ATSHA204 datasheet(41/65 Pages) ATMEL

41 / 65 page

Atmel ATSHA204 [DATASHEET]

8740D

−CRYPTO−3/12

8.5

GenDig Command

Uses SHA-256 to combine a stored value with the contents of TempKey, which must have been valid prior to the execution of

this command. The stored value can come from one of the data slots, either of the OTP pages, either of the first two pages of

the configuration zone, or retrieved from the hardware transport key array. The resulting digest is retained in TempKey, and

can be used in one of three ways:

It can be included as part of the message used by the MAC, CheckMac, or HMAC commands. Because the MAC

response output incorporates both the data used in the GenDig calculation and the secret key from the MAC

command, it serves to authenticate the data stored in the data and/or OTP zones.

A subsequent Read or Write command can use the digest to provide authentication and/or confidentiality for the

data, in which case it is known as a data protection digest.

You can use this command for secure personalization by using a value from the transport key array. The resulting

data protection digest would then be used by the Write Command.

If Zone is two (Data) and KeyID is

≤15, the GenDig command sets TempKey.GenData to one and TempKey.KeyID to the input

KeyID; otherwise, TempKey.GenData is set to zero.

Regardless of how the resulting digest is computed, it can never be read from the device.

If TempKey.Valid is invalid, this command returns an error. Upon command completion, the TempKey.Valid bit is set,

indicating that a digest has been loaded and is ready for use. The TempKey.Valid bit is cleared when the next command is

executed. See Section 2.2 for more details.

For all KeyID values less than 0x8000, the device uses the least-significant four bits of KeyID to determine the slot number

from which to retrieve the key value from the data zone of the EEPROM. KeyID values above 0x8000 reference keys stored in

the masks of the design. In any event, all 16 bits of KeyID as input to the device are used as Param2 in the SHA-256

calculation.

If the Zone parameter points to the configuration zone, then this command returns an error if the configuration zone is

unlocked.

When the key specified on input to GenDig has the CheckOnly bit set, GenDig can be used to generate ephemeral keys

matching those generated on client CryptoAuthentication devices using the DeriveKey command. Keys that have the

CheckOnly bit set represent situations in which the device is acting as a host. In this case, the opcode and parameter bytes

that would normally be included in the SHA calculation are replaced with bytes from the input stream.

Table 8-15. Input parameters

Name

Size

Notes

Opcode

GENDIG

0x15

Param1

Zone

If 0x00 (Config): Use KeyID to specify either the first (KeyID=0) or second (KeyID = 1)

256-bit block of the configuration zone.

If 0x01 (OTP): Use KeyID to specify either the first or second 256-bit block of the OTP

zone.

If 0x02 (Data): KeyID specifies a slot in the data zone or a transport key in the hardware

array.

All other values are reserved and must not be used.

Param2

KeyID

Identification number of the key to be used, or selection of which OTP block.

Data

OtherData

4 or 0

4 bytes of data for SHA calculation when using a CheckOnly key; otherwise ignored.

Table 8-16. Output parameter

Name

Size

Notes

Success

Upon successful execution, the Atmel ATSHA204 returns a value of zero.

ATSHA204 Datasheet(PDF) 41 Page - ATMEL Corporation

ATSHA204 Datasheet(HTML) 41 Page - ATMEL Corporation

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65

Datasheet Download

Link URL