NXP Semiconductors EdgeLock A5000, Application Note

Page: 45 / 45

NXP Semiconductors
AN13500
EdgeLock A5000 Secure Authenticator for electronic anti-counterfeit protection using device-to-device
authentication
Contents
1 Device-to-device authentication ........................ 3
2 Certificate chain of trust .................................... 4
3 Mutual authentication flow .................................6
3.1 Control unit authentication .................................6
3.2 Machine authentication ......................................7
4 Evaluating A5000 for anticounterfeit
protection .............................................................9
4.1 Hard- and software setup ..................................9
4.2 OpenSSL engine overview .............................. 11
4.3 Plug & Trust Middleware ssscli tool
introduction ...................................................... 13
4.4 Pre-provisioned A5000 device certificates
used by the example ....................................... 15
4.5 Retrieve the pre-provisioned A5000
credentials ........................................................16
4.5.1 Retrieve the pre-provisioned A5000 device
certificates ........................................................16
4.5.2 Retrieve the pre-provisioned A5000 device
certificates public keys .....................................19
4.5.3 Create the reference key files for the
OpenSSL engine ............................................. 20
4.6 Chain of trust of the pre-provisioned device
certificates ........................................................22
4.7 Mutual authentication flow ............................... 25
4.7.1 Control unit authentication ...............................25
4.7.1.1 Step 1: Control unit device certificate
validation ..........................................................25
4.7.1.2 Step 2: Proof of control unit private key
possession .......................................................26
4.7.2 Machine authentication ....................................29
4.7.2.1 Step 1: Machine device certificate
validation ..........................................................30
4.7.2.2 Step 2: Proof of control unit private key
possession .......................................................31
4.8 Binding A5000 to a host MCU/MPU using
Platform SCP ...................................................33
4.8.1 Introduction to the Global Platform Secure
Channel Protocol 03 (SCP03) ......................... 33
4.8.2 How to enable Platform SCP in the Plug &
Trust Middleware ............................................. 36
4.8.3 How to configure the A5000 product
specific SCP keys in the Plug & Trust
Middleware .......................................................37
4.9 Manage access from multiple Linux
processes to the A5000 ...................................38
5 A5000 secure provisioning .............................. 40
6 References .........................................................41
7 Legal information ..............................................42
Please be aware that important notices concerning this document and the product(s)
described herein, have been included in section 'Legal information'.
© NXP B.V. 2022. All rights reserved.
For more information, please visit: http://www.nxp.com
For sales office addresses, please send an email to: salesaddresses@nxp.com
Date of release: 28 March 2022
Document identifier: AN13500