NXP Semiconductors
AN13500
EdgeLock A5000 Secure Authenticator for electronic anti-counterfeit protection using device-to-device
authentication
Note:
We assume the NXP root and intermediate CA are already stored in the machine
and control unit.
Note:
To simplify the example we do not use the A5000 for validating the control unit
certificate, because the keys of the NXP root and intermediate CA are not stored inside
the A5000 device.
The control unit certificate is valid in case OpenSSL returns
OK
. This also means, that the
public key included in the control unit certificate can be trusted.
4.7.1.2 Step 2: Proof of control unit private key possession
In this step, the control unit must prove that it is in possession of the ECC private key.
•
For this purpose, the machine uses the A5000 to generate a 16-byte random number
and sends this number to control unit.
•
Next the control unit uses A5000 to sign the received random number, using the private
ECC key securely stored inside the A5000.
•
The ECC signature (signed random number) is returned to the machine.
•
The machine verifies the signature with the control unit public key. The control unit is
authenticated in case of successful signature verification.
The following OpenSSL command generates 8-byte random number in HEX format.
Because we did not specify to use the A5000 OpenSSL engine so random numbers are
generated by OpenSSL in software.
openssl rand -hex 8
Figure 31. OpenSSL - Random numbers generated by OpenSSL in software
The Plug & Trust Middleware supports the A5000 Secure Authenticator and the SE05x
Secure Element. Both product families are using the same API and the same OpenSSL
engine. The NXP Plug & Trust middleware OpenSSL engine is located in the following
directory:
/usr/local/lib/libsss_engine.so
The corresponding OpenSSL configuration file is located in:
~/se_mw/simw-top/demos/linux/common/openssl_sss_se050.cnf
With the help of following the Linux command we can display the relevant default setting:
tail ~/se_mw/simw-top/demos/linux/common/openssl11_sss_se050.cnf
-n 12
AN13500
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2022. All rights reserved.
Application note
Rev. 1.0 — 28 March 2022
26 / 45
