at88sa102s ATMEL Corporation, at88sa102s Datasheet - Page 4

• Manufacturer Part Number: at88sa102s
• Description: Cryptoauthentication
• Manufacturer: ATMEL Corporation

1.4.
1.5.
1.5.1. SHA Computation Example
4
Key Values
The values stored in the AT88SA102S internal key array are hardwired into the masking layers of the chip during wafer
manufacture. All chips have the same keys stored internally, though the value of a particular key cannot be determined
externally from the chip. For this reason, customers should ensure that they program a unique (and secret) number into
the 64 secret fuses and they should store the Atmel provided key values securely.
Individual key values are made available to qualified customers upon request to Atmel and are always transmitted in a
secure manner.
When the serial number is included in the MAC calculation then the response is considered to be diversified and the
host needs to know the base secret in order to be able to verify the authenticity of the client. A diversified response can
also be obtained by including the serial number in the computation of the value written to the secret fuses. An Atmel
CryptoAuthentication host chip provides a secure hardware mechanism to validate responses to determine if they are
authentic.
SHA-256 Computation
CryptoAuthentication performs only one cryptographic calculation – a keyed digest of an input challenge. It optionally
includes various other information stored on the chip within the digested message.
CryptoAuthentication computes the SHA-256 digest based on the algorithm documented here:
http://csrc.nist.gov/publications/fips/fips180-2/fips180-2.pdf
Throughout this document, the complete message processed by the AT88SA102S chip is documented. According to
the above specification, this always includes a single bit of ‘1’ pad after the message, followed by a 64 bit value
representing the total number of bits being hashed (less pad and length). If the length is less than 447 (512-64-1) then
the necessary number of ‘0’ bits are included between the ‘1’ pad and ‘length’ to stretch the last message block out to
512 bits.
When using standard libraries to calculate the SHA-256 digest, these pad and length bits should probably not be
passed to the library as most standard software implementations of the algorithm add them in automatically.
In order to ensure that there is no ambiguity, the following example vector is provided in addition to the sample vectors
in the NIST document. In this example, all values are listed in hex format. For all but the key, bytes are listed in the
order that they appear on the bus – first on the bus is listed on the left side of the page. The key value below is listed in
the same order as the challenge, so the 01 at the left of the key string corresponds to the first byte in the SHA-256
document.
Key
Challenge
Opcode 08
Mode
KeyID
Secret Fuses
Status Fuses
MfrID Fuses
S/N Fuses
ROMMfrID
ROM SN
AT88SA102S [Preliminary]
50
FFFF
01030507090B0D0F11131517191B1D1F21232527292B2D2F31333537393B3D3F
020406080A0C0E10121416181A1C1E20222426282A2C2E30323436383A3C3E40
(all optional information included in message)
0000111122223333
445566
77
8899AABB
CCDD
EEFF
8584A–SMEM–03/09