Fundamentals of SHA-3 Master/Slave Mutual Authentication System

Introduction

As computer technology advances, customers are asking for an even higher level of security. Analog Devices' answer is the DeepCover^® Secure Authenticator DS28E50 with 1-Wire^®, SHA-3, and user EEPROM and the DS2477 SHA-3 coprocessor with a 1-Wire master function.

DS28E50 1-Wire SHA-3 Authenticator

The DS28E50 supports a challenge size of 256 bits and uses a 256-bit secret. Each 1-Wire slave has a unique 64-bit ROM ID, which serves as the node address in a 1-Wire network and is a fundamental ingredient for authentication. The function commands for the DS28E50 include general memory read/write access, as well as security functions for slave authentication to the master and master authentication to the slave for write access. The memory is separated into pages of 32 bytes and allows the user to set protections on memory pages. See the DS28E50 Security User Guide for a description of device commands, a memory map, and available memory protections.

DS2477 SHA-3 Coprocessor with a 1-Wire Master

The DS2477 secure I²C coprocessor with built-in 1-Wire master combines FIPS 202-compliant secure hash algorithm (SHA-3) challenge-and-response authentication with Analog Devices' patented ChipDNA^™ feature—a physically unclonable technology with the ultimate protection against security attacks.

Security Logistics

SHA-based security relies on hash message authentication codes (HMACs) computed from open data and a secret. To verify authenticity, both sides (i.e., the host or coprocessor and the 1-Wire authenticator) must know the secret, which shall never be exposed. In addition, the secret in each 1-Wire authenticator should be unique. This way, in case the secret of a single authenticator is compromised, the security of the entire system is not affected.

At first glance, it appears impossible to meet these requirements. There is, however, a simple solution: compute the secret from known ingredients at a trusted location. These ingredients are a master secret (32 bytes), the binding data (32 bytes), a partial secret (32 bytes), the authenticator's ROM ID (8 bytes), and padding/formatting ("other data"). Although the ingredients are exposed at one point in time, the computed secret is never exposed and remains hidden.

In-Factory Setup

DS2477 Coprocessor

The coprocessor setup involves only communication between the host processor and the coprocessor. The master secret, binding data, and partial secret should be generated as random numbers. Once the values of these ingredients are defined, these values apply to the entire system. To be recognized as authentic in the system, all coprocessors and authenticators must be set up using the same values. Table 1 shows the host activity and coprocessor commands involved in performing the setup.

DS28E50 1-Wire Authenticator

The setup of the authenticator is similar to that of the coprocessor. Table 2 shows the sequence of steps and authenticator commands involved in performing the setup. After loading the master secret and binding data into the authenticator, the partial secret is provided to the authenticator's Compute and Lock SHA-3 Secret command. The Compute and Lock SHA-3 Secret command finally generates and installs the authenticator's unique secret, thus overwriting the master secret. The DS28E50 can be set up using any 1-Wire master. This app note assumes that the DS2477 1-Wire master will be used to set up the DS28E50.

Process Flow

Generating the Authenticator's Unique Secret in the Coprocessor (in the Field)

Before the host can verify whether an authenticator belongs to the system, the authenticator's unique secret must be recreated inside the coprocessor (S-Secret). Table 3 shows the I²C commands involved in performing the Coprocessor Compute and Lock SHA-3 Secret. The coprocessor knows already the master secret, binding data, and partial secret. Additional data needed are the authenticator's ROM ID and the manufacturer ID. With multiple authenticators on the 1-Wire bus, the Read ROM command is not applicable. Instead, the search ROM sequence must be used, identifying one 1-Wire device at a time. The term "customization data" refers to the authenticator's ROM ID, manufacturer ID, and the page number (OR'd with 0x80) where the binding data was located in the authenticator.

Verifying the Authenticity of the Authenticator

Table 4 shows the sequence of steps needed to verify an authenticator's authenticity in a given system using the DS2477 coprocessor.

To verify the DS28E50 with a generic host (i.e., to authenticate an authenticator), the host needs to know the data of one of the authenticator's memory pages. Then the authenticator receives a challenge from the host and the authenticator is instructed to compute a page HMAC and to send it to the host for verification. Once the host knows the page HMAC, it computes an HMAC using the same data. If both HMAC results are identical, the S-Secret in the host matches the unique secret in the authenticator, confirming that the authenticator is part of the system. All of these procedures can be handled by a single Full Authenticate command on the DS2477. See Table 5 (or the DS2477 Security User Guide) for the I²C commands needed.

Faster Verification that the Authenticator Is a Part of the System

While the Full Authenticate command in the DS2477 simplifies the authentication process for the user, it does so by executing each step automatically in series. It is possible to speed up the authentication process by manually executing the authentication steps and have the DS2477 generate the unique slave secret while the DS28E50 is generating the HMAC for Compute and Read Page Authentication, as seen in Table 6 below.

Writing to the Authenticator with Host Authentication—Authenticated Write

If the 1-Wire authenticator is verified as part of the system, the host can write to the user memory using the Authenticated Write Memory command. Table 7 shows the sequence of steps and commands needed to write one segment. As a precondition, the host needs to know the current memory page data (old page data) before a page can be updated (new page data). Note that the page must have authentication write protection HMAC (APH) or encryption and authenticated write protection HMAC (EPH) set on it. This example will assume the DS28E50 is set up according to Table 2 with the exception that page 0 will have APH protection set in step 5.