Home
3 EEPROM Memory and Data Zone Access Policies
3.2 Data Zone and Access Policies
3.2.1 Data Zone Data Types
The following section provides more details on the various types of data capable of being stored in the ECC608-TNGHNT data slots.
3.2.1.5 I/O Protection Key

ECC608-TNGHNT

Introduction
Features
Applications
1 Pin Configuration and Pinout
2 Helium Network and DeWi Alliance
3 EEPROM Memory and Data Zone Access Policies
- 3.1 ECC608-TNGHNT Configuration Zone
- 3.2 Data Zone and Access Policies
  - 3.2.1 Data Zone Data Types
    The following section provides more details on the various types of data capable of being stored in the ECC608-TNGHNT data slots.
  - 3.2.2 Slot Configuration Terminology
    The following section provides a set of terms used to discuss configuration options. The terms are arranged alphabetically.
  - 3.2.3 ECC608-TNGHNT Slot Configuration Summary
    The ECC608-TNGHNT has 16 slots that are configured for different use cases. Below is a summary of those slots with their configuration and proposed uses for the ECC608-TNGHNT:
  - 3.2.4 ECC608-TNGHNT Detailed Slot Access Policies
- 3.3 ECC608-TNGHNT EEPROM One-Time-Programmable (OTP) Zone
4 Device Commands
5 I²C Interface
6 Electrical Characteristics
7 Package Drawings
8 Revision History
Microchip Information

3.2.1.5 I/O Protection Key

The Verify, ECDH, and KDF commands can optionally use the I/O protection feature to encrypt some parameters and validate (via MAC) some responses. This is to help protect against man-in-the-middle attacks on the physical I²C bus. However, before this feature can be used, the MCU and ECC608-TNGHNT need to generate and save a unique I/O protection key, essentially pairing the MCU and ECC608-TNGHNT devices to each other. The pairing process must happen on the first boot.

I/O protection key generation:

MCU uses a random command to generate a random 32-byte I/O protection key.
MCU saves the I/O protection key in its internal Flash.
MCU writes the I/O protection key to the I/O protection key slot.
MCU slot locks that slot to make the I/O protection key permanent.

As a pairing check, the MCU could use the MAC command to issue a challenge to the I/O protection key and verify that the I/O protection key stored in Flash matches the one in the ECC608-TNGHNT.

The online versions of the documents are provided as a courtesy. Verify all content and data in the device’s PDF documentation found on the device product page.