Cryptographic best practices discourage extensive reuse of encryption keys. This page shows you how to use TrustFLEX to update public keys securely.
TrustFLEX is a pre-configured and partially pre-provisioned secure element to ensure that a product with the consumables it uses, firmware it runs, accessories that support it, and the network nodes it connects to are not cloned, counterfeited, or tampered. It is one of the three ATECC608A sub-families (including Trust&GO and TrustCUSTOM) found on the CryptoAuth Trust Platform Development Kit.
The CryptoAuth Trust Platform includes hardware prototyping tools along with a unique design suite to accelerate the prototyping of commonly implemented use cases (e.g., IoT authentication, firmware validation (Secure Boot), IP protection, custom public key infrastructure, etc.). The presence of three sub-families allows for a wide variety of flexibility for implementation, based on the complexity of the application.
|
Table of Contents
|
Materials
Hardware Tools
| Tool | About | Purchase |
|---|---|---|
 CryptoAuth Trust Platform
Evaluation Kit |
| |
The CryptoAuth Trust Platform evaluation kit includes an on-board Embedded Debugger (EDBG).
Software Tools
| Tool | About | Installers |
Installation
Instructions |
||
|---|---|---|---|---|---|
| Windows | Linux | Mac OSX | |||
|
MPLAB® X
Integrated Development Environment |
| | | | |
|
MPLAB® XC32
C/C++ Compiler |
| | | | |
 Trust Platform DesignSuite
Includes Anaconda Navigator & Jupyter Notebook |
| | | | |
MPLAB X IDE v3.35 has a bug that prevents it from connecting to the CryptoAuth Trust Platform board. Please use a previous or later version of the IDE.
The Trust Platform Design Suite also includes example projects for the Atmel Studio 7 IDE.
1. TrustFLEX Devices
TrustFLEX devices are pre-configured and partially pre-provisioned secure elements for use in the following use cases:
- Cloud Platform Support: Google Cloud, AWS IoT, AWS Greengrass®, and Microsoft Azure®
- Secure Boot Firmware validation
- Secure Over The Air (OTA) upgrade
- Custom Public Key Infrastructure (PKI)
- IP/Firmware protection
- Accessory and Disposable authentication
Device Customization Process:
There are five steps involved in customizing the TrustFLEX device:
- Select a Pre-defined Use Case(s) from the TrustFLEX use case library.
- Generate the development keys and certificates using the Jupyter Notebook resource generator.
- Prototype the Use Case(s) in the Jupyter Notebook.
- Test the Use Case(s) on an embedded platform using the MPLAB® X IDE projects provided in the suite.
- Generate the secret exchange for production.
2. Open Jupyter Notebook
Click the Start Jupyter button to open Jupyter Notebook in your web browser.
This is used to provision a secure element on the CryptoAuth Trust Platform board. See the user guides (in the docs folder) for detailed instructions on running Jupyter Notebook for each use case.
Jupyter Notebook is an open-source web application that allows you to create documents that contain code and narrative text that can be executed in place. It provides Graphical User Interface (GUI) elements, the ability to add images, and gives the interactive look that is absent in normal code files.
The cells of the Jupyter Notebook can be used to write code or text using markdown. The code cells contain executable code and the text cells contain the explanation of the code's functionality.
assets folder:
- CryptoAuth Trust Platform board firmware.
- WINC1500 board firmware.
docs folder:
- Data sheets.
- CryptoAuth Trust Platform board user's guide.
- Detailed use-case guides.
TrustFLEX folder:
- Jupyter notebook packages
- C-based projects
TrustnGO folder:
- Jupyter notebook packages
- C-based projects
3. TrustFLEX Resource Generator:
The Resource Generator Notebook supports the development of Cryptographic Keys, Custom Root, and Signer Keys to issue device certificates and prototype the TrustFLEX devices with development keys and certificates.
TrustFLEX devices come with pre-programmed certificates in slots 10, 11, and 12. Slots zero through four have pre-generated private keys, other than these mentioned slots all the other slots have no data in them.
The Resource Generator Notebook will create development keys and certificates for all slots that can be further customized. Keys and certificate chains are stored in the PC filesystem and not generated in a secure environment.
Note: This tool is used for development purposes only and not for mass production. The keys and certificate chains are not generated in a secure environment.
3.1 Setting up the Hardware:
- Plug-in the CryptoAuth Trust Platform to the PC using the USB cable.
- The Design Suite is set up such that it communicates with the TrustFLEX device only.
3.2 Using the Trust Platform Suite for TrustFLEX:
- Open Jupyter Notebook, navigate to the TrustFLEX resource generator notebook, and click to open it.
- Trust Platform repository folder: TrustFLEX\00_resource_generation\
- File: TFLXTLS_resource_generator.ipynb
- Execute each cell using Cell > Run Cell and observe the output of each successfully executed code cell.
- If the Notebook has already been executed before, then restart the kernel by selecting Kernel > Restart and Clear Output.
Some cells take a bit of time to execute. The circle in the images below indicates if the kernel is still working on a cell (full circle) or idle (empty circle).
- Once all the cells are executed, you are asked to select the certificate type you need.
- Select MCHP Cert to use the standard Microchip certificate.
- Select Custom Cert to use a custom certificate. If using a custom certificate, you will need to enter the organization name to include in the custom certificates being generated.
- For this example, select Custom Cert.
- A prompt will open asking you to enter the Organization Name. If you don't know the organization name you can make one up but make sure the name does not exceed 24 characters.
TrustFLEX devices only use custom certificates for the custom PKI use cases. For all other TrustFLEX use cases, this selection is irrelevant because they don't use certificates.
- Once the organization name has been entered, the following output and a manifest file to be uploaded into the public cloud of your choice (Google GCP, AWS IoT, and Microsoft Azure) will be generated.
4. Use Case Prototyping:
Typically, the validation authority public key will be loaded to a secure element and locked permanently. This permanent public key will be used to validate/invalidate another rotating public key in a different slot. Unless this key is validated, it can’t be used for cryptographic operations.
The slot containing the rotating public key is configured as PubInvalid. This setting restricts the rotating public key access for both writes and cryptography operations until it's enabled by the validation authority.
This validation/invalidation process includes the validation authority signing the rotating public key’s digest and generating the signature. The validation authority’s private key will be used for verifying the signature with the temporary public key’s digest.
Once the rotating public key is validated, it can be used for Elliptic Curve Cryptography (ECC) operations and cannot be overwritten by another fraudulent key.
The basic steps for rotating public key update as follow:
- Invalidate existing rotating public key.
- Update (write) new rotating public key.
- Validate new rotating public key.
The temporary public key invalidation process is the same as validation except for the verify command. Once the temporary public key is invalidated, the slot can be updated with a new temporary public key. Once this new key is generated, its digest must be signed by the validation authority.
Once the new temporary public key is written to the slot, it remains in the invalidated state. This state restricts any Cryptography operations. To validate this slot for cryptography operations, the digest of this slot and signature generated in the previous state should be verified using the authority permanent public key. Once it's verified successfully, the slot becomes validated and is ready for cryptography operations. No updates are allowed to the slot unless is it first invalidated.
4.1 Running Public Key Rotation example on Jupyter Notebook
- From the Jupyter Home page, navigate to the TFLXTLS_Use_Cases\notebooks\public-key-rotation\Public Key Rotation with ECC608A-TFLXTLS Tutorial.ipynb notebook file and open it.
The notebook will open on your browser.
- Run all cells by selecting Kernel > Restart & Run All.
- It may take a while for the cells to complete processing. The circle beside the "Python 3" text in the graphics below indicate if the kernel is running (full circle) or idle (empty circle).
- Navigate through different cells output for the description of the step and result from the execution.
4.1.1 Generate a validation authority key pair
This step creates a permanent public/private key pair for the validation authority. It is performed by the TrustFLEX Resource Generator notebook (Crypto Resource Generator.ipynb) in the previous step. The validation authority pubic key is stored in slot 13.
4.1.2 Generate a rotating key pair
This step generates a new rotating key pair. Note these keys are not written into any slot at this time.
Click the Gen Rotating key pair button at the bottom of the Notebook. The button will turn green after the keys are generated successfully, and will turn red if there is an error.
4.1.3 Authorize the rotating public key
Before the new rotating keys can be used, they must be validated by the validation authority. In this step, the validation authority calculates the rotating public key’s digest and signs it using the validation authority private key.
Click the Authorize key button at the bottom of the Notebook. The button will turn green after the keys are authorized successfully, and will turn red if there is an error.
4.1.4 Update rotating public key
This is where the actual slot (slot 14) update happens. Before updating, the existing slot must be invalidated using the existing public key digest and signature provided by the validation authority. This signature should be of the existing (old) rotating public key. Once the slot is invalidated, the new rotating public key can be overwritten to this slot. After writing it successfully, the slot remains in the invalidated state ("PubInvalid") and doesn’t allow any cryptographic operations.
4.1.5 Validate the rotating public key
This step does the slot validation after writing the new rotating public key into slot 14. Unless the slot is validated, it cannot be used for cryptographic operations.
The process of validation involves the rotating public key digest and the signature provided by the validation authority. During this process, the TrustFLEX device initiates an internal Public key digest calculation on slot 14. Once the digest is generated, atcab_verify_validate function will be executed with the slot number and signature as parameters. On the successful match of the digest and signature, the slot will be marked as valid. This restricts further writes to the slot but enables cryptographic operations using this slot.
Click the Validate Key button at the bottom of the Notebook. The button will turn green after the key is validated successfully, and will turn red if there is an error.
4.1.6 Verify the rotating public key
Once the rotating public key is validated, it can be used for cryptographic operations. To verify that the rotating public key is functional, you perform a sign and verify ECC operation.
Generate a temporary message digest and sign it with the rotating private key. The signature is verified by using the rotating public key. If it is verified, then the rotating public key is available for ECC operations.
Click the Verify key button at the bottom of the Notebook. The button will turn green after the key is verified successfully, and will turn red if there is an error.
4.2 Running Public Key Rotation example on CryptoAuth Trust Platform
This use case can also be executed on an embedded platform. Once the resources are generated, both Atmel Studio 7 and MPLAB X IDE projects provided can be used to run the application on the CryptoAuth Trust Platform.
Remember to provision the TrustFLEX device before using these projects:
- Program the CryptoAuth Trust Platform with the factory firmware.
- Execute the TrustFLEX Resource Generator notebook (see the previous step).
Select the IDE of your choice from the tabs below:
1
Open the example project in the IDE
Start the MPLAB X IDE and open the Public Key Rotation project.
- Select File > Open Project.
- Look in the trust_platform\DesignTools\TFLXTLS_Use_Cases\c\pub_key_rotate\mplab folder.
- Double-click the pub_key_rotate.X file.
The application source file pub_key_rotate.c is found in this folder:
TFLXTLS_Use_Cases\c\pub_key_rotate
2
Program the CryptoAuth Trust Platform
Click the Make and Program Device icon and wait for the "Programming complete” message to be displayed in the Output window.
- Once the programming is complete, the project will execute the public key rotation operation. On successful completion of the operation, the Trust Platform status LED will start blinking.
- Public key rotation successful = LED blinks once every second
- Public key rotation unsuccessful = LED blinks five times every second
It is also possible to view the console messages by using a terminal emulation program (i.e., TeraTerm). Open the application with the COM port related to CryptoAuth TrustPlatform with 115200-8-N-1 settings.
