2.2.3 ATECC608A-TNGLoRaWAN Slot Configuration Summary

The ATECC608A-TNGLoRaWAN has 16 slots that can be configured for different use cases. Below is a summary of those slots with their configuration and proposed uses for the ATECC608A-TNGLoRaWAN:

SlotUse CaseDescriptionPrimary Configuration
0NwkKey/AppKeyDerived parent keys - used for deriving all session keys. These keys are derived with the individual device serial number and master parent key; the derived keys are said to be diversified.Never readable/writable. Derive key can be run with the repersonsalization key as the parent. Must supply DeriveKeyMAC. AES key.
1Device private keyRFU - optional ECC private key. Device private key, public key can be generated from the private key.ECC Private Key. Public Key can be generated, ECDH, external signs, permanent.
2AppSKeyApplication session key. Derived from AppKey and other information.AES key. Always writable, encrypted reads with the IO protection key as read key. PubInfo set to allow KDF to write this slot.
3NwkSEncKeyNetwork session encryption key. Derived from NwkKey and other information.AES key. Always writable, encrypted reads with the IO protection key as read key. PubInfo set to allow KDF to write this slot.
4SNwkSIntKeyServing network session integrity key. Derived from NwkKey and other information.AES key. Always writable, encrypted reads with the IO protection key as read key. PubInfo set to allow KDF to write this slot.
5FNwkSIntKeyForwarding network session integrity key. Derived from NwkKey and other information.AES key. Always writable, encrypted reads with the IO protection key as read key. PubInfo set to allow KDF to write this slot.
6JSIntKeyJoin server integrity key. Derived from NwkKey and other information.AES key. Always writable, encrypted reads with the IO protection key as read key. PubInfo set to allow KDF to write this slot.
7JSEncKeyJoin server encryption key. Derived from NwkKey and other information.AES key. Always writable, encrypted reads with the IO Protection Key as read key. PubInfo set to allow KDF to write this slot.
8Certificate dataRFU - signer and device compressed certificate data.Always readable/writable. ECC public key. Lockable.
9JoinEUI/DevNonceJoinEUI and DevNonce, stored together in the same slot. Used in derive key calculation.Always readable/writable.
10DevEUISlot to hold a manually assigned IEEE EUI. Used to derive the session keysAlways readable/writable. Lockable.
11McAppSKeyMulticast application session key.AES key. Always writable, encrypted reads with the IO protection key as read key. PubInfo set to allow KDF to write this slot.
12McNwkSKeyMuticast network session key.AES key. Always writable, encrypted reads with the IO protection key as read key. PubInfo set to allow KDF to write this slot.
13Repersonalization keyDiversified key that is used to derive a new set of NwkKey/AppKey parent keys (Slot 0). It can also be used as the encrypted write key for itself (Slot 13).Never read, encrypted write. Repersonalization key is the write key.
14IO protection keyUsed to encrypt the output of the KDF command to encrypt newly derived keys back to the host. It can also be used as the encrypted read key for all session keys.Never readable, always writable, lockable. ReqRand is set.
15Reserved