SWRU455M February 2017 – October 2020 CC3120 , CC3120MOD , CC3130 , CC3135 , CC3135MOD , CC3220MOD , CC3220MODA , CC3220R , CC3220S , CC3220SF , CC3230S , CC3230SF , CC3235MODAS , CC3235MODASF , CC3235MODS , CC3235MODSF , CC3235S , CC3235SF
The SimpleLink device supports on-chip asymmetric key-pair storage (secure key storage) with built-in crypto acceleration and crypto services to assist in some common cryptographic-related operations.
These crypto services provide a mechanism to manage up to eight ECC key-pairs, and use them to sign or verify data buffers. This capability can be used for authenticating the device identity, among other usage options.
There are three types of supported key-pairs:
The system supports a single constant key-pair. Entry 0 is reserved for this key-pair. Entries 1 to 7 can be used for temporary or installed key-pairs, according to the application needs. All keys are ECC keys using the SECP256R1 curve. The following applies to all entries:
For all key pairs, the private key is never exposed, and can only be accessed indirectly when using it to sign buffers. The public key may be retrieved by the host application (see Section 18.1.1). Table 18-1 lists the key crypto utility features.
Main Features | Description |
---|---|
Manage temporary key-pair | Create or remove temporary keys at a provided index. Temporary keys are not persistent over the power cycle. Creating a temporary key in an index occupied by another temporary key overrides the occupied key. An installed key on that index cannot be overridden. |
Installed key-pairs | Install or uninstall key pairs provided by the host application. The keys must be preprogrammed in the file system. The install action adds them to the data base, and allows using them to sign and verify buffers. This operation is persistent over the power cycle without consideration of system-persistent configuration. The user cannot install a key in an occupied index. |
Constant key-pair | Unique key for the given device, embedded in the hardware. Always available and constant. |
Retrieve public key | For any key-pair type, the host may request to retrieve the public key of the pair in x9.63 raw format. The host application can also retrieve the metadata of this key (type, curve, length, filename, and so forth). |
Verify buffer | Given a buffer and a signature, the host can request to use any key-pair to verify the ECDSA signature. |
Sign buffer | Given a buffer, the host can request to use any key-pair to create a signature using ECDSA. |
Secured content delivery | Transfer secure content by sending the public key to the application server which encrypts the file, and decrypts in the device internally using the private key only. Can only be performed with a temporary key in index 1. |
True random number | Retrieve buffer with true random numbers from the networking subsystem. Maximum buffer length 172 bytes for each retrieval. |
Certificate creation | Create a self signed certificate or certificate signing request (CSR) with one of the installed keys, device key or temporary key. |