CryptoCompanion Chip

9

5277C–CryptoCompanion–9/09

Table 9.

Memory Locking

LockBit 1

Lock Bit 0 (LSB)

Meaning

1

1

Locked. ReadMemory and WriteMemory enabled, subject to the restrictions in this

section. WriteMemoryEncrypted and ReadMemoryDigest disabled.

1

0

Unlocked/Confidential. ReadMemoryDigest, WriteMemory and

WriteMemoryEncrypted enabled. ReadMemory disabled.

0

0

Unlocked. ReadMemory and WriteMemory enabled. WriteMemoryEncrypted and

ReadMemoryDigest disabled.

1.5.2.

Secure Personalization

Customers desiring to write secrets into the AT88SC018 during personalization without exposing these secrets to

attackers should purchase the version of the chip in which Lock[1:0] is 10.

In these parts, Atmel will write a transport key into the EncKey location within EEPROM during wafer probe. Once the

AT88SC018 leaves the Atmel factory, the EncKey location cannot be written under any circumstances.

When the part is unlocked and therefore in the personalization phase, the WriteMemoryEncrypted command permits

the incoming data to be encrypted using EncKey as the encryption key. Data can also be written unencrypted if

desired. Verification of the EEPROM contents must use the ReadMemoryDigest command as ReadMemory is

prohibited in these parts as shipped. Once locked, the WriteMemoryEncrypted and ReadMemoryDigest commands are

prohibited – WriteMemory and ReadMemory are then enabled over a restricted address space.

The value written into EncKey will be the first 16 bytes of the SHA-1 digest of the concatenation of the 15 byte

ManufacturingID with a 16 byte secret provided to Atmel by the system manufacturer. The upper 6 bits of the Lock byte

will contain a secret tag assigned by Atmel to differentiate between various secrets that may have been used to

generate EncKey. This tag will be erased when the AT88SC018 is locked, leaving the Lock byte with the value 0xFF.

1.5.3.

ManufacturingID (MfrID)

These 15 bytes contain unique wafer manufacturing information. This data can be used as the AT88SC018 serial

number if desired and can also be used by Atmel to track production of the part. It is written by Atmel at wafer test and

cannot be modified by the customer, regardless of whether or not the part has been locked.

The ManufacturingID value can only be obtained by executing the ReadManufacturingID command. Note, however,

that if Lock[1:0] is ‘10’, then the contents of the second 32 byte block which includes this value can be accessed with

ReadMemoryDigest. ReadMemory can never be used to access the first 48 bytes of memory (SHA Constant, EncKey,

MfrID & Lock).