ATSHA204A datasheet(87/93 Pages) MICROCHIP

87 / 93 page

If the device determines that the correct password has been entered, then the value of the

password can optionally be combined with a stored or ephemeral value to create a key that can be

used by the system for data protection purposes.

If the device determines that the correct password has been entered, then the device can use this

fact to optionally release a secondary high entropy secret, which can be used for data protection

without the risk of an exhaustive dictionary attack.

If the password has been lost, an entity with knowledge of a parent key value can optionally write a

new password into the slot. Optionally, the current value can be encrypted with a parent key and

read from the device.

Passwords should be stored in even-numbered slots. If the password is to be mapped to a secondary

value (use Step 3 above), then the target slot containing this value is located in the next higher slot

number (the password slot number plus one); otherwise, the target slot is the same as the password slot.

ReadKey for the target slot must be set to 0x0 to enable this capability. In order to prevent fraudulent or

unintended usage of this capability, do not set ReadKey for any slot to 0x0 unless this CheckMac/Copy

capability is specifically required. In particular, do not assume that other bits in the configuration word for

a particular slot override the enablement of this capability specified by ReadKey = 0x0.

This capability is enabled only if the mode parameter to CheckMac has a value of 0x01 or 0x05 and

TempKey.SourceFlag matches Mode<2>.

Note: Care should be taken when using Mode 0x05 as the system is subject to a replay attack;

however, there may be some system configurations in which this arrangement is advantageous.

•

The first 32 bytes of the SHA-256 message are stored in a data slot in the EEPROM (the

password).

•

The second 32 bytes of the SHA-256 message must be a randomly generated nonce in the

TempKey register.

If the above conditions are met and the input response matches the internally generated digest, then the

contents of the target key are copied to TempKey. The other TempKey register bits are set as follows:

•

SourceFlag is set to one (not random).

•

GenData is set to zero (not generated by the GenData command).

•

CheckFlag is set to zero (TempKey is not restricted to the CheckMac command).

•

Valid is set to one.

13.3.7

Transport Keys

The ATSHA204A device includes an internal hardware array of keys (transport keys) that are intended for

secure personalization prior to locking of the data section. The values of the hardware keys are kept

secret and are made available to qualified customers upon request to Microchip. These keys can be used

with the GenDig command only and are indicated by a SlotID value greater than or equal to 0x8000.

For GenDig and all other commands, SlotID values less than 0x8000 always reference keys that are

stored in the Data zone of the EEPROM. In these cases, only the four least-significant bits of SlotID are

used to determine the slot number, while the entire 16-bit SlotID as input is used in any SHA-256

message calculation.

ATSHA204A

Reference and Application Notes

DS40002025A-page 87

ATSHA204A Datasheet(PDF) 87 Page - Microchip Technology

ATSHA204A Datasheet(HTML) 87 Page - Microchip Technology

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93

Datasheet Download

Link URL