About this writeup
MITRE's embedded CTF has teams design a Hardware Security Module from scratch and then attack each other's builds. For eCTF 2026 I led Northeastern's team, NEU-1, and we built NeuSense: a bare-metal HSM in C on the TI MSPM0L2228 (ARM Cortex-M0+), with no operating system.
This guide rebuilds the design after the competition. It aims to be complete enough that someone who has never seen our repository could build the same device on any microcontroller, in any language. The architecture, threat model, key hierarchy, permission model and storage design are ours. The code in it is reference code written to teach the design, not the competition firmware.
It covers:
- The problem and the substrate: the threat model and the hardware we had to work with
- The cryptographic core: AES-CBC-256 on the hardware accelerator, HMAC-SHA256, and a three-tier HKDF key hierarchy
- State that survives power loss: a secure flash filesystem
- Deciding who gets in: PIN rate limiting and a fail-closed permission model
- Talking to the host, and surviving physical access
- Building it, proving it, and the decision register behind every trade-off
Read it below, or download the PDF. The project overview is on the case study page.
