ATSHA204 ATMEL [ATMEL Corporation], ATSHA204 Datasheet - Page 41

• Manufacturer Part Number: ATSHA204
• Description: Atmel CryptoAuthentication
• Manufacturer: ATMEL [ATMEL Corporation]

8.5
GenDig Command
Uses SHA-256 to combine a stored value with the contents of TempKey, which must have been valid prior to the execution of
this command. The stored value can come from one of the data slots, either of the OTP pages, either of the first two pages of
the configuration zone, or retrieved from the hardware transport key array. The resulting digest is retained in TempKey, and
can be used in one of three ways:
If Zone is two (Data) and KeyID is ≤15, the GenDig command sets TempKey.GenData to one and TempKey.KeyID to the input
KeyID; otherwise, TempKey.GenData is set to zero.
Regardless of how the resulting digest is computed, it can never be read from the device.
If TempKey.Valid is invalid, this command returns an error. Upon command completion, the TempKey.Valid bit is set,
indicating that a digest has been loaded and is ready for use. The TempKey.Valid bit is cleared when the next command is
executed. See Section 2.2 for more details.
For all KeyID values less than 0x8000, the device uses the least-significant four bits of KeyID to determine the slot number
from which to retrieve the key value from the data zone of the EEPROM. KeyID values above 0x8000 reference keys stored in
the masks of the design. In any event, all 16 bits of KeyID as input to the device are used as Param2 in the SHA-256
calculation.
If the Zone parameter points to the configuration zone, then this command returns an error if the configuration zone is
unlocked.
When the key specified on input to GenDig has the CheckOnly bit set, GenDig can be used to generate ephemeral keys
matching those generated on client CryptoAuthentication devices using the DeriveKey command. Keys that have the
CheckOnly bit set represent situations in which the device is acting as a host. In this case, the opcode and parameter bytes
that would normally be included in the SHA calculation are replaced with bytes from the input stream.
Table 8-15. Input parameters
Table 8-16. Output parameter
Opcode
Param1
Param2
Data
Name
Success
1.
2.
3.
It can be included as part of the message used by the MAC, CheckMac, or HMAC commands. Because the MAC
A subsequent Read or Write command can use the digest to provide authentication and/or confidentiality for the
You can use this command for secure personalization by using a value from the transport key array. The resulting
response output incorporates both the data used in the GenDig calculation and the secret key from the MAC
command, it serves to authenticate the data stored in the data and/or OTP zones.
data, in which case it is known as a data protection digest.
data protection digest would then be used by the Write Command.
Name
GENDIG
Zone
KeyID
OtherData
4 or 0
Size
Size
1
1
2
1
Notes
0x15
If 0x00 (Config): Use KeyID to specify either the first (KeyID=0) or second (KeyID = 1)
If 0x01 (OTP): Use KeyID to specify either the first or second 256-bit block of the OTP
If 0x02 (Data): KeyID specifies a slot in the data zone or a transport key in the hardware
All other values are reserved and must not be used.
Identification number of the key to be used, or selection of which OTP block.
4 bytes of data for SHA calculation when using a CheckOnly key; otherwise ignored.
Notes
Upon successful execution, the Atmel ATSHA204 returns a value of zero.
256-bit block of the configuration zone.
zone.
array.
Atmel ATSHA204 [DATASHEET]
8740D−CRYPTO−3/12
41