NXP Semiconductors
AN13500
EdgeLock A5000 Secure Authenticator for electronic anti-counterfeit protection using device-to-device
authentication
A5000 can be bound to the host by injecting in both the host and A5000 the same unique
SCP03 AES key-set and by enabling the Platform SCP feature in the Plug & Trust
Middleware. The
Binding a host device to EdgeLock SE05x
describes in detail
the concept of secure binding.
SCP03 is defined in
Global Platform Secure Channel Protocol '03' - Amendment D v1.2
specification.
SCP03 can provide the following three security goals:
• Mutual authentication (MA)
–
Mutual authentication is achieved through the process of initiating a Secure
Channel and provides assurance to both the host and the A5000 entity that they are
communicating with an authenticated entity.
• Message Integrity
–
The Command- and Response-MAC are generated by applying the CMAC according
to NIST SP 800-38B.
• Confidentiality
–
The message data field is encrypted across the entire data field of the command
message to be transmitted to the A5000, and across the response transmitted from
the A5000.
The SCP03 secure channel is set up via the A5000 authenticator application using the
standard ISO7816-4 secure channel APDUs.
The establishment of an SCP03 channel requires three static 128-bit AES keys shared
between the two communicating parties:
Key-ENC
,
Key-MAC
and
Key-DEK
.
Key-ENC
and
Key-MAC
keys are used during the SCP03 channel establishment to
generate the session keys. Session Keys are generated to ensure that a different set of
keys are used for each Secure Channel Session to prevent replay attacks.
Key-ENC
is used to derive the session key
S-ENC
. The
S-ENC
key is used for
encryption/decryption of the exchanged data. The session keys
S-MAC
and
R-MAC
are
derived from
Key-MAC
and used to generate/verify the integrity of the exchanged data
(C-APDU and R-APDU).
Key-DEK
key is used to encrypt new SCP03 keys in case they get updated.
Key
Description
Usage
Key
Type
Key-ENC
Static Secure Channel
Encryption Key
Generate session key for Decryption/
Encryption (AES)
AES
128
Key-MAC
Static Secure Channel
Message Authentication
Code Key
Generate session key for Secure Channel
authentication and Secure Channel MAC
Verification/Generation (AES)
AES
128
Key-DEK
Data Encryption Key
Sensitive Data Decryption (AES)
AES
128
Table 2. Static SCP03 keys
The session key generation is performed by the Plug & Trust Middleware host crypto.
AN13500
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2022. All rights reserved.
Application note
Rev. 1.0 — 28 March 2022
34 / 45
