NXP Semiconductors
AN13500
EdgeLock A5000 Secure Authenticator for electronic anti-counterfeit protection using device-to-device
authentication
Figure 39. OpenSSL - Verify machine certificate
Note:
We assume the NXP root and intermediate CA are already stored in the machine
and control unit.
Note:
To simplify the example we do not use the A5000 for validating the machine
certificate, because the keys of the NXP root and intermediate CA are not stored inside
the A5000 device.
The machine certificate is valid in case OpenSSL returns
OK
. This also means, that the
public key included in the machine certificate can be trusted.
4.7.2.2 Step 2: Proof of control unit private key possession
In this step, the machine must prove that it is in possession of the ECC private key.
Note:
We assume the Linux environment variable
OPENSSL_CONF
was already set as
The control unit generates a 256-bytes random number and stores it into a text file. The
random number is sent to the machine.
openssl rand -out control_unit_random.txt -hex 256
cat control_unit_random.txt
AN13500
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2022. All rights reserved.
Application note
Rev. 1.0 — 28 March 2022
31 / 45
