Security chips and single-chip cryptographic modules · FIPS 140-3 and ISO/IEC 19790 validation, four security levels, tamper-evident and removal-resistant coatings, zeroization and environmental failure protection, certification claims such as EAL4+ and PCI
A security chip is an integrated circuit that performs cryptographic operations and stores keys inside a protected boundary, with features to detect or resist tampering; examples include secure elements, security microcontrollers for payment terminals and hardware security chips for IoT devices. Ask three things first: which certification and security level the application requires, what physical and environmental attacks the chip resists, and which algorithms, interfaces and memory it provides.
Single-chip security ICs: secure elements, security MCUs and cryptographic coprocessors for payment, identity, IoT and embedded systems. Hardware security modules (HSM cards and appliances), general-purpose microcontrollers without security certification, and smart cards as finished products are outside this page except where compared.
Start with your task
01
NIST's FIPS 140-3, Security Requirements for Cryptographic Modules, supersedes FIPS 140-2 and aligns with ISO/IEC 19790:2012(E), with testing in accordance with ISO/IEC 24759:2017(E) as modified by the Cryptographic Module Validation Program (CMVP) as validation authority; its major changes are limited to introducing non-invasive physical requirements. Its history explains that FIPS 140-1 defined four increasing security levels for eleven requirement areas, so that cost-effective solutions could match data sensitivity and environment, from a guarded facility to a completely unprotected location. [1]
ZxInfoTek, a security chip maker linked to this page, lists the XK2200 (32-bit Arm Cortex-M0 at up to 48 MHz, up to 64 KB flash and 6 KB SRAM, hardware cryptographic acceleration) as having passed EAL4+ and Chinese national second-level security certification, and the TSC9560 as complying with PCI 5.1 and certified by the National Cryptography Administration and the UnionPay Bank Card Testing Center. [3]
Editorial note: certification claims are specific to a chip version and configuration; ask the supplier for the certificate number and the security target or security policy, and check them with the issuing body.
Give the supplier the application (payment, identity, IoT, automotive), the certification and level required (FIPS 140-3 level, EAL, PCI, national schemes), cryptographic algorithms and key sizes, key storage capacity, interfaces (I2C, SPI, UART, ISO 7816), CPU and memory, tamper and environmental protections, operating temperature, package, lifecycle and personalisation services, and supply longevity.
02
FIPS 140-2's requirements for single-chip cryptographic modules add nothing at Security Level 1. Level 2 requires a tamper-evident coating, such as tamper-evident passivation, or a tamper-evident enclosure that is opaque in the visible spectrum. Level 3 requires either a hard, opaque, tamper-evident coating such as hard epoxy over the passivation, or an enclosure whose removal or penetration is highly likely to seriously damage the module. Level 4 adds a hard, opaque, removal-resistant coating whose prying or dissolving is highly likely to destroy the module. At Level 4 the module must also detect penetration and immediately zeroize plaintext critical security parameters. It must either have environmental failure protection that detects voltage or temperature excursions and zeroizes them, or pass environmental failure testing. [2]
Editorial note: FIPS 140-2 is cited here for its published single-chip physical requirements; FIPS 140-3 supersedes it, aligns with ISO/IEC 19790 and adds non-invasive physical requirements, so confirm which standard and level a chip's certificate refers to. [1] [2]
03
Infineon's product page for the OPTIGA Trust M SLS32AIA describes a pre-provisioned discrete secure element that sits beside a host microcontroller over a shielded I2C connection and can stay in place when the host MCU is changed. It lists hardware based on a CC EAL 6+ (high) certified chip and PSA level 3; ECC on NIST curves up to P-521 and Brainpool r1 curves up to P-512; RSA up to 2048 bits; AES up to 256 bits; HMAC and the TLS v1.2 PRF and HKDF up to SHA-512; a true and deterministic random number generator; four monotonic counters; up to 10 kB of user memory; a 16-bit CPU; a hibernate mode; a 3 × 3 mm USON-10 package; an ambient temperature range of −40 °C to +105 °C; and a 20-year lifetime for the industrial configuration. Its use cases include zero-touch provisioning, platform integrity, secured updates, secured communication and mutual authentication. [4]
Editorial calculation: 20 years is about 175,000 hours of operation; the 9 mm² package footprint and 10 kB of user memory compare with the 64 KB of flash ZxInfoTek lists for its XK2200 security MCU, which runs application code as well as keys. A discrete element suits a design that keeps its own MCU, while a security MCU replaces it; the certificate for each must name the exact part and configuration. [4] [3]
| Field | OPTIGA Trust M value | What to ask any supplier |
|---|---|---|
| Certification basis | CC EAL 6+ (high) hardware; PSA level 3 [4] | Certificate numbers and scope. |
| Asymmetric keys | ECC up to P-521; RSA up to 2048 [4] | Curves and key sizes you need. |
| Symmetric and hash | AES up to 256; HMAC up to SHA-512 [4] | Algorithms in hardware. |
| User memory | Up to 10 kB [4] | Certificates and keys to store. |
| Interface and package | Shielded I2C; USON-10, 3 × 3 mm [4] | Bus and footprint. |
| Temperature and lifetime | −40 to +105 °C; 20 years industrial [4] | Grade for your product life. |
04
Suppliers linked to this page list security chips; each card links to the page reviewed.
Listings include security MCUs with cryptographic accelerators and payment certifications, and security chips in an IC distributor's catalogue. Ask each for certificates, security policy, algorithm support and lifecycle commitments.
05
This is a functional reference built from the sources cited; it is not one maker's specification.
| Function | Role | Fix in the order |
|---|---|---|
| Crypto accelerator | Hardware cryptographic algorithms. [3] | Algorithms, key sizes. |
| CPU and memory | Runs firmware; stores keys. [3] | Core, flash, SRAM. |
| Tamper-evident or removal-resistant coating | Physical protection by level. [2] | Level claimed. |
| Zeroization | Erases plaintext CSPs on attack (Level 4). [2] | Triggers. |
| Environmental failure protection | Detects voltage/temperature excursions. [2] | EFP or EFT. |
| Certification | FIPS 140-3/ISO 19790; EAL; PCI. [1] [3] | Certificate numbers. |
06
A security chip quotation needs values for your device. The table explains each field, gives published values where a reviewed source states them, and says what to obtain from the supplier.
| Field | What it means and published values | Ask the supplier for |
|---|---|---|
| Validation standard | FIPS 140-3 aligned with ISO/IEC 19790:2012. [1] | Certificate and level. |
| Security level | Four levels, 1–4. [1] [2] | Level per area. |
| Physical protection | Coatings by level for single chips. [2] | Description. |
| Other certifications | Examples: EAL4+, PCI 5.1. [3] | Certificates. |
| CPU / memory | Example: Cortex-M0, 48 MHz, 64 KB flash. [3] | Core, memory. |
| Interfaces | Example: UART, I2C, SPI. [3] | Interfaces. |
07
Paste it into your enquiry below or into an email to a maker, then replace every bracket.
Application: [payment/identity/IoT/automotive] Certification: [FIPS 140-3 level; EAL; PCI; national] Crypto: [algorithms; key sizes; key storage] Hardware: [CPU; memory; interfaces; package; temperature] Services: [personalisation; firmware; lifecycle] Documents: [certificate numbers; security policy]
These companies list security chips.
Lists security chips (XK2200, TSC9560, ZX9660) with PCIe hardware secure modules.
Product scope checked 2026-10-11
IC supplier listing security chips in its catalogue.
Product scope checked 2026-10-11
Explore company information and manufacturing capabilities, then discuss the scope of your project with a relevant supplier.
FIPS 140-3, which supersedes FIPS 140-2 and aligns with ISO/IEC 19790:2012. [1]
Under FIPS 140-2, a hard opaque tamper-evident coating or an enclosure whose removal is highly likely to destroy the module. [2]
Detection of penetration with immediate zeroization, and environmental failure protection or testing for voltage and temperature excursions. [2]
One maker's product page lists CC EAL 6+ certified hardware, ECC up to P-521, RSA up to 2048, AES up to 256, up to 10 kB user memory, an I2C interface, −40 to +105 °C and a 20-year industrial lifetime. [4]
Sources checked 2026-10-12. FIPS 140-3 and FIPS 140-2 are NIST Federal Information Processing Standards; ZxInfoTek is a chip maker describing its own products.
Ask for use case, specification boundaries, supplier type, and RFQ preparation information for this product.
Compare manufacturer profiles with relevant product and process capability.