2

Product use cases

This section illustrates the many uses of an STSAFE-A120 device using asymmetric cryptography.

2.1

Authentication

This scenario illustrates the command flow where the STSAFE-A120 is mounted on a device that authenticates to

a remote host (IoT device case), the local host being used as a pass-through to the remote server.

The scenario where the STSAFE-A120 is mounted on a peripheral that authenticates to a local host, for example

games, mobile accessories or consumables, is exactly the same.

Command flow

1. Obtain the public key of the STSAFE-A120 chip in the host device:

–

Command 1 is used to read the X509 public key certificate from the data partition of the STSAFE-A120

chip.

–

The host device verifies the X509 public key certificate with the CA public key (the host is responsible for

getting a copy of this key). When the verification process succeeds, the host device has an authentic

copy of the STSAFE-A120 public key that it is used later on for verification of the signature.

2. The host device generates a challenge and stores it for later use in the verification of the signature. The host

device then computes a hash of this challenge and sends it to the STSAFE-A120 in command 2 to fetch the

signature that the STSAFE-A120 chip computed with its private key. The host device verifies the signature

with the STSAFE-A120 public key (obtained in the first step of this scenario). When valid, the host knows that

the peripheral or IoT device is authentic.

Figure 3. Example of IoT device authentication

Peripheral

Wire or wireless

1. Read certificate

X509 public key certificate

2. Generate signature (challenge)

Signature

Read certificate

X509 public key certificate

Generate signature (challenge)

Signature

Verifies peripheral’s public

key certificate

Generates

challenge

Verifies signature

Remote host

Local host

STSAFE-A120

I2C

STSAFE-A120

Product use cases

DS14609 - Rev 1

page 5/38