related Articles
- Secure enclaves and PQC
- Google Titan: PQC Roadmap
- PQC and TPM 2.0: Roadmap for Trusted Platform Modules
- What is post-quantum cryptography
- NIST FIPS guide
- 6G Research and PQC: ITU-T and 3GPP Direction
- NFC Payments PQC: ISO 14443 Direction
- ACH Transfers and Post-Quantum Cryptography
- Microsoft Pluton: PQC Roadmap
Protect Your Data Before Q-Day Arrives
QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.