NXP Semiconductors
AN13500
EdgeLock A5000 Secure Authenticator for electronic anti-counterfeit protection using device-to-device
authentication
Figure 5. Control unit authentication flow
3.2 Machine authentication
The authentication of the machine also consists of two steps: the
certificate validation
and the private key
proof of possession
. These two steps are
equivalent to the ones performed for the control unit authentication.
Certificate validation:
The first step is the verification of the machine digital certificate.
1. The machine sends its device certificate together with its hierarchy of CA certificates.
2. The control unit validates that the provided certificate chain of trust is valid by verifying
the signatures of all the certificates in the chain up to the root CA
If the machine certificate is valid, it means that the public key included in it can be
trusted.
Proof of possesion:
The second step is the proof of possession. This procedure is needed to make sure that
the certificate we received belongs to the machine. This proof of possession mechanism
ensures that the uploader of the certificate also knows the associated private key. For
that,
1. The control unit generates a random challenge
2. The machine returns the random challenge signed, using its private key stored inside
A5000.
3. The control unit validates the random number signature with the public key obtained
from the machine certificate
A successful response means that the machine is authentic. Bear in mind that the trust
relies on protecting the private key. For this reason, the use of A5000 is fundamental to
make sure the private key is not compromised.
AN13500
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2022. All rights reserved.
Application note
Rev. 1.0 — 28 March 2022
7 / 45
