lowRISC® and Partners to Deliver Commercial-Quality, Open-Source CHERI Secure Enclave with InnovateUK Support

COSMIC Project kicks off to provide a secure foundation for application-class SoCs, combining CHERI technology with formal verification and open-source design

CAMBRIDGE, United Kingdom, Nov. 12, 2025 (GLOBE NEWSWIRE) -- lowRISC CIC and Capabilities Limited are pleased to announce the launch of the COSMIC Project, led by lowRISC and backed by the UK Department for Science, Innovation and Technology (DSIT) and InnovateUK.

COSMIC aims to deliver the world’s first open-source, commercial-quality, CHERI-enabled, 64-bit application-class Secure Enclave design. This will provide CHERI memory safety and compartmentalisation, along with the formal verification required to address the security needs of application-class system-on-chip (SoC) designs. The project is planned to run between now and March 2028, with the first stage completing in March 2026.

Secure Enclaves are isolated subsystems in an SoC designed to run code and store data in a highly secure environment. They keep sensitive information – such as passwords and biometric data – safe even if the main operating system or other parts of the SoC are compromised. Secure Enclaves are used industry-wide, from mobile phones and IoT edge nodes to data centers, to help ensure the security of systems in the face of the ever-growing threat of cybercrime.

“At lowRISC, we believe strongly in our mission to make commercial open-source silicon real, and in security by openness, not obscurity,” said Javier Orensanz Martinez, CEO at lowRISC. “It is fantastic that not only is this supported by commercial partners such as Google and Rivos, but also by funds from the UK government.”

“We’re delighted to see lowRISC advancing the adoption of CHERI-enabled technologies, particularly following the success of the Sunburst Project,” said Professor John Goodacre, Director of Secure & Resilient Growth at InnovateUK. “Their efforts are accelerating the commercial maturity of the CHERI-enhanced RISC-V processor core and paving the way for its integration into future high-security platforms such as OpenTitan.”

COSMIC leverages the HW IP and design principles developed in OpenTitan® with the addition of the CVA6-CHERI application processor developed by Capabilities Limited, based on CVA6 from the OpenHW Foundation. CVA6-CHERI improves performance, brings in the ability to run a Linux-style operating system, and implements the hardware-based memory-safety capabilities of the forthcoming RISC-V ‘Y’ extension (CHERI). The CVA6-CHERI processor will also be extended with a dual-core lockstep configuration, further enhancing its security credentials. The design will be exercised with large-scale software stacks such as Linux, leverage concepts from security-focused designs like seL4 and will be integrated into the resulting open-source COSMIC reference design.

“CHERI is the state-of-the-art in hardware-enabled memory safety,” said Professor Robert Watson, Director at Capabilities Limited, and Professor of Systems, Security, and Architecture at the University of Cambridge. “We are delighted that Capabilities Limited’s open-source CVA6-CHERI design has been selected for the COSMIC secure enclave.”

Verification will be critical for COSMIC to achieve commercial readiness. A team led by Professor Tom Melham at Oxford University, in collaboration with lowRISC, has applied formal verification extensively to the CHERIoT-Ibex Core developed by Microsoft. The work demonstrates that instruction execution in the core conforms precisely to its ISA specification. Work in COSMIC will aim at similarly comprehensive formal verification for CVA6-CHERI.

“Our work on formal verification of CHERIoT-Ibex set a new standard for thoroughness and coverage, producing the most verified CHERI processor to date,” said Professor Tom Melham. “CHERI-CVA6 will be a significant and welcome challenge in scaling our methods now to an application class core, and we are delighted to be pushing the boundaries of CHERI processor formal verification as part of COSMIC.”

Commenting on the COSMIC project, Mike Eftimakis, Founding Director of the CHERI Alliance said: "The CHERI Alliance is thrilled to see two of its founding members unveil a new product leveraging CHERI security technology. As cyber threats skyrocket and regulations tighten at an unprecedented pace, manufacturers must embed rock-solid security in their products, now. COSMIC provides a solid base for this."

Learn more at cosmic-project.org.

About OpenTitan®
The OpenTitan Project, stewarded by lowRISC, has already commercial-quality open-source RoT devices, now in production by Nuvoton and soon to be shipping in new Google Chromebooks. OpenTitan can also be configured as an integrated SoC subsystem, and is in production at Rivos.

About lowRISC®
Founded in 2014 at the University of Cambridge Department of Computer Science and Technology, lowRISC is a not-for-profit company/CIC that provides a neutral home for collaborative engineering to develop and maintain commercial-quality open source silicon designs and tools for the long term. The lowRISC not-for-profit structure combined with full-stack engineering capabilities in-house enables the hosting and management of high-quality projects like OpenTitan and Sunburst via the Silicon Commons® approach.

About Capabilities Limited
CapLtd is a University of Cambridge spinout transitioning the CHERI technology into broad industrial use. With teams working on architecture, microarchitecture, software, and formal methods, we perform fundamental and applied research, as well as enable product development, for industrial, government, and national security clients. Recent projects have developed the open-source CVA6-CHERI application core, created CHERI-enabled prototypes of software applications such as nginx and the Chromium browser, and enabled CHERI adoption in open-source systems such as FreeBSD, Linux, and seL4.

Media Contact
lowRISC@w2comm.com