If what you need is the management of 16 different NIST P-curve keys and nothing else, and you don't necessarily care if the whole package is secure against DPA, that part is a cheap way to get that.

But that's not what people on this thread are asking for; they want it to do all the crypto stuff they do normally, with all the keys secured in hardware.

I'm a little out of my depth on this stuff; I've done chipset work but my part of those projects always starts with the C code. Maybe you can accomplish what you want with a cheap crypto IC. I'm really just pushing back on the idea that because you can build a smartphone out of a cheap ARM core, you can also build an HSM out of one.

> If what you need is the management of 16 different NIST P-curve keys and nothing else

You can put AES keys in the slots and have the IC perform operations with them.

> and you don't necessarily care if the whole package is secure against DPA, that part is a cheap way to get that.

Go get the NDA datasheet.

> (HSM out of ARM core alone)

We agree here.

That's AES (right, of course; I assume arbitrary small blob of data, but these are the operations the IC can do itself without you having to drag the key out into the SRAM of your MCU) for GCM, and P-curve ECC. It's not SSH, right, or Signal protocol. It's just designed to drive TLS, and can do U2F.

Does the data sheet talk about hardware side channel mitigation?

Check out the Datasheet of the ATECC508A, it has been available without an NDA since Jan 2018.