ATECC608A datasheet(49/81 Pages) MICROCHIP

49 / 81 page

– 0: The source key that will be combined with TempKey is the target key as specified in the command line

(Roll Key operation)

– 1: The source key is the parent key of the target key, which is found in SlotConfig[TargetKey].WriteKey

(Create Key operation).

• If SlotConfig[TargetKey].Bit15 is set, an input MAC must be present and have been computed as follows:

– SHA-256(ParentKey, Opcode, Param1, Param2, SN[8], SN[0:1])

where the ParentKey ID is always SlotConfig[TargetKey].WriteKey.

• If performing a Roll Key operation and KeyConfig[TargetKey].ReqAuth is one, then the appropriate authorization

must have been performed using KeyConfig[TargetKey].AuthKey prior to the execution of DeriveKey. If

performing a Create Key operation and KeyConfig[ParentKey].ReqAuth is one, then the appropriate

authorization must have been performed using KeyConfig[ParentKey].AuthKey prior to the execution of

DeriveKey.

Prior to execution of this command, the Nonce command must have been run to create a valid nonce in TempKey. If

KeyConfig.ReqRandom is one for the source key, this nonce must have been created with the internal RNG or an

error will be returned. In all cases, Mode[2] must match the state of TempKey.SourceFlag or the command will return

an error.

If performing a Roll Key operation and KeyConfig[TargetKey].ReqAuth is one, then the appropriate authorization must

have been performed using KeyConfig[TargetKey].AuthKey prior to the execution of DeriveKey. If performing a

Create Key operation and KeyConfig[ParentKey].ReqAuth is one, then the appropriate authorization must have been

performed using KeyConfig[ParentKey].AuthKey prior to the execution of DeriveKey.

If an input MAC is required and KeyConfig[ParentKey].ReqAuth is one, then the appropriate authorization must have

been performed using KeyConfig[ParentKey].AuthKey prior to the execution of DeriveKey.

If a parent key is involved in the operation (either SlotConfig[TargetKey].Bit12 or SlotConfig[TargetKey].Bit15 are set)

and SlotConfig[ParentKey].LimitedUse is also set, DeriveKey returns an error if Counter[0] has reached its limit.

DeriveKey always ignores LimitedUse for the target key.

WARNING

If the source and target key are the same, then there is a risk of permanent loss of the key value if power

is interrupted during the write operation. If the Configuration bits permit it, then the key value may be

recovered using an authenticated and encrypted write based on the parent key.

For the ATECC608A-TNGLoRaWAN, the DeriveKey command can be run on Slot 0. Slot 13 is the parent key used

for the key derivation and an authorizing MAC is always required.

Table 5-64. Input Parameters DeriveKey

Opcode

(1 Byte)

Mode

(1 Byte)

TargetKey

(2 Bytes)

Data

(0 or 32 Bytes)

Description

0x1C

0x00

0x00 0[Slot]

Optional MAC data

Use if TempKey Source was Random

0x04

0x00 0[Slot]

Optional MAC data

Use if TempKey Source was fixed

Table 5-65. Output Response DeriveKey

Name

Size

Notes

Response

1 Byte

•

0x00 - If successful

•

Error code if there is a failure

The key written to the target slot is the result of SHA-256 of the following message:

ATECC608A-TNGLoRaWAN

Device Commands

Complete Datasheet

DS40002154B-page 49

ATECC608A Datasheet(PDF) 49 Page - Microchip Technology

ATECC608A Datasheet(HTML) 49 Page - Microchip Technology

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81

Datasheet Download

Link URL