ATECC608 programming/pre-provisioning on custom design

[sessler-rob]

Hi Simen (@M65649), hi everyone!

We are developing a custom IoT board based on AVR-IoT cellular mini with AVR128DB48, ATECC608B and a LTE modem.
It will be used to connnect to Azure IoT Hub.
In the schematic a ATECC608B-MAH4I-S is installed, but I can't find any information about this product name.
At the moment we have a ATECC608B-MAHDA (TrustCustom) in our design, which has to be programmed with certificates in the corresponding slots (as far as I understood).
@M65649 Which certificates and parameters do we have to program into a new and unprogrammed ATECC608B to get the avr-iot-cellular-arduino-library working and provision the device to Azure IoT Hub?
Is there a script that does this, or can you provide some information, or maybe a manual?

If no, is it possible to order a preprogrammed ATECC608B-MAH4I-S?

We also have a pre-provisioned Trust&GO secure element (ATECC608B-TNGTLS) here, is it possible to use this one (maybe with minor modifications on avr-iot-cellular-arduino-library)?

Thanks,
Ruben

[crypto-lars]

Hi,

I am not sure what your requirements are for handling the devices in Azure e.g. if you want to operate with you own chain of trust and use the device provisioning service (DPS) ... or just do individual enrollment ... many options there, and depending on what you want to do a different ATECC608B variant would be needed.

Trust Custom is the most flexible but most complex solution since you will have to configure the whole device. Only recommended if you have specific needs that cannot be covered by Trust&Go or Trust&Flex. A short comparison between the other solutions is here https://onlinedocs.microchip.com/oxy/GUID-59F7F830-64CA-4EE1-A21D-C5745DEC9509-en-US-2/GUID-E9D8F7C5-867A-4826-9310-10CB628ECE93.html

The MAH4I-S is based on the Trust&Flex solution but gives us two additional benefits:

• keep track of all devices that we put on our development boards (we have then all manifests with certificates etc. for all devices that have been mounted on our products).
• Compared to the standard Trust&Flex nothing is locked so we can make adjustments if necessary (we lock the parts that we want to be locked during board manufacturing)
  Anyway, this device is not available for purchase but wanted to give some background information here. The best fit, when it comes to necessary changes, would be the standard Trust&Flex device because this would be a drop in replacement and should work with the provisioning sketch. I have not tested this but in theory it should work.

If you want to use Trust&Go devices you will do individual enrollments in Azure and you have to make some changes in the code to store the Azure connection details somewhere in your application because this device does not allow you to store this data (e.g. MCU EEPROM or hardcode it in the application if you don`t expect this to change).

For experimenting with programming certificates etc. we also have the pysequansutils Python package https://pypi.org/project/pysequansutils/ but this wont work if you dont use the Sequans Monarch 2 modem.

[crypto-lars]

Hi Ruben,

I don't have any suggestion where to get a Trust&Flex devices besides the official channels.
The procedure to convert Trust Custom device into something that is similar to Trust&Flex is not easy and requires detailed knowledge on ECC608 features as well as creating your own chain of trust. The Trust&Flex devices have a certificates that are signed by Microchip CA and you won't be able to re-create this and therefore would have to create your own certificate chain.

I think the best option, until you can get hold of Trust&Flex devices, would be be to use Trust&Go. The changes needed are

• Enable Trust&Go support in the provisioning sketch with ATCA_TNGTLS_SUPPORT instead of ATCA_TFLEX_SUPPORT
• Find a different solution for storing Azure device specific data (you cannot store this in the secure element, so either hard-code in your application or store e.g. in EEPROM). For this you need to adjust the provisioning script and the application.

Regards,
Lars

[M65649]

Tagging along on this @sessler-rob. If you need help with modifying the library for Trust&Go I'll be happy to provide support.

[sessler-rob]

Hi @crypto-lars , hi @M65649,

thanks for your support.
I ordered a DT100104 which contains both Trust&Go and TrustFlex.
I'll adopt it to my board the next days and test it.
As soon as I have results, I will report back.

Thanks
Ruben

[sessler-rob]

Hi @crypto-lars,

thanks again for your fast support.
I got provisioning and communication with Azure IoTHub working right out of box with the TrustFlex device.

Thanks and regards
Ruben

[M65649]

I'm glad to hear @sessler-rob. Let us know if there's anything else we can help with 😄