NXP Semiconductors

A5000

Edge Lock Secure Authenticator

identifier is then used in subsequent operations to access the object. The number of

objects that can be allocated is only limited by the available memory in the system. After

usage, objects can be deleted and the associated memory is freed up again.

There is also the possibility to create transient objects. Transient objects have an object

descriptor stored in non-volatile memory, but the object content is stored in RAM.

Together with the import/export functionality of A5000, transient objects can be used

securely store secret keys in a remote memory system.

When the creation of secure objects is interrupted by internal errors (e.g. insufficient

space) or a tearing event, the memory is not freed up automatically. The memory can be

freed up using garbage collection. An example to trigger garbage collection is included in

the Plug & Trust Middleware (InvokeGarbageCollection) [5].

3.3 Startup behaviour

range the IC boots up.

4 Pre-provisioned ease of use configuration

A5000 variants with pre-provisioned credentials for ease of use are available and can

be used during development phase or in the field. With this customers have all keys pre-

injected in A5000 that are required for the main use cases as, e.g., originality check or

cloud onboarding. The identifying information can be read out using the example "get

info" from A5000 Plug&Trust MW package. This variant identifier is also known as OEF

ID. This will allow to distinguish the delivered configuration.

For more information, see Table 3 and Table 4:

Variant

Variant Identifier (OEF ID)

A5000

A736

A5000 Arduino Dev. Kit.

A736

Table 3. Variant Identifiers

Key name and type

Certificate

Usage policy

(keys)

Erasable by

customer

(keys)[1]

Identifier

Originality Key 0, ECC256, Die

Individual

Certificate 0

Anybody, Read

No

0xF0000000 (key)

0xF0000001 (cert)

Originality Key 1, ECC256, Die

Individual

Certificate 1

Anybody, Read

No

0xF0000002 (key)

0xF0000003 (cert)

Root of Trust signing key,

ECC256, Die Individual (used

to attest new generated keys)

N/A

Anybody Read and

Attestation

No

0xF0000012 (key)

Table 4. Variant A5000

[1]

Certificates are always erasable by customer. Consider that their deletion prevents the device from connecting to the EdgeLock 2GO service over TLS.

4.1 A5000 Chain of Trust

A5000

All information provided in this document is subject to legal disclaimers.

© NXP B.V. 2022. All rights reserved.

Product data sheet

Rev. 1.0 — 28 March 2022

667609

7 / 26