ATSHA204 datasheet(15/65 Pages) ATMEL

15 / 65 page

Atmel ATSHA204 [DATASHEET]

8740D

−CRYPTO−3/12

3.3.6

Password Checking

Many applications require a user to enter a password to enable features, decrypt stored data, or some other purpose.

Typically, the expected password has to be stored somewhere in memory and is, therefore, subject to discovery. The

ATSHA204 can securely store the expected password and perform a number of useful operations on it. The password is never

passed in the clear to the device, nor can it be read from the device. It is hashed with a random number in the system software

before being passed to the device.

The copy capability of the CheckMac command enables the following types of password checking options:

CheckMac does an internal comparison with the expected password and returns a Boolean to the system to indicate

whether the password was correctly entered or not.

If the device determines that the correct password has been entered, then the value of the password can optionally

be combined with a stored or ephemeral value to create a key that can be used by the system for data protection

purposes.

If the device determines that the correct password has been entered, the device can use this fact to optionally

release a secondary, high entropy secret, which can be used for data protection without risk of any exhaustive

dictionary attack.

If the password has been lost, an entity with knowledge of a parent key value can optionally write a new password

into the slot. Also optionally, the current value can be encrypted with a parent key and read from the device.

Passwords should be stored in even-numbered slots. If the password is to be mapped to a secondary value (use #3 above),

then the target slot containing this value is located in the next higher slot number (the password slot number plus one).

Otherwise, the target slot is the same as the password slot.

ReadKey for the target slot must be set to zero to enable this capability. In order to prevent fraudulent or unintended usage of

this capability, do not set ReadKey for any slot to zero unless this CheckMac/copy capability is specifically required. In

particular, do not assume that other bits in the configuration word for a particular slot override the enablement of this capability

specified by ReadKey = 0.

This capability is enabled only if the mode parameter to CheckMac has a value of 0x01, indicating:

The first 32 bytes of the SHA-256 message are stored in a data slot in the EEPROM (the password).

The second 32 bytes of the SHA-256 message must be a randomly generated nonce in the TempKey register.

If the above conditions are met and the input response matches the internally generated digest, then the contents of the target

key are copied to TempKey. The other TempKey register bits are set as follows:

• SourceFlag is set to one (not random)

• GenData is set to zero (not generate by the GenData command)

• CheckFlag is set to zero (TempKey is not restricted to the CheckMac command)

• Valid is set to one

3.3.7

Transport Keys

The ATSHA204 device includes an internal hardware array of keys (transport keys) that are intended for secure

personalization prior to locking of the data section. The values of the hardware keys are kept secret, and are made available to

qualified customers upon request to Atmel. These keys can be used with the GenDig command only, and are indicated by a

KeyID value

≥ 0x8000.

This is the intended personalization command flow:

Write intended values to the configuration zone, and then lock the configuration zone.

Write non-secret slots and OTP zone, data should be passed to the device in the clear.

Generate a random personalization key in any one of the secret slots with the following sequence:

Nonce command to generate a random nonce in TempKey

Gendig specifying a transport key

≥ 0x8000

Gendig using the compliance (default) value stored in the slot to be used for personalization

Encrypted Write to that same slot (overwrites the compliance value)

ATSHA204 Datasheet(PDF) 15 Page - ATMEL Corporation

ATSHA204 Datasheet(HTML) 15 Page - ATMEL Corporation

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65

Datasheet Download

Link URL