The ConnectCore 8M Mini SOM integrates an Atmel ATECC508A cryptochip that offers the following features:

  • Cryptographic accelerator with secure hardware-based key storage

  • Performs high-speed public key (PKI) algorithms

    • ECDSA: FIPS186-3 Elliptic Curve Digital Signature Algorithm

    • ECDH: FIPS SP800-56A Elliptic Curve Diffie-Hellman Algorithm

  • NIST standard P256 elliptic curve support

  • SHA-256 hash algorithm with HMAC option

  • Internal high-quality FIPS random number generator (RNG)

  • 10Kb EEPROM memory for keys, certificates, and data

    • Storage for up to 16 keys

    • Guaranteed-unique 72-bit serial number

  • Two high-endurance monotonic counters

  • Multiple options for consumption logging and one-time write information

  • Intrusion latch for external tamper switch or power-on chip enablement

The cryptochip is connected to the i.MX8M Mini CPU through the I2C1 port.

There is no kernel driver and no device tree entries for this hardware element, as it is managed directly from userspace.

Userspace usage

You can use the cryptochip via the CryptoAuthLib, which is a software library written in C that supports ATSHA and ATECC family of Atmel CryptoAuthentication devices.

Before you can use the chip’s functionality, you must program and lock the configuration zone. The configuration zone is a set of 128 bytes that configure the cryptochip for a specific use case.

Microchip provides information about the configuration zone under NDA.

The CryptoAuthLib library provides a test application called cryptoauth_test. You can use this application to program and lock the configuration zone with default test values.

Locking the configuration zone is an irreversible operation. If you are going to use cryptoauth_test to program and lock the default configuration, you should only use the cryptochip for testing purposes and not for production.

To program and lock the configuration zone with default test values, run the cryptoauth_test application and then run the lockcfg command:

# cryptoauth_test
$ lockcfg

Locking with test configuration, which is suitable only for unit tests...
Confirm by typing Y
Contact Microchip for information on appropriate data to write to your configuration zone depending on your use case.

Example application

Digi Embedded Yocto includes an example that makes use of the CryptoAuthLib library: https://github.com/digi-embedded/dey-examples/tree/dey-4.0/maint/cryptochip-get-random. This application obtains random numbers from the ATECC508A and outputs them to the standard output stream:

# ./cryptochip-gen-random | hexdump
0000000 6239 ddd4 b378 693f 14ed bfa1 447b cff1
0000010 275e fd14 e392 2b4a c2ff ac93 0f5e cbab
0000020 16c1 e6b7 a458 c5ea c96f 59c9 776a 41c5
0000030 a656 ffa8 2076 6917 f18a e9ad 9ea1 7915
0000040 b677 aec3 a0a2 c7b6 c8ce 2a1f aa6c d9fc
0000050 f75c 3b57 eea4 051b 3a5f 7bd9 523f 4544
0000060 cb1a 388c b655 e8ca d6eb e459 8a43 cd2f
(...)

The output of the application matches what you would read from a standard random number generator, like /dev/random. For example, you can also store the random data—checking the speed at which it is produced—and then run an entropy test on it:

# ./cryptochip-gen-random | pv --rate > data.bin
[ 912 B/s]
# ent data.bin
Entropy = 7.998261 bits per byte.

Optimum compression would reduce the size
of this 291808 byte file by 0 percent.

Chi square distribution for 291808 samples is 706.41, and randomly
would exceed this value less than 0.01 percent of the times.

Arithmetic mean value of data bytes is 127.0582 (127.5 = random).
Monte Carlo value for Pi is 3.149895135 (error 0.26 percent).
Serial correlation coefficient is 0.000944 (totally uncorrelated = 0.0).
The ent utility is not included in Digi Embedded Yocto by default. You can transfer the random data file to your host computer and analyze it there.

Building applications

Follow these steps to compile an application that uses the cryptochip:

  1. Include the cryptoauthlib header:

    #include <cryptoauthlib.h>

  2. Use the I2C default configuration to initialize the library:

    atcab_init(&cfg_ateccx08a_i2c_default);
    The cfg_ateccx08a_i2c_default variable is provided by the library and it is already configured for the ConnectCore 8M Mini.

  3. Add the following lines to the Makefile so that the applications are linked against the library:

    CFLAGS += $(shell pkg-config --cflags cryptoauthlib)
LDLIBS += $(shell pkg-config --libs cryptoauthlib)

PKCS11 interface

The library can interface with OpenSSL via a PKCS11 API to exchange cryptographic tokens. For example, using the cryptochip’s default test configuration, you can create a CSR for the private key generated in said configuration.

# openssl req -engine pkcs11 -key "pkcs11:token=0123EE;object=device;type=private" -keyform engine -new -out new_device.csr -subj "/CN=NEW CSR EXAMPLE"

Once the CSR has been created, verify that its signature is correct with the following OpenSSL command:

# openssl req -in new_device.csr -verify -text -noout
verify OK
Certificate Request:
    Data:
        Version: 1 (0x0)
        Subject: CN = NEW CSR EXAMPLE
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:f7:0c:d4:ab:51:14:02:83:6b:1b:4d:6b:5d:88:
                    cd:77:7e:66:c4:ab:80:3a:3c:3f:92:52:2b:34:40:
                    5c:89:22:cb:39:32:e3:b3:f8:2f:15:2e:cd:f0:01:
                    57:0c:ad:7c:be:9c:71:bb:ac:a4:cc:5d:8b:45:de:
                    d1:63:cc:84:17
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        Attributes:
            a0:00
    Signature Algorithm: ecdsa-with-SHA256
         30:46:02:21:00:d4:3d:e2:df:3d:c3:b0:b5:9c:58:24:36:17:
         3d:d9:76:52:1a:51:79:59:fa:90:ad:a5:28:20:97:e9:bc:8c:
         f1:02:21:00:87:ea:7e:78:20:b5:c0:a2:5b:6d:71:2c:0c:da:
         6e:bf:00:e2:61:f2:7c:82:10:d6:87:d8:06:0f:10:3b:d8:d9

See the Github Cryptoauthlib wiki for more information. The Digi Embedded Yocto rootfs has the PKCS11 feature ready to use out of the box with the cryptochip’s default test configuration.

For more information about the use of this library, see the Atmel Application Note 8984 - Cryptoauthlib. The library is already integrated for the ConnectCore 8M Mini, so you can skip the porting section of the Atmel application note.