AT88SC0404CA-Y6H-T Atmel, AT88SC0404CA-Y6H-T Datasheet
AT88SC0404CA-Y6H-T
Specifications of AT88SC0404CA-Y6H-T
Related parts for AT88SC0404CA-Y6H-T
AT88SC0404CA-Y6H-T Summary of contents
Page 1
... ISO 7816-2 Compliant Modules • High Reliability Endurance: 100,000 Cycles Data Retention: 10 years ESD Protection: 2,000V * Note: Modules available with either 2-wire modes Atmel CryptoMemory Specification Atmel AT88SC0104CA Atmel AT88SC0204CA Atmel AT88SC0404CA Atmel AT88SC0808CA ® Patent)* 8664C–CRYPT–01/10 ...
Page 2
... Table of Contents 1. Pin Configuration and Package Information .........................................................................................3 1.1. Pin Configuration ...........................................................................................................................3 1.2. Package Information .....................................................................................................................3 2. Description .............................................................................................................................................4 2.1. Differences from Atmel AT88SCxxxxC Family of Products ..........................................................4 2.2. Embedded Applications .................................................................................................................4 2.3. Smart Card Applications ................................................................................................................4 2.4. Scope ............................................................................................................................................4 3. Block Diagram ..........................................................................................................................................5 4. Pin Description .........................................................................................................................................6 4.1. Supply Voltage (V 4.2. ...
Page 3
... Set Security Fuses ..................................................................................................................... 54 12. Absolute Maximum Ratings* ................................................................................................................ 57 12.1. DC and AC Characteristics ........................................................................................................ 58 12.2. Timing Diagrams for Synchronous Communications ................................................................. 59 13. POR and Tamper Conditions ............................................................................................................... 62 13.1. Power On Reset (POR) Delay.................................................................................................... 62 13.2. Tamper Detection ....................................................................................................................... 62 14. Ordering Information ............................................................................................................................ 62 Appendix A. Errata ............................................................................................................................... 63 Appendix B. Revision History ............................................................................................................. 64 Atmel AT88SC0104/0204/0404/0808/CA 2 8664C–CRYPT–01/10 ...
Page 4
... ISO Smart Card Module RST = C2 SCL/CLK = 8-lead GND 8-Lead TSSOP TWI Smart Card Module V =C1 CC NC=C2 SCL/CLK=C3 NC=C4 8664C–CRYPT–01/10 Atmel AT88SC0104/0204/0404/0808/CA ISO Module TWI Module “SOIC, PDIP” 8-lead SOI C , PDIP C5 = GND A/ GND 4 8-lead Ultra Thin Mini-MAP (MLP 2x3) ...
Page 5
... A configuration zone contains registers to define the security rights for each user zone and space for passwords and secret keys used by the security logic of Atmel CryptoMemory Through dynamic, symmetric-mutual authentication, data encryption, and the use of encrypted checksums, CryptoMemory provides a secure place for storage of sensitive information within a system ...
Page 6
... Block Diagram Figure 2. Block Diagram V CC GND SCL/CLK SDA/IO RST 8664C–CRYPT–01/10 Atmel AT88SC0104/0204/0404/0808/CA Authentication, Power Encryption and Management Certification Unit Synchronous Data Transfer Interface Password Asynchronous ISO Interface Verification Reset Block Answer to Reset EEPROM 5 ...
Page 7
... The RST input is not available in the plastic package options for CryptoMemory. Figure 3. Connection Diagram 2.7v - 5.5v Microprocessor Note: While Atmel CryptoMemory AT88SCXXXXCA is a Low Voltage Device (2.7V to 3.6V) its I/O Buffers are designed for Standard High Voltage Applications (2.7V to 5.5V) Atmel AT88SC0104/0204/0404/0808/ ...
Page 8
... Configuration and User Zone Description 5.1. Detailed Description To enable the security features of Atmel appropriate passwords and keys. This is accomplished though programming the configuration zone of CryptoMemory using simple write and read commands. To gain access to the configuration zone, the secure code (write 7 password) must be successfully presented ...
Page 9
... Table 2. Atmel AT88SC0104CA/0204CA/0404CA Configuration Memory $0 $1 $00 Fab Code $08 $10 $18 DCR $20 AR0 PR0 $28 $30 $38 $40 $48 $50 AAC0 $58 $60 AAC1 $68 AAC2 $70 $78 AAC3 $80 $88 $90 $98 $A0 $A8 PAC $B0 PAC $B8 PAC $C0 PAC $C8 $D0 PAC $D8 PAC $E0 PAC $E8 PAC $F0 $F8 Atmel AT88SC0104/0204/0404/0808/ Answer to Reset MTZ Card Manufacturer Code ...
Page 10
... Table 3. Atmel AT88SC0808CA Configuration Memory $0 $1 $00 Fab Code $08 $10 $18 DCR AR0 PR0 $20 $28 AR4 PR4 $30 $38 $40 $48 $50 AAC0 $58 $60 AAC1 $68 $70 AAC2 $78 $80 AAC3 $88 $90 $98 $A0 $A8 $B0 PAC $B8 PAC PAC $C0 $C8 PAC $D0 PAC $D8 PAC PAC $E0 $E8 PAC $F0 $F8 8664C–CRYPT–01/10 ...
Page 11
... User Memory The EEPROM user memory is divided into four (Atmel AT88SC0808CA) user zones. Multiple zones allow for the storage of different data types or files in different zones. Access to user zones is possible only after meeting security requirements. The customer defines these security requirements in the configuration zone during device personalization. When the same security requirements define access to multiple zones, the zones effectively serve as one large storage area albeit with the requirement to select each zone prior to access ...
Page 12
... Table 5. Atmel AT88SC0204CA User Memory Zone $00 ─ User 0 ─ $38 $00 ─ User 1 ─ $38 $00 ─ User 2 ─ $38 $00 ─ User 3 ─ $38 Note: Page size = 16-bytes 8664C–CRYPT–01/10 Atmel AT88SC0104/0204/0404/0808/ 64-bytes 64-bytes 64-bytes 64-bytes $7 11 ...
Page 13
... Table 6. Atmel AT88SC0404CA User Memory Zone $00 ─ User 0 ─ $78 $00 ─ User 1 ─ $78 $00 ─ User 2 ─ $78 $00 ─ User 3 ─ $78 Note: Page size = 16-bytes Atmel AT88SC0104/0204/0404/0808/ 128-bytes 128-bytes 128-bytes 128-bytes 8664C–CRYPT–01/10 $7 ...
Page 14
... Table 7. Atmel AT88SC0808CA User Memory Zone $00 ─ User 0 ─ $78 $00 User 1 ─ ─ ─ ─ ─- $78 User 6 $00 ─ User 7 ─ $78 Note: Page size = 16-bytes 8664C–CRYPT–01/10 Atmel AT88SC0104/0204/0404/0808/ 128-bytes 128-bytes $7 13 ...
Page 15
... The use of passwords protects read and write accesses to the user zones. Any one of eight password sets is available for assignment to any user zone through configuration of access registers. Atmel 24-bit passwords for read and write operations. Read passwords grant only read accesses to zones under password protection, while write passwords grant both read and write accesses ...
Page 16
... Decrementing AAC to $00 permanently disables the corresponding key set and permanently renders the corresponding user zone(s) under protection inaccessible. Entry into authentication mode is a process through which the host and Atmel authenticate one another. First, the host generates a 64-bit random number, reads a current cryptogram and identification information from the device, and uses this information in conjunction with the corresponding secret seed to generate a 64-bit challenge for the device ...
Page 17
... The host must reinitiate entry into authentication and, if applicable, encryption modes to continue. The use of checksum is optional when reading data. Calls to the read checksum command resets device security so its use is recommended only at the completion of all data read operations from the device. Atmel AT88SC0104/0204/0404/0808/ Command/Communications ...
Page 18
... Data Protection Features Security operations control access to data stored in Atmel exist to protect data in the user memory. 6.2.1. Modify Forbidden The Modify Forbidden option renders the user zone read-only by restricting all write operations to it recommended to program all required data in the user zone prior to enabling this option. Modify Forbidden is available for any user zone and is selectable by configuring appropriate Access Registers ...
Page 19
... Factory Programmed Fields Device Atmel AT88SC0104CA Atmel AT88SC0204CA Atmel AT88SC0404CA Atmel AT88SC0808CA 6.3.2. Answer To Reset (ATR) This is an 8-byte wide register with content that Atmel defines. This register is read/write accessible prior to blowing the FAB fuse, but becomes read-only after blowing the fuse. ...
Page 20
... Disabling this bit (ETA = “1”) limits authentication and password verification trials to only four incorrect attempts ($FF, $EE, $CC, $88, $00). CS0 – CS3: Programmable Chip Select (only relevant in synchronous protocol) The four most significant bits (b4 – b7) of every command comprise the Chip Select Address. All Atmel ® CryptoMemory devices will respond to the default Chip Select Address of $B (1011) ...
Page 21
... Four (Atmel AT88SC0104CA/0204CA/0404CA) or eight (Atmel AT88SC0808CA) 8-bit access registers allow personalization of the device. Each access register works in conjunction with a Password/Key register to define the security settings for each individual zone of the user memory. Values in the access registers take immediate effect after programming. The default value for each bit is “ ...
Page 22
... Password/Key Registers ® Four (Atmel AT88SC0104CA/0204CA/0404CA) or eight (Atmel AT88SC0808CA) 8-bit Password/Key registers receive definition during device personalization. Each Password/Key register works in conjunction with a corresponding Access register to define the security settings of each zone. The values programmed have an immediate effect on the logic of the device. The default value is “ ...
Page 23
... The status of these fuses is given in a ‘fuse byte.’ A value of ‘0’ indicates that the fuse has been blown. Bits four to seven of this byte are not used as Security Fuses and are reserved for Atmel use. Table 14. Device Fuses ...
Page 24
... SEC, PER, CMA and FAB are non-volatile fuses blown at the end of various steps in the manufacturing and personalization process. Once blown, these fuses can never be reset. Atmel code before the device leaves the factory. Blowing the remainder of the fuses must follow the sequence: ...
Page 25
... The asynchronous mode is selected when RST is low on a rising edge of CLK. Once the asynchronous mode has been selected not possible to return to the synchronous mode other than by powering the device off and on again. Atmel AT88SC0104/0204/0404/0808/CA 24 supports two application areas with different communication protocols: a 2-wire serial due to the internal and/or external pull-up on RST ...
Page 26
... Once the asynchronous mode has been selected not possible to switch to the synchronous mode without powering off the device. Table 16. ATR Codes for Lower Density Atmel CryptoMemory Device Atmel AT88SC0104CA Atmel AT88SC0204CA Atmel AT88SC0404CA Atmel AT88SC0808CA Figure 10. Power Up Sequence for Smart Card Mode V cc I/O-SDA RST ...
Page 27
... Synchronous Protocol Communication with Atmel Atmel AT24Cxxx Serial EEPROM devices using a two-wire protocol (TWI). Basic command structure and timing are the same however a significant difference exists when reading the CryptoMemory device that will be described below. 8.1. Start-up Sequence When first powering up the device, five pulses are required on CLK-SCL for reading of internal registers. This may be accomplished by sending one full command byte to the device ...
Page 28
... Command Set The command set of Atmel CryptoMemory exceeds that of a simple memory device. Each instruction sent to the CryptoMemory must have 4-bytes: Command, Address 1, Address 2 and N. The last byte, N, defines the number of any additional data bytes to be sent or received from the CryptoMemory device. In addition, the Random Read command is available the only one byte command but must be preceded by an aborted write command in order to set up the read address ...
Page 29
... The CryptoMemory Normal Read command looks like a TWI write command (LSB of the fist byte = 0) but after the fourth byte of the command the CryptoMemory device will begin to send data back on the bus. The number of bytes sent by CryptoMemory will be equal to the value of N. Figure 13. Atmel CryptoMemory Normal Read Command S T ...
Page 30
... The NACK response, however, does not affect the loading of the read address. The Random Read command works for both Configuration and User Memory important to implement the CryptoMemory read commands as specified; otherwise CryptoMemory responses will cause contention on the bus with a host using standard TWI protocol. 8664C–CRYPT–01/10 Atmel AT88SC0104/0204/0404/0808/ ...
Page 31
... Set User Zone with Anti-Tearing Read Config Zone Read Fuse Byte System READ Read Checksum Verify Authentication Verify CRYPTO Verify Encryption Write Password Verify Password Read Password Note: Delays are based on operation at 25° C Atmel AT88SC0104/0204/0404/0808/CA 30 Addr 1 Addr 2 N Command $B0 addr addr N $B0 addr addr N ...
Page 32
... Device Configuration Register (DCR) in the configuration memory. The DCR is set to $FF at the Atmel factory and thus will respond to device address $B and $F unless the DCR is modified. For a device to respond only to $B the DCR should be set to $B also. ...
Page 33
... ACK. During this operation the address will “roll over” from the last byte of the current zone to the first byte of the same zone. The host terminates Random Read by issuing a NACK signal instead of an ACK. Atmel AT88SC0104/0204/0404/0808/CA 32 Address 2 ...
Page 34
... The data byte address to be read is defined by Address 1 and Address 2 in the command and is internally incremented following the transmission of each data byte. The value N defines how many bytes Atmel value of zero will result in 256-bytes read. The host however may cease clocking the device and end the transmission with a NACK and STOP at any time prior to receiving all N-bytes. During a read operation the address will " ...
Page 35
... In this case, the device will prevent the internal write cycle and no bytes will be written in the EEPROM. After this command the host must perform ACK polling. Atmel AT88SC0104/0204/0404/0808/CA 34 Host ...
Page 36
... The fuses must be blown sequentially: FAB must be blown first, CMA may be blown only if FAB is ‘0’, and PER only if CMA is ‘0’. After this command the host must perform ACK polling. The SEC fuse is blown at the Atmel Table 20. Fuse Identification ...
Page 37
... Read Fuse Byte Fuse data is returned in the form of a single byte. Bits zero to three represent the fuse states; a value of ‘0’ indicates the fuse has been blown. Bits four to seven are not used as security fuses and are reserved by Atmel. Table 23. Fuse Byte Definition ...
Page 38
... Figure 24. System READ Command Address 1 T 1011 0110 0000 xxxx 8.11. Verify CRYPTO: $B8 8.11.1. Functional Figure 25. Verify CRYPTO Command Functional Description 8-random bytes 8-challenge bytes 8664C–CRYPT–01/10 Atmel AT88SC0104/0204/0404/0808/CA Address 2 N xxxx xxxx xxxx xxxx Host Device Command Key Index ...
Page 39
... User Zone $B2 command or System READ $B6 command. To verify whether the authentication succeeded, the host could either read the associated attempts counter to confirm the value is $FF, or read the post authentication cryptogram from the device and compare with the cryptogram generated when the host computed the challenge bytes. Atmel AT88SC0104/0204/0404/0808/ and Secret Seed, G ...
Page 40
... Once the sequence has been carried out, the device requires the host to perform an ACK polling sequence with the System READ command $B6. In order to know whether the inserted password was correct, the host can read the corresponding attempts counter and verify the value is zero. 8664C–CRYPT–01/10 Atmel AT88SC0104/0204/0404/0808/CA Host Device Command ...
Page 41
... The Atmel AT88SC0104CA is used for this example. A small pattern is written into the first two user zones. Security for each of these two user zones and the associated register values are shown in the table below. Simple values for passwords are used ...
Page 42
... The following shows the two-wire commands sent to Atmel device. The flow is consistent with the steps described above; comments have been added as indicated with an asterisk (*). *Atmel AT88SC0104CA Initialization Example *WRITE DATA TO USER ZONES *Set User Zone *Write data = Zone 0 Data *Set User Zone 1 ...
Page 43
... PASSWORDS IN CONFIGURATION ZONE *Write Passwords, read 01, write *READ ENTIRE CONFIGURATION ZONE TO VERIFY *Device Response *SET SECURITY FUSES *Set FAB Fuse *Set CMA Fuse *Set PER Fuse *Read Fuse Byte = *Device Response Atmel AT88SC0104/0204/0404/0808/CA 42 8664C–CRYPT–01/10 ...
Page 44
... SW1-SW2 = $90-$00 Note: For all bytes transmitted by the device or by the host, including header, procedure, status and data bytes parity error is detected, the receiver requests that byte to be sent again (see character format) 8664C–CRYPT–01/10 Atmel AT88SC0104/0204/0404/0808/CA 8 data bits Parity bit d d ...
Page 45
... Command Set Table 25. Atmel CryptoMemory Asynchronous Command Set Command Description Normal B0 Write User Zone with Anti-Tearing B2 Read User Zone Read User Zone Write Config Zone Write Fuses Send Checksum B4 System WRITE Set User Zone Write Config Aone w/a-t Set User Zone w/a-t ...
Page 46
... INS Data Data Data Data Finish 8664C–CRYPT–01/10 Atmel AT88SC0104/0204/0404/0808/CA Device Val Note Class (ignored by Atmel CryptoMemory) ** Write instruction $B0 Address byte A1 (ignored by 0104C - 1616C) ** Address byte A2 = $02 $02 4-data bytes $04 INS $B0 Device responds with INS code Byte to be written at start address $02 ...
Page 47
... T=0 Command Descriptions The command set of Atmel CryptoMemory exceeds that of a simple memory device. Each instruction sent to the CryptoMemory must have 4-bytes: Command, Address 1, Address 2 and N. The last byte, N, defines the number of any additional data bytes to be sent or received from the CryptoMemory device. ...
Page 48
... If the host is not allowed to read the zone, the device will return the "Command Unauthorized" code ($69 $00) after it has received the header. Table 28. Read User Zone Command Structure CLA INS : Command ** $B2 8664C–CRYPT–01/10 Atmel AT88SC0104/0204/0404/0808/CA Host Device Data … Data Command Header P1 : Address 1 ...
Page 49
... Set User Zone command. Anti-tearing should be turned off if not required would otherwise cause more write cycles than necessary. Table 30. Anti-Tearing Command Description Write Config Zone w/ a-t Set User Zone w/ a-t Atmel AT88SC0104/0204/0404/0808/CA 48 Host Device Data … ...
Page 50
... The fuses may only be "programmed", that is written from '1' to '0'. The write fuses operation is only allowed after successfully presenting the secure code (Write 7 password). The fuses must be blown sequentially: FAB must be blown first, CMA may be blown only if FAB is ‘0’, and PER only if CMA is ‘0’. The SEC fuse is blown at the Atmel factory to protect lot history information. ...
Page 51
... Read Fuse Byte Fuse data is returned in the form of a single byte. Bits zero to three represent the fuse states; a value of ‘0’ indicates the fuse has been blown. Bits four to seven are not used as Security Fuses and are reserved by Atmel Table 34. Fuse Byte Definition ...
Page 52
... System READ Command Structure Table 35. System READ CLA INS : Command ** $B6 10.8.5. Read Checksum The checksum consists of 2-bytes, and the Read Checksum command must be sent with parameter Table 36. System READ CLA INS : Command ** $B6 8664C–CRYPT–01/10 Atmel AT88SC0104/0204/0404/0808/CA Command Header --- p p --- System READ P1 ...
Page 53
... If the challenges match, the device computes and writes a new C success or failure information of the authentication process and updates the authentication attempts counter accordingly. Key index: b0000_00nn : Secret Seed G b0001_00nn : Session Encryption Key S Data : Q : Host random number, 8-bytes CH : Host challenge, 8-bytes Atmel AT88SC0104/0204/0404/0808/CA 52 Host Device Command Key Index ...
Page 54
... If the password is wrong, the device simply returns $69 $00 after incrementing the attempts count. The Write 7 password is also known as the Secure Code and must be properly presented before access to the configuration zone is granted when personalizing the device. 8664C–CRYPT–01/10 Atmel AT88SC0104/0204/0404/0808/CA Verify CRYPTO P1 P2 ...
Page 55
... Write Data to User Zones In the default configuration from Atmel, all user zones have free access rights. Writing initial data into the user zones should be done before setting security configurations. Use the Set User Zone command and Write User Zone command to write initial data into the user zones ...
Page 56
... The following shows the TPDU commands sent to the Atmel device. The flow is consistent with the steps described above; comments have been added as indicated with an asterisk (*). *Atmel AT88SC0104CA Initialization Example *WRITE DATA TO USER ZONES *Set User Zone *Write data = Zone 0 Data *Set User Zone 1 ...
Page 57
... *READ ENTIRE CONFIGURATION ZONE TO VERIFY *Device Response *SET SECURITY FUSES *Set FAB Fuse *Set CMA Fuse *Set PER Fuse *Read Fuse Byte = *Device Response Atmel AT88SC0104/0204/0404/0808/CA 56 8664C–CRYPT–01/10 ...
Page 58
... Voltage on Any Pin with Respect to Ground ....................... − 0 Maximum Operating Voltage ..................................... 6.0V DC Output Current .................................................5.0 mA 8664C–CRYPT–01/10 Atmel AT88SC0104/0204/0404/0808/CA * NOTICE: Stresses beyond those listed under “Absolute Maximum Ratings” may cause permanent damage to the device. This is a stress rating only and functional operation of the device at these or any other condition beyond those +0 ...
Page 59
... I SDA/IO Output High Current OL Notes: 1. Applicable over recommended operating voltage range from -40°C to +85°C (unless otherwise noted prevent Latch Up Conditions from occurring during Power Up of the Atmel AT88SCXXXXCA turned on before applying V Atmel AT88SC0104/0204/0404/0808/CA 58 Test Condition = 3.3V) Async READ at 3.57MHz CC = 3.3V) Async WRITE at 3 ...
Page 60
... Applicable over recommended operating range from -40°C to +85° 30pF (unless otherwise noted) AC 12.2. Timing Diagrams for Synchronous Communications 12.2.1. Bus Timing Figure 36. SCL: Serial Clock, SDA: Serial Data I/O SCL t SU.STA SDA IN SDA OUT 8664C–CRYPT–01/10 Atmel AT88SC0104/0204/0404/0808/CA Parameter CC t HIGH LOW LOW ...
Page 61
... SDA 8th BIT WORDn Note: The write cycle time t clear/write cycle Figure 38. Data Validity SDA SCL DATA STABLE Atmel AT88SC0104/0204/0404/0808/CA 60 ACK STOP CONDITION is the time from a valid stop condition of a write sequence to the end of the internal WR DATA S TABLE DATA CHANGE ALLOWED ...
Page 62
... Figure 39. Start and Stop Definition SDA SCL START Figure 40. Output Acknowledge SCL DATA IN DATA OUT 8664C–CRYPT–01/10 Atmel AT88SC0104/0204/0404/0808/ STOP ...
Page 63
... AT88SCxxxxCA-PU AT88SCxxxxCA-SU AT88SCxxxxCA-TH AT88SCxxxxCA-Y6H-T AT88SCxxxxCA-WI Note: Ordering codes are valid for Atmel AT88SC0104CA, Atmel AT88SC0204CA, Atmel AT88SC0404CA and Atmel AT88SC0808CA Table 43. Ordering Information (1) (2) Package Type M2 – J Module: ISO or TWI M2 – P Module: ISO or TWI M2 ISO 7816 Smart Card Module with Atmel Logo ...
Page 64
... Write User Zone command is sent in Authentication mode or Encryption mode the data is saved in a buffer until a cryptographic checksum is received. The host must send the checksum it has computed immediately after the Write User Zone command. If the checksum is valid, Atmel incorrect the data is discarded and the cryptographic engine is reset. ...
Page 65
... Appendix B. Revision History Doc. Rev. 8664C 8664B 8664A Atmel AT88SC0104/0204/0404/0808/CA 64 Date 01/2010 Convert to MS Word, added MJTG module and added Ordering Information 08/2009 Update document 05/2009 Initial document release Comments 8664C–CRYPT–01/10 ...
Page 66
... Disclaimer: The information in this document is provided in connection with Atmel products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Atmel products. EXCEPT AS SET FORTH IN ATMEL’S TERMS AND CONDITIONS OF SALE LOCATED ON ATMEL’S WEB SITE, ATMEL ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT ...