SHA104 TFLXAUTH SECURE PROVISIONING PROCESS

Microchip offers Secure Provisioning Services for its security solutions before shipment. To leverage this service, secure exchange process is required between customers and Microchip Hardware Secure Modules (HSM). The process starts with requesting a unique custom Part Number, a manufacturing ID (MAN-ID), and the HSM encryption keys (unique per project) through the Microchip Technical Support Portal. Refer to the Secure Provisioning Guide for detailed steps of the secure sub-system configuration and secure exchange process.

Select Use Cases :

SHA104 TFLXAUTH XML Generator

Device Configuration
Device Address: (7 Bit Hex Value)
Device interface:
Enable IO Levels to fixed reference:
Enable RNG Health Test Auto Clear:
Enable Enhanced SelfTest:

Serial Number
SN[0:1]
SN[8]

Monotonic Counter Configuration
Allowed counts:
Limited Key Use:
IMPORTANT NOTE: The above User settings cannot be changed once its written and locked by this configurator.
So, it is recommended to set higher counts for Monotonic Counter and correct Limited Key Use setting.

Data Slots

Click on individual slots for more info.

Slot Number Slot Use-case Description Slot Property
Slot Description:
Using the IO protection features is optional, but the IO protection key is saved here. The idea is that on first boot, a random key will be generated and saved to this slot and the MCU's NVM, then the slot locked. Locking may not be necessary, if key rotation is needed for this key, but it does open up the device to a DOS attack where the key is changed unexpectedly. It is required to load and lock this slot for Checkmac-MAC response to work. Otherwise, only Checkmac-boolean response is allowed.

Provisioning:
The data entered in the below step will be stored in the device slot during provisioning.

Provisioning data input method:



Disable slot write:

Slot 1 User Data General public data storage (320 bytes) Clear read, Always write, Lockable
Slot Description:
This slot is used for public data storage, data can be written/read in clear text(Not encrypted). This slot should not be used for storing secrets.

Provisioning:
The data entered in the below step will be stored into the device slot during provisioning.

Provisioning data input method:



Disable slot write: If the checkbox is checked, the contents of the slot cannot be modified under any circumstances.

Slot 2 User Data General public data storage (64 bytes) Clear read, Always write, Lockable
Slot Description:
This slot is used for public data storage, data can be written/read in clear text(Not encrypted). This slot should not be used for storing secrets.

Provisioning:
The data entered in the below step will be stored into the device slot during provisioning.

Provisioning data input method:



Disable slot write: If the checkbox is checked, the contents of the slot cannot be modified under any circumstances.

Slot 3 Secret key Storage for a secret key No read, Always write, Lockable, Symmetric Key
Slot Description:
This slot provides a storage location for a symmetric key to use with the SHA104-TFLXAUTH's symmetric key commands. The primary use case is to support symmetric authentication for Accessory / Disposable authentication. If the Configuration Zone is set as locked at provisioning, Slot cannot be updated. If the slot in the Data Zone is set as unlocked, then Slot can be updated. If the slot in the DataZone is set as locked, you will need to encrypt the updated key and execute a NONCE command

Provisioning:
The data entered in the below step will be stored in the device slot during provisioning.

Provisioning data input method:



Diversified key:
Enable Encrypted Write for HMAC Key:
Disable slot write:

Prototyping

PROTOTYPE package is meant only for understanding and prototyping. It should NOT be shared as secrets are available in plain text. Alternatively, you may use dummy secrets.
Click here to provision the SHA104-TFLXAUTH-PROTO with the data/information provided in the above slots.

Production

Production package must be used to generate the Secure Provisioning Package to be sent to Microchip Provisioning Service (through Microchip Technical Support Portal). You will be prompted to add the HSM encryption keys when starting the generation process.
Both "Generate Provisioning Package" buttons compile all the data provided in the above slots into a zip package containing files that holds device configuration and user data to be loaded into the SHA104-TFLXAUTH slots. In the prototyping package, all user data are in unencrypted plain text whereas in the production package, user data are encrypted.

MICROCHIP

This text will be replaced