ATECC608A datasheet(11/81 Pages) MICROCHIP

11 / 81 page

...........continued

Item

Slot #

Bytes

Signer Certificate

[144:215]

Additional Data Storage

[216-415]

2.2.1.8

I/O Protection Key

The Verify, ECDH, , and KDF commands can optionally use the I/O protection feature to encrypt some parameters

and validate (via MAC) some responses. This is to help protect against man-in-the-middle attacks on the physical I2C

bus. However, before this feature can be used, the MCU and ATECC608A-TNGLoRaWAN need to generate and

save a unique I/O protection key, essentially pairing the MCU and ATECC608A-TNGLoRaWAN devices to each

other. The pairing process must happen on first boot.

I/O Protection Key Generation:

MCU uses random command to generate a random 32-byte I/O protection key.

MCU saves the I/O protection key in its internal Flash.

MCU writes I/O protection key to the I/O protection key slot.

MCU slot locks that slot to make the I/O protection key permanent.

As a pairing check, the MCU could use the MAC command to issue a challenge to the I/O protection key and verify

the I/O protection key stored in Flash matches the one in the ATECC608A-TNGLoRaWAN.

2.2.1.9

General Data Storage

No slots have been specifically setup for General Data Storage. Extra data bytes not used within some of the AES

keys may potentially be used for additional data storage if required. Discuss this option with Microchip prior to

implementing this in any of the slots.

2.2.2

Slot Configuration Terminology

The following section provides a set of terms used to discuss configuration options. The terms are arranged

alphabetically.

Term

Description

AES Key

Slot can be used as a key source for AES commands. The AES key is 128 bits in width for the

ATECC608A-TNGLoRaWAN.

Always Write

Slot can be written in the clear with the Write command.

Clear Read

Slot is considered public (non-secret) and its contents can be read in the clear with the Read

command.

ECDH

Elliptic Curve Diffie Hellman. Private key can be used with the ECDH command.

Encrypted Write Slot can only be written using an encrypted write based on the write key specified.

Ext Sign

Private key can be used to sign external (arbitrary) messages.

Int Sign

Private key can be used to sign internal messages generated by the GenKey or GenDig

commands. Used to attest the device's internal keys and configuration.

Lockable

Slot can be locked at some point in the future. Once locked, the slot contents cannot be changed

(read/use only).

No Read

Slot is considered secret and its contents cannot be read with the Read command. Private keys

and symmetric secrets should always be configured as No Read.

No Write

Slot cannot be changed with the Write command.

Permanent

Private key is permanent/unchangeable. It is internally generated during factory provisioning.

Updatable

Private key can be overwritten later with a new, random, internally-generated private key. Its

initial value is internally generated during factory provisioning.

ATECC608A-TNGLoRaWAN

EEPROM Memory and Data Zone Access Policies

Complete Datasheet

DS40002154B-page 11

ATECC608A Datasheet(PDF) 11 Page - Microchip Technology

ATECC608A Datasheet(HTML) 11 Page - Microchip Technology

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81

Datasheet Download

Link URL