NXP Semiconductors
AN13500
EdgeLock A5000 Secure Authenticator for electronic anti-counterfeit protection using device-to-device
authentication
3 Mutual authentication flow
The authentication flow consists of a mutual authentication procedure. First, the machine
will authenticate the control unit that it will be connected to. After that, the control unit will
authenticate the machine that attempts to connect.
3.1 Control unit authentication
The authentication of the control unit consists of two steps: the
certificate validation
and
the private key
proof of possession
.
Certificate validation:
The first step is the verification of the control unit digital certificate.
1. The control unit sends its device certificate together with its hierarchy of CA
certificates.
2. The machine validates that the provided certificate chain of trust is valid by verifying
the signatures of all the certificates in the chain up to the root CA
If the control unit certificate is valid, it means that the public key included in it can be
trusted.
Proof of possession:
The second step is the proof of possession. This procedure is needed to make sure that
the certificate we verified belongs to the control unit. This proof of possession mechanism
ensures that the uploader of the certificate also knows the associated private key. For
that,
1. The machine generates a random challenge
2. The control unit returns the random challenge signed, using its private key stored
inside A5000.
3. The machine validates the random number signature with the public key obtained
from the control unit certificate.
A successful response means that the control unit is authentic. Bear in mind that the trust
relies on protecting the private key. For this reason, the use of A5000 is fundamental to
make sure the private key is not compromised.
AN13500
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2022. All rights reserved.
Application note
Rev. 1.0 — 28 March 2022
6 / 45
