NXP Semiconductors
AN13500
EdgeLock A5000 Secure Authenticator for electronic anti-counterfeit protection using device-to-device
authentication
openssl x509 -in control_unit.pem -pubkey -noout >
control_unit_pub.pem
Finally, the machine verifies the signature with the control unit public key
control_unit_pub.pem
. Because we are using the public key of another entity, this
step is performed by the OpenSSL engine in software.
openssl dgst -sha256 -verify control_unit_pub.pem -signature
control_unit_signature.sha256 machine_random.txt
Figure 37. OpenSSL - Verify control unit signature
The control unit is authenticated in case OpenSSL returns
Verified OK
.
4.7.2 Machine authentication
The authentication of the machine also consists of two steps. In principle the steps
are vice versa compared to the control unit authentication. The steps are briefly
demonstrated for completeness:
•
Step 1: Machine certificate validation
•
Step 2: Proof of machine private key possession
The example below will demonstrate the basic principle of the machine authentication
flow as shown in the figure below using the OpenSSL command-line tools .
AN13500
All information provided in this document is subject to legal disclaimers.
© NXP B.V. 2022. All rights reserved.
Application note
Rev. 1.0 — 28 March 2022
29 / 45
