5.2.3.2 SecureBoot - FullStore (Digest)

In the FullStore Digest mode of the SecureBoot command, the verified digest will be stored in a slot. This mode improves the IO transfer and overall computation times associated with the command. To use this mode, the FullCopy validation Command mode needs to be initially executed and the device will receive both the digest and the signature and store the digest in the slot specified in the SecureBoot access policies. Optionally a MAC can be generated with a nonce from the host using the IO protection secret to prevent tampering with the wire between the host and the ATECC608A-TFLXTLS.

Table 5-58. Input Parameters - SecureBoot FullStore

Opcode
(1 Byte)

Mode
(1 Byte)

Param2
(2 Bytes)

Data
(32 Bytes)

Description
0x800x060x00 00
  • 32-byte digest of the entire code
  • Code digest and signature to be verified by the public key
0x860x00 00
  • 32-byte encrypted digest of the entire code
  • Code digest is encrypted
  • Code digest and signature to be verified by the public key
  • Output MAC is generated
Table 5-59. Output Response - SecureBoot FullStore
NameModeSizeResponse
Success0x061 byte

0x00 - Successful
0x01 - Computation completed but mismatch in result.
Error code for other values.

MAC0x8632 bytesIf successful
1 byte

0x01 - Computation completed but mismatch in result.
Error code for other values.

SecureBoot Stored Digest MAC Calculation

Prior to generating the MAC in this mode, the Nonce command must be run to insure a valid value is stored in TempKey. The MAC is then calculated in two steps.

Step 1: Generate SHA256 digest over the IO protection key and the nonce
32 bytesContent of the IO protection key
32 bytesFirst 32 bytes of nonce stored in TempKey
Step 2: SHA256 digest of the output of step 1 and the additional information shown below:
32 bytesDigest generated in step 1
32 bytesPlaintext Message. Output of step 1 XORed with the input encrypted code digest (first 32 bytes of the input buffer)
4 bytesInput parameters (Opcode, Mode, Param2) (0x80, 0x86, 0x00 00)