ATECC508A datasheet(31/109 Pages) MICROCHIP

31 / 109 page

There is no reset mechanism for this limitation. After 128 uses (or the number of one bits set in

LastKeyUse on personalization), Key 15 is permanently disabled. This capability is not susceptible to

power interruptions. Even if the power is interrupted during execution of the command, only a single bit in

LastKeyUse will be unknown, all other bits in LastKeyUse will be unchanged, and the key will remain

unchanged.

If fewer than 128 uses are desired for Key 15, then some of the bytes within this array should not be

initialized to 0xFF. The only legal values for bytes within this field (besides 0xFF) are 0x7F, 0x3F,

0x1F, 0x0F, 0x07, 0x03, 0x01, or 0x00. The total number of bits set to one indicates the number

of uses.

Example: How to set 16 uses is shown as follows:

0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,

0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00

The limited use capability applies to the same commands, and in the same situations, in which they are

checked for the LimitedUse feature (see the previous section for more information). In addition, the

Verify command will check for single use restrictions on both the public key (when that key is stored

internally), and the key to be validated when the command is run in validation mode and either is stored

in slot 15.

3.2.7

Password Checking

Many applications require a user to enter a password to enable features, decrypt stored data, or perform

some other task. Typically, the expected password has to be stored somewhere in the memory, and

therefore is subject to discovery. The ATECC508A can securely store the expected password and

perform a number of useful operations upon it. The password is never passed in the clear to the device,

and it cannot be read from the device. It is hashed with a random number in the system software before

being passed to the device.

The copy capability of the CheckMac command enables the following types of password checking

options:

CheckMac does an internal comparison with the expected password and returns a boolean result

to the system to indicate whether the password was correctly entered or not.

If the device determines that the correct password has been entered, then the value of the

password can optionally be combined with a stored ephemeral value to create a key that can be

used by the system for data protection purposes.

If the device determines that the correct password has been entered, then the device can use this

fact to optionally release a secondary high entropy secret, which can be used for data protection

without the risk of an exhaustive dictionary attack.

If the password has been lost, then an entity with knowledge of a parent key value can optionally

write a new password into the slot. Optionally, the current value can be encrypted with a parent key

and read from the device.

To prepare for this CheckMac/Copy capability, passwords should be stored in even numbered slots. If

the password is to be mapped to a secondary value (using the third option above), then the target slot

containing this value is located in the next higher slot number (i.e. the password’s slot number plus one);

otherwise, the target slot is the same as the password slot. ReadKey for the target slot must be set to

zero to enable this capability. In order to prevent fraudulent or unintended usage of this capability, do not

set ReadKey for any slot to zero unless this CheckMac/Copy capability is specifically required. In

ATECC508A

Security Information

Datasheet Complete

DS20005927A-page 31

ATECC508A Arkusz danych(PDF) 31 Page - Microchip Technology

ATECC508A Arkusz danych(HTML) 31 Page - Microchip Technology

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 ...More

Arkusz danych Pobierz

Link URL