Earlier this year, hardware hacker Andrew “bunnie” Huang launched a crowdfunding campaign on Crowd Supply for a small, $9.50 evaluation board called Dabao. It funded in March, drew 964 backers, and 3,400 boards were claimed before orders closed. As of late June, boards have shipped from the factory and are on their way to developers around the world.
One detail that’s easy to miss is that the chip on that board, Baochip-1x, is built from the same physical silicon as Daric (the internal code name for CrossBar Chip 1), CrossBar’s Secure Processing Unit (SPU). They are fabricated from the same die and mask set on TSMC’s 22nm process, with chip-probe-time fusing and software determining which hardware features are active. Learn more in this article. In bunnie’s own words:
“Our chips share the exact same mask, but you wouldn’t guess that we’re the same die unless I told you this.”
The campaign offers a rare hands-on look yet at the silicon shared between Baochip-1x and Daric, and the story behind it says a lot about where secure hardware is heading.
1. One Die, Two Personalities
As bunnie describes it, CrossBar is the “host” company that funded the mask set, while Baochip is the “hitchhiker.” bunnie integrated his open-source VexRiscv RISC-V core alongside CrossBar’s design, with chip-probe-time fusing determining which processor is enabled. Baochip-1x activates the VexRiscv core, while Daric activates CrossBar’s ARM core. As bunnie notes, creating multiple products from a single mask by enabling or disabling different cores or features is standard industry practice. The Baochip-1x and Daric collaboration, however, is an uncommon application of that approach.
The arrangement traces back to what we wanted Daric to be. Crossbar set out to build a high-performance secure enclave that differentiates in two ways: fabrication in a relatively advanced (for security chips) 22nm process, and the use of ReRAM technology for non-volatile storage. ReRAM retains data without power like flash, but with faster write times, small 32-byte page sizes, and the ability to scale below 40nm, a limit flash has not been able to break. For risk reduction, Daric uses a tape-out-proven ARM core; the Baochip variant activates the RISC-V side instead.
2. A Shared Security Fabric
Because both products share the same die, the hardware security architecture showcased in the Dabao campaign also underpins Daric. The chip includes hardware security features commonly found in commercial secure elements, including a ring-oscillator-based true random number generator, hardware-protected key slots, one-way counters, signed boot, and hardware accelerators for RSA, elliptic-curve cryptography, SHA-256/512, SHA-3, Blake2/3, and AES. Physical attack countermeasures include a security mesh, glitch sensors, and ECC-protected RAM. bunnie describes the platform as well-suited for security-critical applications such as password managers, authenticators, and other high-assurance applications, which is the class of workload Daric was designed for.
3. Transparency as a Design Choice
The security-chip industry has a paradox that bunnie lays out well: certification schemes like Common Criteria effectively reward closed-source designs, because a flaw that’s harder to find scores as “more secure.” The result is an industry of black boxes, despite years of users asking for transparency.
CrossBar took a different approach by working with bunnie on an open-source strategy. On the Baochip side, much of the design is open for inspection. Most of the compute logic’s source code is available on GitHub, the bootloader is fully open and reproducible, and the package supports IRIS (Infra-Red In-Situ) inspection, allowing users to verify the actual transistors on the die with a modified CMOS camera. As the campaign says,
“Trust it because you can, not because you must.”
The open development model has already produced useful feedback. Shortly after launch, community researchers reviewing the published RTL raised questions about the masking scheme in one of the AES implementations. This is one example of how public review can help identify potential issues early: flaws surface in public, before attackers find them in private. We published a response on Medium clarifying the design choices and security context, and the red teams are already reaching for their ChipWhisperers.
The openness also benefits development tools. In his latest campaign update, bunnie demonstrates waveform-level “God mode” debugging by stepping through every internal signal of the chip’s I/O coprocessor against the actual RTL. That level of visibility is simply not possible on closed silicon.
4. What the Traction Means
For those watching this space from an investment lens, a few data points from the campaign are worth noting. This is not an academic multi-project-wafer curiosity: the chip is fabricated on a fully production-qualified TSMC process with a dedicated mask set, and the supply chain can produce millions of units. Wafers have gone through an engineering qualification lot, hundreds of chips reached alpha developers, production wafers are moving through the fab in Hsinchu, and finished boards shipped from the factory in June, with design risk deemed low and chip yields so far acceptable.
The campaign also demonstrated early interest, with nearly 1,000 backers pre-ordering thousands of boards: nearly a thousand backers pre-ordered thousands of units of a brand-new microcontroller platform, at a price point ($9.50) that competes head-on with the Raspberry Pi Pico 2 and ESP32-class boards, while carrying secure-element-grade hardware features not commonly found on boards in this price range.
5. The Bigger Picture
The Dabao project shows that there is strong interest in hardware that can be inspected and verified. It shows there’s a growing community that wants inspectable, verifiable silicon, and Daric brings that same die architecture, the same hardware security foundation, and CrossBar’s ReRAM technology to the secure-enclave market. One die, two products, and a shared goal: making secure hardware more transparent and verifiable.
— The CrossBar Team