NXP Semiconductors
AN13500
EdgeLock A5000 Secure Authenticator for electronic anti-counterfeit protection using device-to-device
authentication
To be able to demonstrate the principle of machine and control unit authentication flow
with a single Raspberry Pi and OM-A5000ARD board the ECC256 key pair 0 (object ID
0xF0000000
) and the corresponding certificate 0 (object ID
0xF0000001
) are used as
“machine” credentials.
As “control unit” credentials the ECC256 key pair 1 (object ID
0xF0000002
) and the
corresponding certificate 1 (object ID
0xF0000003
) are used.
Credentials
are assigned
to
Key name and type
Certificate
Identifier
Machine
Originality Key 0, ECC256, Die
Individual
Certificate 0
0xF0000000
(key)
0xF0000001
(cert)
Control Unit
Originality Key 1, ECC256, Die
Individual
Certificate 1
0xF0000002
(key)
0xF0000003
(cert)
Table 1. Pre-provisioned certificates and keys used by the example
Note:
The complete list of pre-provisioned device credentials is provided in the A5000
EdgeLock Secure Authenticator Product data sheet.
4.5 Retrieve the pre-provisioned A5000 credentials
The ECC private keys are securely stored inside the A5000 secure authenticator and
cannot be read out. Standard OpenSSL API and the OpenSSL command-line tools
needs to be called with a private key to perform private key operations.
The Plug & Trust Middleware provides an OpenSSL engine which allows to use so called
reference keys instead of private keys. A reference key contains only a reference, the
object ID, to the private key inside the A5000. The reference key looks for OpenSSL
like a real key, but it does not contain secret data. All private ECC operations using a
reference key, e.g. ECC signing, are performed securely inside the A5000 without the
need to know the private key value.
This chapter demonstrates how to use the ssscli and openssl command-line tools to
perform the following operations:
•
Reading of the pre-provisioned A5000 device certificates and save them into a PEM
formatted file.
•
Reading of the pre-provisioned A5000 device certificates public keys and save them
into a PEM formatted file.
•
Creation of the corresponding reference keys and storage in a PEM-formatted file.
4.5.1 Retrieve the pre-provisioned A5000 device certificates
Create a folder inside your home directory for the example certificates and keys using the
following commands:
mkdir ~/auth_demo
cd ~/auth_demo
Run the following
ssscli
commands to read the device certificates and store them into
a file. By default a filename with extension
.pem
and
.cer
will store the certificate in
PEM format. Other extensions will store the certificate in DER format. In the following
examples we use machine.pem and control_unit.pem as the certificate file names.
AN13500
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2022. All rights reserved.
Application note
Rev. 1.0 — 28 March 2022
16 / 45
