Leverage the Simplicity of Thumbprint Certificate Authentication

The vast majority of networks mandate Transport Layer Security (TLS), which relies on certificate-based authentication. Whether you are using a public cloud or a private cloud, the trust in the device identity will depend entirely on how well the device’s private key is protected. If the private key is spoofed, the device can be impersonated by an unauthorized user who can then control the device’s transactions. The TLS stack is good for managing the key agreement and the encryption. However, implementing secure authentication presents you with several challenges: securely storing the private key in the device, shipping the private key across the globe for any project and system size, and creating a possibly cost-prohibitive, weak and hard-to-scale manufacturing flow. These challenges can be addressed by using the TrustFLEX ATECC608B-TFLXTLS secure element from our Trust Platform family with TLS stack providers. This solution also provides you with the flexibility to choose your own certificate authority in addition to leveraging the integrated authentication use cases in the same secure element.

serviceplan-logo-trustflex-whitebg

Benefits of Using the TrustFLEX ATECC608B With TLS:

  • Leverage multiple use cases with our pre-configured devices
  • Use your own certificate authority
  • Leverage the simplicity of thumbprint certificate authentication
  • Implement a unique, trusted, protected and managed device identity
  • Turn-key code examples

  • Leverage Microchip’s secure provisioning service
  • Simplify logistics of shipping private keys and reduce manufacturing costs
  • Microcontroller-agnostic implementation
  • JIL rated “high” secure key storage
  • Protection against known tamper, side-channel attacks

TrustFLEX ATECC608B-TNGTLS Features

  • Custom Certificate Authentication: Use either the default thumbprint certificates already inside the TrustFLEX device or overwrite them with your own certificate.
  • JSON Web Token (JWT) Authentication: Leverage a private key to perform an Elliptic Curve Digital Signature Algorithm (ECDSA) sign operation on a token that will be verified by its corresponding public key somewhere else in the network.
  • Secure Boot (with key attestation): Perform an ECDSA verification at boot using a public key corresponding to a private key used to sign the code that the system will boot from. The public key becomes highly sensitive as it will allow a system to boot.
  • OTA Verification: Perform an ECDSA verification after an update using a public key corresponding to a private key used to sign the code the system will be updated with. The public key becomes highly sensitive as it will allow a system to be updated with a new code that needs to be trusted.
  • Firmware Intellectual Property (IP) Protection: Perform a verification during the system runtime using a key corresponding the one used to sign the code the system will run on. The verification key becomes highly sensitive as it will allow a system to run on a genuine code image.
  • Message Encryption: Provides the capability to encrypt a very small packet of data using the integrated hardware Advanced Encryption Standard (AES) engine.
  • Key Rotation: Provides the capability to rotate private keys within the secure boundaries of the secure element.
  • I/O Protection Key: Provides the capability to uniquely pair the MCU and the secure element.
  • Host Accessory Authentication: Provides the capability to create an ecosystem control strategy by having a main host authenticate its peripherals using as basic PKI architecture.

Ready to Get Started with TrustFLEX and a TLS Stack Provider?

mBedTLS

Linux® OS

Trust Platform Devices

View All Parametrics
X

Similar Devices

View All Family Devices

Development Tools

Definitions

Credentials: Identity verification tools or methods that include X.509 certificates, generic certificates for thumbprint authentication, keys and data packets

Customization: The action of creating a unique device/system through its configuration and set of secrets

Firmware Verification: When a key and cryptographic operation are used to verify a signed image on a device at boot up or during run time

IP Protection: When a key and a cryptographic operation are used to verify signed (or hashed) firmware that is considered Intellectual Property (IP) of a product

Key(s): A set of binary numbers that is used to trigger a cryptographic algorithm that implements asymmetric or symmetric encryption

Over-the-Air (OTA) Verification: When a key and a cryptographic operation are used to verify a signed image that has been loaded into a connected device by a push notification from a cloud service

PKI: Public Key Infrastructure

Provisioning: The action of generating a credential into an embedded storage area

Thumbprint Certificate: An X.509 certificate not issued by a certificate authority that is used for authentication to the cloud

Find More Definitions

FAQS

General Questions:

Q: How can I get started with the Trust Platform?
A: Use the “Let Us Guide You to the Right Option” on the Trust Platform page, which will help you take the first step. You will find additional information about getting started with Trust&GO, TrustFLEX and TrustCUSTOM on their pages.

Q: I am a distribution partner. How do I enroll in the Trust Platform program?
A: Contact your local Microchip sales office to request assistance with joining the program.

Trust&GO Questions:

Q: Do I need to contact Microchip to provision my Trust&GO secure element?

A: No. When you buy the device, it is already provisioned with keys and certificates specific to the use case you have selected that are locked inside the device. Trust&GO cannot be altered and is intended to be used as is.

Q: Where can I obtain the public keys and certificates for my Trust&GO device?
A: Log into your customer account at the ecommerce website where you purchased the device after device shipment, and you should be able to download a manifest file containing all the necessary public keys and certificates. Contact the vendor if you have any trouble finding this file.

TrustFLEX Questions:

Q: Do I need to contact Microchip to provision my TrustFLEX secure elements?  
A: Yes. When you buy the device, it comes pre-configured with your selected use case(s). By default, the TrustFLEX device also come with keys and generic certificates for thumbprint authentication that are overwritable internally if you have not already locked them using the lock bit. While the configuration cannot be altered, the default credentials can be changed if you have not already locked them. If you decide to use the default credentials, you will have to lock them after receiving the device. If you don’t want to use the default credentials, you can replace them with yours and then lock them. After you have made your decision, create the secret packet exchange, encrypt it and upload it into a support ticket on Microchip’s technical support portal. We will provision your devices and ship them according to your instructions.

Q: Where can I obtain the public keys and certificates for my TrustFLEX device when I use the default credentials?
A: Log into your customer account at the ecommerce website where you purchased the device after device shipment, and you should be able to download a manifest file containing all the necessary public keys and certificates. Contact the vendor if you have any trouble finding this file. WARNING: If you have overwritten the default credentials in your device, the manifest file will no longer be compatible with the device’s new credentials.

TrustCUSTOM Questions:

Q: Do I need to contact Microchip to provision my TrustCUSTOM secure element?
A: Yes. When you buy the device, it will be blank. You will need to use the TrustCUSTOM configurator, which is available under Non-Disclosure Agreement (NDA) to define the configuration, create the secret packet exchange, encrypt it and upload it into a support ticket on Microchip’s technical support portal. We will provision your devices and ship them according to your instructions.

Q: Where can I obtain the secret packet exchange for my TrustCUSTOM device?
A: This utility is only available through a Non-Disclosure Agreement (NDA). Contact your local Microchip sales office or distributor to request it.

Q: Where can I get the full data sheet for my TrustCUSTOM device?
A: This document is only available through a Non-Discloser Agreement (NDA). Contact your local Microchip sales office or distributor to request it.

Training

Partners