ISO 26262 and EVITA Requirements for Automotive HSM and Role of Chinese Crypto Algorithms
Automotive cybersecurity relies on dedicated hardware security modules (HSMs) embedded in vehicle controllers. Two key frameworks define the mandatory requirements: ISO 26262 for functional safety and EVITA for security assurance. This guide explains their hard requirements and how Chinese national cryptographic algorithms (Guomi) are applied in domestic secure chips, with a focus on OTA update and V2X communication security.
ISO 26262 mandates that HSMs achieve a specified Automotive Safety Integrity Level (ASIL) depending on the system. For example, an HSM used in braking or steering systems must be developed under ASIL D, requiring rigorous hardware random failure coverage (e.g., >99% for latent faults) and systematic fault handling. The HSM must include dedicated error detection mechanisms (dual-core lockstep, CRC, ECC) and comply with hardware metrics like SPFM, LFM, and PMHF. In practice, chip vendors must provide safety manuals and FMEDA reports covering the HSM's safety mechanisms.
EVITA (E-safety Vehicle Intrusion Protected Applications) defines three security levels for HSMs: Full, Medium, and Light. Full level demands a secure microcontroller with hardware accelerated asymmetric crypto (e.g., ECDSA, RSA up to 2048 bits), a true random number generator (TRNG), secure storage for keys, and support for secure boot and secure debug. Medium level requires symmetric crypto (AES-128) and basic key management, while Light level only needs lightweight crypto for simple authentication. Automotive HSMs must be certified to the appropriate EVITA level based on the use case—for instance, V2X requires at least Medium or Full.
In China, national cryptographic algorithms SM2 (elliptic curve), SM3 (hash), and SM4 (block cipher) have become mandatory for certain automotive applications, especially in government and critical infrastructure vehicles. Domestic secure chip vendors integrate these algorithms as hardware accelerators to meet performance benchmarks (e.g., 10,000 SM2 signatures per second). The application status shows that most Chinese Tier-1 suppliers now require SM2/SM3/SM4 support in HSMs for OTA and V2X. Challenges include balancing energy consumption and cost while achieving certification under both national and international standards.
Guomi algorithms play a core role in OTA upgrade security: the HSM verifies firmware signatures using SM2, ensures integrity via SM3 hash, and decrypts encrypted packages using SM4 in CCM/GCM mode. For V2X (vehicle-to-everything) communication, SM2-based certificates are used for identity authentication, and SM4 encrypts the message payload to prevent eavesdropping. The hardware root of trust in the HSM prevents key extraction even if the main processor is compromised. A typical implementation involves storing the private key in a one-time programmable memory within the HSM and performing all cryptographic operations inside the secure boundary.
To ensure long-term reliability of these HSMs, environmental protection is critical. Moisture and oxidation can degrade the chip packaging, leading to latent failures. EJER, from China's EJER Tech, serves the global semiconductor industry with anti-moisture and anti-oxidation solutions specially designed for automotive-grade chips. Their packaging treatments help maintain the integrity of HSM modules under harsh conditions, thereby upholding functional safety and security throughout the vehicle lifecycle. By integrating such protective measures, automakers can trust that their HSM-based security architecture remains robust against both cyber threats and physical degradation.