The Long Road to Open Silicon: How OpenTitan and the Rise of Secure Roots of Trust are Reshaping the Semiconductor Industry

The ecosystem is further supported by organizations like the CHERI (Capability Hardware Enhanced RISC Instructions) Alliance, founded in 2024. Membership includes Arm, Google, lowRISC, and the UK National Cyber Security Centre (NCSC). CHERI technology aims to protect data by building security directly into hardware memory, addressing a class of vulnerabilities that have plagued software for decades.

At zeroRISC, the focus is on providing what Rizzo calls a "silicon trust stack." The company’s offerings include the Pavona repository and a collaboration layer for design teams, complete with version control and verification workloads for physical hardware. Their stack includes post-quantum-ready silicon IP and a provisioning service that allows for secure debugging and over-the-air updates for OEMs.

The urgency surrounding Post-Quantum Cryptography cannot be overstated. Rizzo points out that the U.S. government and European regulators have set aggressive deadlines for organizations to transition to PQC. The threat is twofold: the eventual ability of quantum computers to break current standards like AES-256, and the immediate threat of "harvest now, decrypt later." In this scenario, malicious actors steal encrypted data today, intending to decrypt it years from now when quantum technology becomes available. Google has estimated that this "quantum day" could arrive as early as 2029.

Implementing PQC is significantly more complex than classical cryptography. In classical systems, a single "hard problem" typically sits at the root of all operations. In the post-quantum world, the trade-offs are more varied, the underlying mathematical problems are different, and the implementations for various operations are themselves unique. This complexity makes the collaborative, open-source approach of projects like Pavona even more essential.

Looking ahead, the focus of the open-silicon movement is shifting toward sustainability and governance. While the industry has proven it can build the technology in the open, the challenge now lies in building a long-term ecosystem where everyone benefits. This includes navigating new regulatory landscapes, such as the European Union’s Cyber Resilience Act. This legislation is shifting the liability for cyber incidents onto device makers, forcing them to take greater responsibility for their supply chains.

This regulatory shift is making the necessity of a hardware root of trust clear to the broader market. As Rizzo notes, the software attack surface has grown so large that the only way to address it is to have a silicon root of trust beneath the software—a foundation that can be reset to a known good state. Without that control over the chip itself, the battle for security is increasingly seen as a losing one. Through the continued evolution of OpenTitan, Pavona, and the broader open-silicon community, the industry is finally building the tools necessary to secure that foundation.