1 Introduction

The ATSHA206A device supports a standard challenge-response protocol to authenticate a component or an accessory attached to a system. In use, the host system sends a challenge (i.e. a 32-byte number) to the ATSHA206A device in the client subsystem via the Message Authentication Code (MAC) command. The device generates a SHA-256 hash by combining the challenge, the DerivedKey and some additional information and returns the result as the response to the host system. The use of a hash algorithm prevents an observer on the bus from deriving the value of the secret key while allowing the system to verify that the response is correct.

The DeriveKey command implements a key derivation scheme. Each time the command is used, the current value of the ParentKey slot is cryptographically combined with certain fixed values and that result is then written into the DerivedKey slot.

All security functions are implemented using the industry-standard SHA-256 secure hash algorithm, using full-sized 256-bit secret keys to prevent any kind of exhaustive attack.

The ATSHA206A is designed to be compatible with the ATSHA204A for a subset of memory and commands as documented in this data sheet. For a comparison, see the Compatibility with ATSHA204A section.