Security Modes
76
SLUUBD3D – September 2015 – Revised September 2018
Copyright © 2015–2018, Texas Instruments Incorporated
Device Security
4. Generate SHA-1 input block B2 of 512 bytes (total input = 128-bit authentication key KD + 160-bit hash
HMAC1 + 1 + 159 0s + 100100000).
5. Generate SHA-1 hash HMAC2 using B2.
6. With no active
ManufacturerInput()
data waiting, write 160-bit message M to
ManufacturerInput()
in the
format 0xAABBCCDDEEFFGGHHIIJJKKLLMMNNOOPPQQRRSSTT, where AA is LSB.
7. Wait 250 ms, then read
ManufacturerInput()
for HMAC3.
8. Compare host HMAC2 with device HMAC3, and if it matches, both host and device have the same key
KD and the device is authenticated.
11.5 Security Modes
11.5.1 FULL ACCESS or UNSEALED to SEALED
The
Seal Device
command instructs the device to limit access to the SBS functions and data flash space
and sets the
[SEC1][SEC0]
flags. In SEALED mode, standard SBS functions have access per the Smart
Battery Data Specification. Extended SBS functions and data flash are not accessible. Once in SEALED
mode, the part can never permanently return to UNSEALED or FULL ACCESS modes although there is a
capability to temporarily switch from SEALED to UNSEALED and then to FULL ACCESS.
11.5.2 SEALED to UNSEALED
SEALED to UNSEALED instructs the device to temporarily extend access to the SBS and data flash
space and clears the
[SEC1][SEC0]
flags. In UNSEALED mode, all data, SBS, and DF have read/write
access. Unsealing is a two-step command performed by writing the first word of the unseal key to
ManufacturerAccess() (MAC)
, followed by the second word of the unseal key to
ManufacturerAccess()
.
The unseal key can be read and changed via the
MAC SecurityKey()
command when in the FULL
ACCESS mode. To return to the SEALED mode, either a hardware reset is needed, or the
MAC Seal
Device()
command is needed to transit from FULL ACCESS or UNSEALED to SEALED.
11.5.3 UNSEALED to FULL ACCESS
UNSEALED to FULL ACCESS instructs the device to temporarily allow full access to all SBS commands
and data flash. The device is shipped from TI in this mode. The keys for UNSEALED to FULL ACCESS
can be read and changed via the MAC command
SecurityKey()
when in FULL ACCESS mode. Changing
from UNSEALED to FULL ACCESS is performed by using the
ManufacturerAccess()
command, by writing
the first word of the Full Access Key to
ManufacturerAccess()
, followed by the second word of the Full
Access Key to
ManufacturerAccess()
. In FULL ACCESS mode, the command to go to boot ROM can be
sent.
