ATECC508A datasheet(80/109 Pages) MICROCHIP

80 / 109 page

Note: For best security, Microchip recommends that the PrivWrite command not be used, and that

private keys be internally generated from the RNG using the GenKey(Create) command.

The slot indicated by this command must be configured via KeyConfig.Private to contain an ECC private

key, and SlotConfig.IsSecret must be set to one, or else this command will return an error. If the slot is

individually locked using SlotLocked, then this command will also return an error.

The private key data is always sent to the device as a 36 byte integer. It is passed to the device MSB first.

The first four bytes (32 bits) should be zero.

Prior to the data zone being locked, this command can be used to write the slot contents without regards

to the SlotConfig value and/or the method by which TempKey was generated. The input data may or may

not be encrypted based on the zone byte; if the input data is plain text then the MAC is ignored, but if it is

encrypted then the MAC must be present and be properly computed. Prior to the configuration zone

being locked, this command will always return an error.

Once the Data zone is locked, the following is necessary for the write to complete:

•

SlotConfig.IsSecret must be one.

•

SlotConfig.WriteConfig must be set to Encrypt to indicate that writes require encryption. It is not

possible to write to a slot for which WriteConfig is set to any other value.

•

TempKey must be valid, its contents must have been generated using the GenDig command, and

the KeyID used during the GenDig execution must match SlotConfig.WriteKey.

•

Zone<6> must be set to indicate that the input data has been encrypted as follows:

–

The first 32 input bytes should be externally encrypted by XORing their value with the current

value in TempKey. The next four bytes should be externally encrypted by XORing their value

with the first four bytes of SHA-256(TempKey).

•

An input authenticating MAC must be computed as follows:

–

SHA-256(TempKey, Opcode, Param1, Param2, SN<8>, SN<0:1>, <21 bytes of zeros>, 36

bytes of PlainTextData)

KeyConfig.ReqRandom, KeyConfig.ReqAuth and KeyConfig.AuthKey are ignored by this command

because they will have been checked by the GenDig command for the parent encrypting key.

Table 9-40. Input Parameters

Name

Size

Notes

Opcode PRIVWRITE

0x46

Param1

Zone

Bit 7:

Must be zero.

Bit 6:

0 = The input data is not encrypted: legal only when the Data zone is

unlocked.

1 = The input data is encrypted using TempKey.

Bits 5-0: Must be zero.

Param2

KeyID

Key slot to be written.

Data_1

Value

Information to be written to the slot may be encrypted. Must be 36 bytes long

regardless of the size of the key.

Data_2

MAC

Message Authentication Code to validate EEPROM Write operation.

ATECC508A

Security Commands

Datasheet Complete

DS20005927A-page 80

ATECC508A датащи(PDF) 80 Page - Microchip Technology

ATECC508A датащи(HTML) 80 Page - Microchip Technology

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 ...More

датащи скачать

ссылки URL