OPTIGA™ Trust Forum Discussions
Can you provide link to get detailed datasheet of SLJ52ACA150A1VQFN32XUMA1 including part number details and technical details like single pin interface to FPGA.
We are interfacing SLJ52ACA150A1 with FPGA LFE5UM-45F (lattice) using single wire for DATA I/O, RST and CLK pins. Need any example schematic. Specifically we need pull-up value required on DATA pin (if required) and any other similar interface details.
Show LessI am planning to use Optiga TrustX module in my project. One requirement in that project is to comply with the 802.1AR standard (Secure Identity Key).
I know that TPM modules are for that purpose, but I am not sure about Trust X. what is the exact difference between them? Why isn't optiga trust X marked TCG TPM? I checked the documentation but the only remark about the difference is that TrustX is for embedded systems but TPM modules are for more powerful PC or linux-based systems.
I appreciate if you can share your thoughts about TrustX for 802.1AR compatibility.
Best regards,
Vedat Show Less
I am playing this example from NordicSemi here:
https://infocenter.nordicsemi.com/index.jsp?topic=%2Fcom.nordic.infocenter.sdk5.v15.3.0%2Fifx_optiga_custom_example.html&cp=5_1_4_3_1_2
In this example, there is a test regarding key derivation as:
static void uc_key_derivation(void)
{
optiga_lib_status_t optiga_lib_status;
uint8_t info[100] = { 0 };
uint16_t info_len = 100;
uint16_t oid = 0xF1D0;
uint8_t shared_secret[64] = { 0 };
// Check if key derivation is supported (OPTIGA Trust X after version 1.20.1048)
optiga_lib_status = optiga_util_read_data(0xE0C2, 0, info, &info_len);
DEMO_OPTIGA_ERROR_CHECK(optiga_lib_status);
if (info[25] == 0x10 && info[26] == 0x48) // !!!! THIS CONDITION RETURNS TRUE
{
NRF_LOG_INFO("Key derivation not supported!\r\n");
NRF_LOG_FLUSH();
return;
}
As I understand, it checks the fw version of the OptigaX for if key derivation is supported or not. According to the reply of the TrustX device, the function returns with 'Key derivation not supported!' message.
The thing is that, in the datasheet (revision 2.6), it clearly says OptigaX supports key derivation in the first page.
Crypto ToolBox with ECC NIST P256, P384, SHA-256 (sign, verify, key generation, ECDH, key derivation)
I appreciate if anybody has any suggestion with that, if this is the case or not, and how to use key derivation with optigaX.
Best regards,
Vedat Show Less
according to the data sheet after successful writing of data . the NVM_ACT bit should be reset. but it doest get reset in my case. that means the NVM is still is progress.
can someone assist me in writing the data to NVM. Show Less
Hi
I have tested several javacards (Feitian D11CR, Infineon JTOP, G&D Smart Cafe) over T=0 and here is what I have observed.
If applet returns some data in case 4 APDU, the JCRE signals with SW 0x61XX that there is data available which terminal should retrieve using GET RESPONSE APDU.
However, if applet returns some data in case 2 APDU and Le does not match number of bytes to be returned, JCRE signals with error SW 0x6CXX, instructing that the same C-APDU has to be resent with correct Le.
For legacy reasons there are terminals who know how to handle 0x61XX, but fail to handle 0x6CXX response. Is there a way how to force JCRE to handle case 2 APDUs using 0x61XX (GET RESPONSE) omegle voojio method?
Show LessThanks. Show Less
Hello,
I have some questions on Infineon OPTIGA™ Trust M SLS 32AIA010MH and especially optiga_crypt_ecdsa_sign().
Question 1
Are there some limitations on the length of the provided digest in the optiga_crypt_ecdsa_sign() API-call? I have an application where I want to sign a digest of ~300 bytes (i.e. I do not want to apply the signature on a hash of the data), but providing such digest to the optiga_crypt_ecdsa_sign() method gives me an error code of 0x8005. Why is that? This error code does not seem to be defined anywhere either, so I am not able to figure out what it means.
By inspecting the source code, it looks like it should give me an OPTIGA_CMD_ERROR_INVALID_INPUT (0x0203) error instead if any.
Question 2
Are there some timing constraints in the https://infineon.github.io/optiga-trust-m/ library we need to be aware of?
I have used the procedure outlined in this example: https://github.com/Infineon/optiga-trust-m/blob/develop/examples/optiga/example_optiga_crypt_ecdsa_sign.c, but if I remove the log statements and the performance measurement, it looks like it causes some issues.
Ressources: https://infineon.github.io/optiga-trust-m/
Best regards
Show LessDear Infineon Community Team,
I ported (to Zephyr 2.4.0 ) and successfully tried the zephyr driver for Optiga Trust M. It works well. Nice job you did here.
However I have been really disappointed when I discovered that this zephyr driver was unfortunately not based on the Optiga Trust Library : "pal" is not ported on Zephyr. Instead it is a nice but distinct implementation. In our case I would have to use features that are not present in this Zephyr driver. So porting the Library seems mandatory.
QUESTIONS:
- Does Infineon think about providing the "Optiga Trust M library" porting for Zephyr?
- Is there any description to implement a Certificate Signing Request using the Optiga Trust M? Or the CSR must be done off-security controller?
- Is there any document that shows the security controller commands in more details?
Thanks in advance. Looking forward to your soonest reply.
Best regards,
Thierry
Show Less
I am working on bring up Infineon SLS37CSA HSM on Qualcomm SA2150P application processor.
I already download all reference resource from the link (https://myicp.infineon.com/sites/SLS37_V2X/Lists/defaultdoclib/SLS37V2XProduct/) including databook, get start, HSM host software and public certification (IntCAcerts/Infineon OPTIGA(TM) V2X ECC CA 004_20200804.zip).
I already integrate HSM host software to SA2150P Linux rootfs. The sample application runs failure below:
~ # get-info
[T=1' ] [ERROR ] polling time exceeded but no data received
[T=1' ] [ERROR ] polling time exceeded but no data received
[T=1' ] [ERROR ] polling time exceeded but no data received
[T=1' ] [ERROR ] Giving up block exchange after 2 tries
[T=1' ] [WARNING] Trying to recover via S(SWR) exchange
[T=1' ] [ERROR ] polling time exceeded but no data received
Could not initialize V2X communication stack (0x804101ff)
~ #
My questions:
1. There is no guide to show how to use the public certification (IntCAcerts/Infineon OPTIGA(TM) V2X ECC CA 004_20200804.zip). Can you provide the steps?
2. What is the other possible reasons for the sample app failure above?
Show LessHi,the following page https://github.com/Infineon/optiga-trust-m/wiki/Data-and-Key-Store-Overview says about data-retention-after-testing that "this time is the same as the device lifetime defined in the data sheet."
Where can i find this information? Can you give me more details?
If i write a data object like 0xF1D0 once after production, how long is this information retained?
Regards.
Show Less