5.2.3.1 SecureBoot - FullCopy

The FullCopy mode of the SecureBoot command will copy either the signature or verified digest to the target slot. The target slot is defined as part of the access policies for SecureBoot and is not part of the command. This mode of the SecureBoot command must be run before the command can be run in FullStore Digest or Signature mode. Optionally a MAC can be generated with a nonce from the host using the IO protection secret to prevent tampering with the wire between the host and the ATECC608A-TFLXTLS.

For the ATECC608A-TFLXTLS device, the digest will be copied to Slot 7 upon successful completion of this command.

Table 5-56. Input Parameters - SecureBoot FullCopy

Opcode
(1 Byte)

Mode
(1 Byte)

Param2
(2 Bytes)

Data
(96 Bytes)

Description
0x800x070x00 00
  • 32-byte digest of the entire code
  • 64-byte signature
  • Code digest is unencrypted
  • Code digest and signature to be verified by the public key
0x870x00 00
  • 32-byte encrypted digest of the entire code
  • 64-byte signature
  • Code digest is encrypted
  • Code digest and signature to be verified by the public key
  • Output MAC is generated
Table 5-57. Output Response - SecureBoot FullCopy
NameModeSizeResponse
Success0x071 byte
  • 0x00 - Successful
  • 0x01 - Computation completed but mismatch in result
  • Error code for other values
MAC0x8732 bytesIf successful
1 byte
  • 0x01 - Computation completed but mismatch in result
  • Error code for other values

SecureBoot FullCopy MAC Calculation

Prior to generating the MAC in this mode, the Nonce command must be run to insure a valid value is stored in TempKey. The MAC is then calculated in two steps.
Step 1: Generate SHA256 digest over the IO protection key and the nonce
32 bytesContent of the IO protection key
32 bytesFirst 32 bytes of nonce stored in TempKey
Step 2: SHA256 digest of the following
32 bytesDigest generated in step 1
32 bytesPlaintext Message. Output of step 1 XORed with the input encrypted code digest (first 32 bytes of the input buffer)
64 bytesSignature as passed from the input
4 bytesInput parameters (Opcode, Mode, Param2) (0x80, 0x86, 0x00 00)