This is a summary document. A
complete document is available under
NDA. For more information, please
contact your local Microchip sales
office.
ATECC608A
CryptoAuthentication™ Device Summary Datasheet
Features
•
•
Cryptographic Co-Processor with Secure Hardware-Based Key Storage:
– Protected storage for up to 16 keys, certificates or data
Hardware Support for Asymmetric Sign, Verify, Key Agreement:
–
–
–
•
ECDSA: FIPS186-3 Elliptic Curve Digital Signature
ECDH: FIPS SP800-56A Elliptic Curve Diffie-Hellman
NIST Standard P256 Elliptic Curve Support
Hardware Support for Symmetric Algorithms:
– SHA-256 & HMAC Hash including off-chip context save/restore
– AES-128: Encrypt/Decrypt, Galois Field Multiply for GCM
Networking Key Management Support:
– Turnkey PRF/HKDF calculation for TLS 1.2 & 1.3
– Ephemeral key generation and key agreement in SRAM
– Small message encryption with keys entirely protected
Secure Boot Support:
– Full ECDSA code signature validation, optional stored digest/signature
– Optional communication key disablement prior to secure boot
– Encryption/Authentication for messages to prevent on-board attacks
Internal High-Quality NIST SP 800-90A/B/C Random Number Generator (RNG)
Two High-Endurance Monotonic Counters
Unique 72-Bit Serial Number
Two Interface Options Available:
– High-speed Single Pin Interface with One GPIO Pin
– 1 MHz Standard I
2
C Interface
1.8V to 5.5V IO Levels, 2.0V to 5.5V Supply Voltage
<150 nA Sleep Current
8-pad UDFN and 8-lead SOIC
Die-on-Tape and Reel for Qualified Customers (Contact Microchip Sales)
•
•
•
•
•
•
•
•
•
•
Applications
•
•
•
•
IoT network endpoint key management & exchange
Encryption for small messages and PII data
Secure Boot and Protected Download
Ecosystem Control, Anti-cloning
©
2018 Microchip Technology Inc.
Datasheet Summary
DS40001977B-page 1
ATECC608A
Pin Configuration and Pinouts
Table 1. Pin Configuration
Pin
NC
GND
SDA
SCL
VCC
Function
No Connect
Ground
Serial Data
Serial Clock Input
Power Supply
Figure 1. Pinouts
8-lead SOIC
(Top View)
NC
NC
NC
GND
1
2
3
4
8
7
6
5
8-pad UDFN
(Top View)
V
CC
NC
SCL
SDA
NC
NC
NC
GND
1
2
3
4
8
7
6
5
3-lead Contact
(Top View)
V
CC
NC
SCL
SDA
1
SDA
2
GND
3
V
CC
©
2018 Microchip Technology Inc.
Datasheet Summary
DS40001977B-page 2
Table of Contents
Features.......................................................................................................................... 1
Applications..................................................................................................................... 1
Pin Configuration and Pinouts.........................................................................................2
1. Introduction................................................................................................................4
1.1.
1.2.
1.3.
Applications.................................................................................................................................. 4
Device Features........................................................................................................................... 4
Cryptographic Operation.............................................................................................................. 5
2. Electrical Characteristics........................................................................................... 6
2.1.
2.2.
2.3.
2.4.
Absolute Maximum Ratings..........................................................................................................6
Reliability...................................................................................................................................... 6
AC Parameters: All I/O Interfaces................................................................................................ 6
DC Parameters: All I/O Interfaces.............................................................................................. 10
3. Compatibility............................................................................................................ 14
3.1.
3.2.
Microchip ATECC508A...............................................................................................................14
Microchip ATSHA204A, ATECC108A.........................................................................................15
4. Package Marking Information..................................................................................16
5. Package Drawings...................................................................................................17
5.1.
5.2.
8-lead SOIC................................................................................................................................17
8-pad UDFN............................................................................................................................... 20
6. Revision History.......................................................................................................23
The Microchip Web Site................................................................................................ 24
Customer Change Notification Service..........................................................................24
Customer Support......................................................................................................... 24
Product Identification System........................................................................................ 25
Microchip Devices Code Protection Feature................................................................. 26
Legal Notice...................................................................................................................26
Trademarks................................................................................................................... 26
Quality Management System Certified by DNV.............................................................27
Worldwide Sales and Service........................................................................................28
©
2018 Microchip Technology Inc.
Datasheet Summary
DS40001977B-page 3
ATECC608A
Introduction
1.
1.1
Introduction
Applications
The ATECC608A is a member of the Microchip CryptoAuthentication
™
family of high-security
cryptographic devices which combine world-class hardware-based key storage with hardware
cryptographic accelerators to implement various authentication and encryption protocols.
The ATECC608A has a flexible command set that allows use in many applications, including the
following:
•
Network/IoT Node Endpoint Security
Manage node identity authentication and session key creation & management. Supports the entire
ephemeral session key generation flow for multiple protocols including TLS 1.2 (and earlier) and
TLS 1.3
Secure Boot
Support the MCU host by validating code digests and optionally enabling communication keys on
success. Various configurations to offer enhanced performance are available.
Small Message Encryption
Hardware AES engine to encrypt and/or decrypt small messages or data such as PII information.
Supports AES-ECB mode directly. Other modes can be implemented with the help of the host
microcontroller. Additional GFM calculation function to support AES-GCM.
Key Generation for Software Download
Supports local protected key generation for downloaded images. Both broadcast of one image to
many systems, each with the same decryption key, or point-to-point download of unique images per
system are supported.
Ecosystem control and Anti-Counterfeiting
Validates that a system or component is authentic and came from the OEM shown on the
nameplate.
•
•
•
•
The ATECC608A is generally compatible with the ATECC508A when properly configured. See Section
3.1 Microchip ATECC508A
for more details.
1.2
Device Features
The ATECC608A includes an EEPROM array which can be used for storage of up to 16 keys, certificates,
miscellaneous read/write, read-only or secret data, consumption logging, and security configurations.
Access to the various sections of memory can be restricted in a variety of ways and then the
configuration can be locked to prevent changes.
Access to the device is made through a standard I
2
C Interface at speeds of up to 1 Mb/s. The interface is
compatible with standard Serial EEPROM I
2
C interface specifications. The device also supports a Single-
Wire Interface (SWI), which can reduce the number of GPIOs required on the system processor, and/or
reduce the number of pins on connectors. If the Single-Wire Interface is enabled, the remaining pin is
available for use as a GPIO, an authenticated output or tamper input.
Each ATECC608A ships with a guaranteed unique 72-bit serial number. Using the cryptographic
protocols supported by the device, a host system or remote server can verify a signature of the serial
number to prove that the serial number is authentic and not a copy. Serial numbers are often stored in a
©
2018 Microchip Technology Inc.
Datasheet Summary
DS40001977B-page 4
ATECC608A
Introduction
standard Serial EEPROM; however, these can be easily copied with no way for the host to know if the
serial number is authentic or if it is a clone.
The ATECC608A features a wide array of defense mechanisms specifically designed to prevent physical
attacks on the device itself, or logical attacks on the data transmitted between the device and the system.
Hardware restrictions on the ways in which keys are used or generated provide further defense against
certain styles of attack.
1.3
Cryptographic Operation
The ATECC608A implements a complete asymmetric (public/private) key cryptographic signature solution
based upon Elliptic Curve Cryptography and the ECDSA signature protocol. The device features
hardware acceleration for the NIST standard P256 prime curve and supports the complete key life cycle
from high quality private key generation, to ECDSA signature generation, ECDH key agreement, and
ECDSA public key signature verification.
The hardware accelerator can implement such asymmetric cryptographic operations from ten to one-
thousand times faster than software running on standard microprocessors, without the usual high risk of
key exposure that is endemic to standard microprocessors.
The ATECC608A also implements AES-128, SHA256 and multiple SHA derivatives such as HMAC(SHA),
PRF (the key derivation function in TLS) and HKDF in hardware. Support is included for the Galois Field
Multiply (aka Ghash) to facilitate GCM encryption/decryption/authentication.
The device is designed to securely store multiple private keys along with their associated public keys and
certificates. The signature verification command can use any stored or an external ECC public key. Public
keys stored within the device can be configured to require validation via a certificate chain to speed-up
subsequent device authentications.
Random private key generation is supported internally within the device to ensure that the private key can
never be known outside of the device. The public key corresponding to a stored private key is always
returned when the key is generated and it may optionally be computed at a later time.
The ATECC608A can generate high-quality random numbers using its internal random number generator.
This sophisticated function includes runtime health testing designed to ensure that the values generated
from the internal noise source contain sufficient entropy at the time of use. The random number generator
is designed to meet the requirements documented in the NIST 800-90A, 800-90B and 800-90C
documents.
These random numbers can be employed for any purpose, including usage as part of the device’s
cryptographic protocols. Because each random number is assured to be essentially unique from all
numbers ever generated on this or any other device, their inclusion in the protocol calculation ensures
that replay attacks (i.e. re-transmitting a previously successful transaction) will always fail.
The ATECC608A also supports a standard hash-based challenge-response protocol in order to allow its
use across a wide variety of additional applications. In its most basic instantiation, the system sends a
challenge to the device, which combines that challenge with a secret key via the MAC command and then
sends the response back to the system. The device uses a SHA-256 cryptographic hash algorithm to
make that combination so that an observer on the bus cannot derive the value of the secret key. At the
same time the recipient can verify that the response is correct by performing the same calculation with a
stored copy of the secret on the recipient’s system. There are a wide variety of variations possible on this
symmetric challenge/response theme.
©
2018 Microchip Technology Inc.
Datasheet Summary
DS40001977B-page 5
京公网安备 11010802033920号
EEWORLD
