ATSHA204 datasheet(38/65 Pages) ATMEL

38 / 65 page

Atmel ATSHA204 [DATASHEET]

8740D

−CRYPTO−3/12

8.3

DeriveKey Command

The device combines the current value of a key with the Nonce stored in TempKey using SHA-256, and places the result into

the target key slot. SlotConfig[TargetKey]. Bit13 must be set or DeriveKey will return an error.

If SlotConfig[TargetKey].Bit12 is zero, the source key that will be combined with TempKey is the target key specified in the

command line (Roll Key operation). If SlotConfig[TargetKey].Bit12 is one, the source key is the parent key of the target key,

which is found in SlotConfig[TargetKey].WriteKey (Create Key operation).

Prior to execution of this command, the Nonce command must have been run to create a valid nonce in TempKey. Depending

on the state of bit two of the input mode, this nonce must have been created with the internal random number generator, or it

must have been fixed.

If SlotConfig[TargetKey].Bit15 is set, an input MAC must be present and have been computed as:

SHA-256(ParentKey, Opcode, Param1, Param2, SN[8], SN[0:1])

where the ParentKey ID is always SlotConfig[TargetKey].WriteKey.

If SlotConfig[TargetKey].Bit12 or SlotConfig[TargetKey].Bit15 is set and SlotConfig[ParentKey].SingleUse is also set,

DeriveKey returns an error if UseFlag[ParentKey] is 0x00. DeriveKey ignores SingleUse and UseFlag for the target key if

SlotConfig[TargetKey].Bit12 and SlotConfig[TargetKey].Bit15 are both zero.

For slots 0-7 only, if input parsing and the optional MAC check succeed, UseFlag[TargetKey] gets set to 0xFF and

UpdateCount[TargetKey] is incremented. If UpdateCount currently has a value of 255, it wraps to zero. If the command fails for

any reason, these bytes are not updated. The value of UpdateCount may be corrupted if power is interrupted during the

execution of DeriveKey.

Note:

If the source and target key are the same, there is a risk of permanent loss of the key value if power is

interrupted during the write operation. If the configuration bits permit it, the key slot may be recovered using an

authenticated and encrypted write based on the parent key.

Table 8-11. Input Parameters

Name

Size

Notes

Opcode

DERIVEKEY

0x1C

Param1

Random

Bit 2: The value of this bit must match the value in TempKey.SourceFlag or the

command will return an error.

Bits 0:1, 3:7: Must be zero.

Param2

TargetKey

Key slot to be written.

Data

Mac

0 or 32

Optional MAC used to validate operation.

Table 8-12. Output parameter

Name

Size

Notes

Success

Upon successful completion, the ATSHA204 returns a value of zero.

ATSHA204 Datasheet(PDF) 38 Page - ATMEL Corporation

ATSHA204 Datasheet(HTML) 38 Page - ATMEL Corporation

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65

Datasheet Download

Link URL