Figure 6. Wrap/unwrap local envelop command flow

IoT device

Local host

I2C

STSAFE-A120

Builds wrap command

C-MAC and enciphers the

plain text

Generate key

(key slot number)

OK

Wrap local envelope

(plain text + local envelope key slot)

Verifies C-MAC

Enciphered plain text

Decrypts cryptogram

(plaint text key) and enciphers it with

local host’s cipher key

Envelope

Stores envelope

Builds unwrap

command C-MAC

Unwrap local envelope

(local envelope key slot + envelope)

Deciphers the received

response to obtain the plain text

and use it

2.4

Key establishment for secure connection (TLS)

This use case shows how to generate the same shared secret in the local host and in the remote host without

having to exchange it. The principle consists in generating two ECC ephemeral key pairs on both sides. Then,

after exchanging the public keys of these two key pairs, the local host and the remote host run an ECDH scheme

to calculate the shared secret.

The goal of this use case is to share a secret between the local host and the remote server using the elliptic curve

Diffie-Hellman (ECDH) scheme with a static key in the STSAFE-A120. The STSAFE-A120 also supports ECDHE

that utilizes an ephemeral key, but this is not illustrated.

The shared secret should further be derived to one or more session keys, but this is not illustrated here. The

session keys can then be used in communication protocols like TLS for confidentiality, integrity, and authenticity of

the data that are exchanged between the local host and the remote server. Below are some examples of data:

•

From the local host to the remote server: power consumption of a smart meter, alarm of a fire sensor or

blood pressure data of a health sensor.

•

From the remote server to the local host: activating the recharge of the battery of an electric car, activating

home appliances like air conditioning or water heaters, or pushing firmware upgrades to IoT devices.

STSAFE-A120

Product use cases

DS14609 - Rev 1

page 8/38