Crypto-Agility Without a Redesign: The “Soft-Fade-Out” Pattern for Legacy IoT Silicon

无需重新设计的加密敏捷性：针对传统物联网芯片的“软淘汰”模式

Most conversations about CRA, DORA, and NIS2 compliance for IoT hardware boil down to one uncomfortable binary: redesign the board around newer, security-capable silicon, or accept that your existing product line falls out of compliance on a fixed deadline. For a product with years left in its lifecycle and a BOM that took months to qualify, “just redesign it” is rarely a real answer. 关于物联网硬件的 CRA、DORA 和 NIS2 合规性讨论，大多归结为一个令人不安的二选一困境：要么围绕更新、具备安全能力的芯片重新设计电路板，要么接受现有产品线在固定期限后不再合规的事实。对于一款生命周期还有数年、且物料清单（BOM）耗时数月才完成认证的产品来说，“直接重新设计”往往不是一个切实可行的方案。

There’s a third option that gets far less attention than it deserves: pair the legacy chip with a modern security co-chip that absorbs the cryptographic boundary, while the legacy part keeps doing exactly what it already does well - application logic, peripherals, display, sensor polling. Call it a soft fade-out. The old silicon stays in service until its natural end-of-life; the compliance gap gets closed by a second, much cheaper part sitting next to it, not by replacing it. 其实还有第三种选择，但它受到的关注远低于其应得的程度：将传统芯片与现代安全协处理器配对，由后者承担加密边界的任务，而传统芯片继续执行其擅长的功能——应用逻辑、外设控制、显示驱动和传感器轮询。这被称为“软淘汰”（Soft Fade-out）。旧芯片继续服役直到其自然生命周期结束；合规性缺口通过旁边添加的第二个更廉价的芯片来弥补，而不是通过替换旧芯片。

The Three Gaps a Legacy Chip Has - and Why a Co-Chip Fixes Them

传统芯片的三大缺口——以及为何协处理器能解决它们

The regulatory pressure driving all of this isn’t abstract. NIST finalized its post-quantum cryptography standards in 2024, and IR 8547 sets real dates: ECDSA and RSA are deprecated after 2030, disallowed after 2035. Germany’s BSI has gone further - TR-02102-1 (2026 edition) sets a stricter 2030 deadline for high-protection-need data, and treats the migration as “alternativlos” (without alternative) rather than a recommendation. 推动这一切的监管压力并非抽象概念。NIST 在 2024 年敲定了后量子密码学标准，IR 8547 也设定了明确的时间表：ECDSA 和 RSA 在 2030 年后被弃用，2035 年后被禁止。德国联邦信息安全局（BSI）走得更远——TR-02102-1（2026 版）为高保护需求数据设定了更严格的 2030 年截止日期，并将此次迁移视为“别无选择”（alternativlos），而非仅仅是一项建议。

Older embedded silicon typically lacks three things simultaneously: a hardware-isolated key store (TEE/APM), side-channel countermeasures (DPA protection) strong enough for physical-access threat models, and enough RAM/compute headroom to run lattice-based PQC algorithms in software without starving the rest of the firmware. Redesigning the whole board to fix all three at once is expensive and slow. But none of those three gaps require touching the part that’s already doing its job - they’re all boundary problems. A second, purpose-built chip can own the boundary. 较旧的嵌入式芯片通常同时缺乏三样东西：硬件隔离的密钥存储（TEE/APM）、足以应对物理访问威胁模型的侧信道对策（DPA 保护），以及足够的 RAM/计算余量来运行基于格的 PQC 算法，且不影响固件的其他部分。为了解决这三个问题而重新设计整个电路板既昂贵又缓慢。但这些缺口都不需要改动已经在正常工作的部件——它们本质上都是边界问题。一个专用的辅助芯片完全可以接管这些边界。

Three concrete pairings

三种具体的配对方案

Using the ESP32 family as a worked example (the underlying logic generalizes to any chip family with a security-generation gap): 以 ESP32 系列为例（其底层逻辑可推广至任何存在安全代际差距的芯片系列）：

• Legacy chip + ultra-low-power security gatekeeper. An older chip with no hardware ECC/ECDSA and an RSA-only boot chain gets an upstream chip acting as root-of-trust - verifying firmware images, anchoring device identity, handling key exchange - before the legacy part is even released from reset. 传统芯片 + 超低功耗安全守门员。 一款没有硬件 ECC/ECDSA 且仅支持 RSA 启动链的旧芯片，可以配备一个作为信任根（Root-of-Trust）的上游芯片——在传统芯片从复位状态释放之前，由该芯片负责验证固件镜像、锚定设备身份并处理密钥交换。

• High-performance chip + isolated crypto coprocessor. A capable application processor (AI/vector extensions, camera, display) that lacks a TEE or DPA protection gets a small, security-hardened co-chip that handles all key storage and signing in a side-channel-protected boundary, isolated from the noisy, complex main firmware. 高性能芯片 + 隔离加密协处理器。 一款功能强大的应用处理器（具备 AI/向量扩展、摄像头、显示功能）如果缺乏 TEE 或 DPA 保护，可以添加一个小型的安全加固协处理器，在受侧信道保护的边界内处理所有密钥存储和签名，从而与嘈杂、复杂的主固件隔离开来。

• Minimal/legacy chip + full network-stack offload. A chip too memory-constrained to run a modern TLS 1.3 + PQC stack alongside its application code gets stripped of crypto duties entirely - it talks to a companion chip over a simple local bus, and that companion chip owns the entire encrypted network boundary. 极简/传统芯片 + 全网络栈卸载。 一款内存受限、无法在运行应用代码的同时运行现代 TLS 1.3 + PQC 栈的芯片，可以完全剥离加密任务——它通过简单的本地总线与配套芯片通信，由配套芯片负责整个加密网络边界。

Each pairing has the same shape: keep the expensive, qualified, field-proven part; add a small, cheap part that owns exactly the gap. 每种配对方案的逻辑一致：保留昂贵、已认证且经过实地验证的部件；添加一个小型、廉价的部件来专门填补缺口。

Where this doesn’t help

此方案的局限性

This pattern solves transport and identity security - TLS boundaries, firmware signing, device attestation. It does not solve data-at-rest confidentiality on the legacy chip itself. If sensitive data is stored unencrypted in the legacy part’s own flash or SRAM, no amount of network-boundary hardening on a co-chip fixes that; you’d need the legacy chip’s own storage path secured, which usually does mean touching the original design. Be precise about which threat model you’re actually closing before treating this as a full compliance answer. 这种模式解决了传输和身份安全问题——如 TLS 边界、固件签名和设备认证。但它无法解决传统芯片本身的静态数据保密性问题。如果敏感数据以未加密形式存储在传统芯片的闪存或 SRAM 中，那么无论协处理器如何强化网络边界都无济于事；你需要保护传统芯片自身的存储路径，这通常意味着必须改动原始设计。在将其视为完整的合规方案之前，请务必明确你实际解决的是哪种威胁模型。

The economic case

经济效益分析

The alternative - a full BOM redesign - typically means re-qualifying an entire board: new layout, new certification runs, new firmware bring-up, new supply chain relationships, months of schedule. A co-chip addition is comparatively small: one new part, one interface (SPI/UART/I2C), a defined crypto boundary. For a product with genuine years left in its lifecycle, that’s the difference between a compliance line item and a product-line-ending expense. 另一种选择——彻底的 BOM 重新设计——通常意味着整个电路板的重新认证：新的布局、新的认证流程、新的固件开发、新的供应链关系，以及数月的进度。而添加协处理器则相对简单：增加一个新部件、一个接口（SPI/UART/I2C）以及一个明确的加密边界。对于一款生命周期还有数年之久的产品而言，这决定了它是仅仅增加一项合规成本，还是面临产品线终结的巨额支出。