P5Cx012/02x/40/73/80/144
family
Secure dual interface and contact PKI smart card controller
Rev. 03 — 24 January 2008
Objective short data sheet
1. General description
1.1 SmartMX family approach
The new CMOS14 SmartMX family members feature a modular set of devices with:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
12 KB to 144 KB EEPROM
200 KB user ROM
6144 B RAM
High-performance secured Public Key Infrastructure (PKI) coprocessor (RSA, ECC)
Secured dual/triple-DES coprocessor
Secured AES coprocessor
Memory Management Unit (MMU)
ISO/IEC 7816 contact interface
Optional ISO/IEC 14443 A Contactless Interface Unit (CIU)
Optional S
2
C interface for NFC communication link
5-metal-layer 0.14
µm
CMOS technology
EEPROM with typical 500000 cycles endurance and minimum 20 years retention time
Broad spectrum of delivery types
Optional certified crypto library modules for RSA, ECC, DES, AES, SHA and PRNG
1.2 SmartMX family properties
The long-term approved SmartMX family features a significantly enhanced secure smart
card IC architecture. Extended instructions for Java and C code, linear addressing, high
speed at low power and a universal memory management unit are among many other
improvements added to the classic 80C51 core architecture. The technology transfer step
from 5-metal-layer 0.18
µm
to 5-metal-layer 0.14
µm
CMOS technology offers now even
more advantages in terms of security features, memory resources, crypto coprocessor
calculation speed for RSA and ECC as well as availability of secure hardware support for
2/3-key Digital Encryption Standard (DES) and Advanced Encryption Standard (AES)
operations.
The availability of contact interface, optional contactless or S
2
C interface enables the easy
implementation of native or open platform and multi-application operating systems in
market segments like e.g. banking, E-passport, ID card, Health Card, secure access, Java
card, Near Field Communication (NFC) connectable mobile hand sets as well as Trusted
Platform Modules (TPM).
NXP Semiconductors
P5Cx012/02x/40/73/80/144 family
Secure dual interface and contact PKI smart card controller
1.3 Naming conventions
Table 1.
x
y
Naming conventions
Type of category:
C = PKI controller + Triple-DES coprocessor + AES coprocessor on selected products
Interface options:
C = contact interface - ISO/IEC 7816
D = dual interface - ISO/IEC 7816 + ISO/IEC 14443 contactless interface
N = ISO/IEC 7816 + S
2
C Interface for NFC
zzz
Amount of non-volatile memory in KB, increasing count for further product options
P5xyzzz SmartMX platform
1.4 Cryptographic hardware coprocessors
1.4.1 FameXE coprocessor
The approved and modular FameXE architecture supports the trend of increasing RSA
keys with faster execution speeds as well as Elliptic Curve Cryptography (ECC) based on
GF(p) or GF(2
n
) at best performance. FameXE supports RSA with an operand length of
up to 8-kbit (up to 4-kbit with intermediate storage in RAM only).
The FameXE PKI coprocessor supports 192-bit ECC key length that offers the same level
of security as 2048-bit RSA. An ECC GF(2
n
) based signature, using a 163-bit key can be
executed in less than 30 ms providing a security level comparable to 1024-bit RSA. The
operand size for ECC, supported by FameXE, is only limited by the 2.5 KB size of the
FXRAM. FameXE is easy to use and the flexible interface provides programmers with the
freedom to implement their own cryptology solutions. A secured and CC EAL5+ certified
crypto library providing a large range of required functions will be available for all devices
in order to support customers in implementing public key-based solutions.
1.4.2 Triple-DES coprocessor
The DES for widely used symmetric encryption is supported by a dedicated, high
performance, highly attack resistant hardware coprocessor. Single DES and triple-DES,
based on two or three DES keys, can be executed within less than 40
µs.
Relevant
standards (ISO/IEC, ANSI, FIPS) and Message Authentication Code (MAC) are fully
supported. A secured crypto library element for DES is available.
1.4.3 AES coprocessor
SmartMX is the first smart card microcontroller platform to provide a dedicated high
performance 128-bit parallel processing coprocessor to support secure AES. The
implementation is based on FIPS197 as standardized by the National Institute for
Standards and Technology (NIST), and supports key lengths of 128-bit, 192-bit, and
256-bit with performance levels comparable to DES. AES is the next generation for
symmetric data encryption and recommended successor of DES providing significantly
improved security level. A secured crypto library element for AES is available.
P5CX012_02X_40_73_80_144_FAM_SDS_3
© NXP B.V. 2008. All rights reserved.
Objective short data sheet
Rev. 03 — 24 January 2008
2 of 18
NXP Semiconductors
P5Cx012/02x/40/73/80/144 family
Secure dual interface and contact PKI smart card controller
1.5 SmartMX interfaces
1.5.1 SmartMX contact interface
Operating in accordance with ISO/IEC 7816, the SmartMX contact interface is supported
by a built-in Universal Asynchronous Receiver/Transmitter (UART), which enables data
rates of up to 1 Mbit/s allowing for the automatic generation of all typical baud rates and
supports transmission protocols T = 0 and T = 1. Either one or two additional IOs are
available.
1.5.2 SmartMX contactless interface
The optional contactless interface is fully compatible with ISO/IEC 14443 A as well as
NXP Semiconductors field proven MIFARE technology. A dedicated Contactless Interface
Unit (CIU) manages and supports communication using data rates of up to 848 kbit/s. A
true anti-collision method (according to ISO/IEC 14443-3) enables multiple cards to be
handled simultaneously.
The optional MIFARE functionality provided in configurations B1 (MIFARE 1 KB
emulation) and B4 (MIFARE 4 KB emulation) safeguard the interface compatibility with
any installed MIFARE infrastructure. The ability to run the MIFARE protocol concurrently
with other contactless transmission protocols implemented by the user OS (T = CL or self
defined) enables the combination of new services and existing applications based on
MIFARE (e.g. ticketing) on a single dual interface controller based smart card.
A tutorial software library for ISO/IEC 14443-3 and ISO/IEC 14443-4 is available to
support NXP Semiconductors customers for easy integration of the contactless
technology into current system solutions.
1.5.3 SmartMX S
2
C interface
The S
2
C interface is intended for use with NXP Semiconductors NFC circuits (e.g. PN511,
PN531) in order to configure a secure NFC system, e.g. in mobile hand sets.
Operated both in Contact mode (ISO/IEC 7816) and in S
2
C mode the user defines the
final function of the controller chip with its operating system. This allows the same level of
security, functionality and flexibility for the contact interface as well as for S
2
C interface.
The S
2
C interface is connected to the internal ISO 14443 CIU. The CIU handles the
demodulation and the modulation of the S
2
C signals in a way that a full contactless
communication via this interface and the NFC IC can be enabled. As the S
2
C interface is
connected to the CIU the power of the P5CN080/P5CN144 has to be supplied via the
VDD and VSS pads to use the S
2
C interface. The S
2
C interface does not need any
software adaptation compared to the normal contactless operation.
Connected to the S
2
C interface of a NFC IC the device is compatible with existing MIFARE
reader infrastructure and the optional emulation modes of MIFARE 1 KB or MIFARE 4 KB
enable fast system integration and backward compatibility to MIFARE based cards. The
communication on the S
2
C interface supports both the ISO/IEC 14443 A part 3 and the
ISO/IEC 14443 part 4.
P5CX012_02X_40_73_80_144_FAM_SDS_3
© NXP B.V. 2008. All rights reserved.
Objective short data sheet
Rev. 03 — 24 January 2008
3 of 18
NXP Semiconductors
P5Cx012/02x/40/73/80/144 family
Secure dual interface and contact PKI smart card controller
1.6 Security features
SmartMX incorporates a big range of both inherent and OS controlled security features as
counter measure against all types of attacks. NXP Semiconductors has used the deep
knowledge of chip security, combined with the used handshaking circuit technology, the
very dense 5-metal-layer 0.14
µm
technology, glue logic and active shielding methodology
for optimum results in CC EAL5+, EMVCo and other third party certifications and
approvals.
SmartMX Memory Management Unit (MMU), designed to define various memory
segments and assign security attributes accordingly, supports a strong firewall concept
that keeps different applications separate from each other. Only the System mode has full
access privileges to all memory space and on-chip peripherals, while the User mode only
has privileges defined upon card personalization and executed under the control of the
System mode.
1.7 Security evaluation and certificates
The reached target of the certification is CC EAL5+. Also third party approvals like e.g.
EMVCo (Visa, CAST), ZKA and others, depending on the application requirements, are
available.
NXP Semiconductors continues to drive forward third party security evaluations to provide
its customers with the relevant information and documentation needed to execute
subsequent composite evaluations of implemented applications.
1.8 Optional crypto library
NXP Semiconductors will offer for all family types an optional crypto library:
•
Various algorithms
–
AES encryption and decryption using the AES coprocessor
–
DES and Triple-DES encryption and decryption using the DES coprocessor
–
RSA encryption and decryption, signature generation and verification for
straightforward and CRT keys up to 5024 bits
–
RSA key generation
–
ECC over GF(p) signature generation and verification (ECDSA) and Diffie-Hellman
key exchange for keys up to 544 bits
–
ECC over GF(p) key generation
–
ECC over GF(2
n
) signature generation and verification (ECDSA) and
Diffie-Hellman key exchange for keys up to 571 bits
–
ECC over GF(2
n
) key generation
–
SHA-1, SHA-224 and SHA-256 hash algorithm
–
Pseudo-Random Number Generator (PRNG)
•
Easy to use API for all algorithms
•
Secure operation in contact as well as in the contactless mode
•
Latest built-in security features to avoid power (SPA/DPA), timing and fault attacks
(DFA)
P5CX012_02X_40_73_80_144_FAM_SDS_3
© NXP B.V. 2008. All rights reserved.
Objective short data sheet
Rev. 03 — 24 January 2008
4 of 18
NXP Semiconductors
P5Cx012/02x/40/73/80/144 family
Secure dual interface and contact PKI smart card controller
•
Common criteria CC EAL5+ certification planned [except ECC over GF(2
n
)] according
to BSI-PP-0002 protection profile
2. Features
2.1 Standard family features
I
EEPROM: choice of 12 KB, 20 KB, 40 KB, 72 KB, 80 KB or 144 KB
N
Data retention time: 20 years minimum
N
Endurance: 500000 cycles typical
I
ROM: 200 KB
I
RAM: 6144 B
N
256 B IRAM + 3.25 KB standard RAM usable for CPU
N
2560 B FXRAM usable for FameXE
I
Dedicated Secure_MX51 Smart Card CPU (Memory eXtended/enhanced 80C51)
N
5-metal-layer 0.14
µm
CMOS technology
N
Operating in Contact and Contactless mode (dependent on family type option)
N
Featuring a 24-bit universal memory space, 24-bit program counter
N
Combined universal program and data linear address range up to 16 MB
N
Additional instructions to improve:
- Pointer operations
- Performance
- Code density of both C and Java source code
I
ISO/IEC 7816 contact interface
I
PKI coprocessor FameXE
I
Support of major Public Key Cryptography (PKC) systems like RSA, Elgamel, DSS,
Diffie-Hellman, Guillou-Quisquater, Fiat-Shamir and Elliptic Curves
N
8192 bits maximum key length for RSA with randomly chosen modulus
N
4096 bits maximum key length for calculation within RAM
N
32-bit interface
N
Boolean operations for acceleration of standard, symmetric cipher algorithms
I
High speed Triple-DES coprocessor (64-bit parallel processing DES engine)
N
Two or three keys loadable
N
DES3 performance < 40
µs
I
High speed AES coprocessor (128-bit parallel processing AES engine)
I
Memory Management Unit (MMU)
I
Low power and low voltage design using NXP Semiconductors handshaking
technology
I
Multiple source vectorized interrupt system with four priority levels
I
Watch exception provides software debugging facility
I
Multiple source RESET system
I
Two 16-bit timers
I
High reliable EEPROM for both data storage and program execution
I
Bytewise EEPROM programming and read access
P5CX012_02X_40_73_80_144_FAM_SDS_3
© NXP B.V. 2008. All rights reserved.
Objective short data sheet
Rev. 03 — 24 January 2008
5 of 18
京公网安备 11010802033920号
EEWORLD
