Three manufacturers, because flaws come by manufacturer.
Chips from the same company share a boot ROM, a bitstream format and a toolchain. A flaw in any of them reaches every chip in that line at once. So each voter in Roost is a chip from a different manufacturer.
The voters
Three independent silicon roots.
If one chip, or a whole manufacturer's line, is broken, that is one vote. Roost needs two.
Specifications
At a glance.
| Form factor | 3U 19-inch rack appliance |
|---|---|
| Signing | 3 voters from 3 manufacturers, 2-of-3 quorum, plus 1 monitor that never signs |
| Keys | Regenerated from each chip's PUF at power-up; never stored |
| Enclosure | Outer aluminium shell with tamper seals, security screws and lid switches; inner enclosure sealed and sensed on all six sides |
| Tamper response | Immediate erasure, also on battery with the power off |
| Environment | Per-chip temperature, every power rail, voltage glitches and clock anomalies monitored |
| Power and cooling | Redundant power supplies and fan modules, swapped without opening the enclosure |
| Deployment | Closed network, on-premises; sold as a pair for high availability; air-gapped operation by file |
| Design targets | Designed to FIPS 140-3 and KCMVP requirements and the EU Cyber Resilience Act |
See Roost refuse an unapproved signature.
A 30-minute live demo with our engineers.