SE Manager Key Provisioning

This example uses the SE Manager API to perform the key provisioning and OTP initialization on the supported Series 2 device.

The following items can be programmed to the SE OTP:

The AES-128 key (encrypt-unsafe-key.prv), the corresponding private sign key (rootsign-unsafe-privkey.pem), and private command key (cmd-unsafe-privkey.pem) can be found in the Windows folder below.

C:\SiliconLabs\SimplicityStudio\v5\developer\adapter_packs\secmgr\scripts\offline

The AES-128 key (encrypt-unsafe-key.prv) is:

81a5e21fa15286f1df445c2cc120fa3f

The public key of rootsign-unsafe-privkey.pem is:

X - C4AF4AC69AAB9512DB50F7A26AE5B4801183D85417E729A56DA974F4E08A562C

Y - DE6019DEA9411332DC1A743372D170B436238A34597C410EA177024DE20FC819

The public key of cmd-unsafe-privkey.pem is:

X - B1BC6F6FA56640ED522B2EE0F5B3CF7E5D48F60BE8148F0DC08440F0A4E1DCA4

Y - 7C04119ED6A1BE31B7707E5F9D001A659A051003E95E1B936F05C37EA793AD63

The example redirects standard I/O to the virtual serial port (VCOM) of the kit. By default, the serial port setting is 115200 bps and 8-N-1 configuration.

The example has been instrumented with code to count the number of clock cycles spent in different operations. The results are printed on the VCOM serial port console. This feature can be disabled by defining SE_MANAGER_PRINT=0 (default is 1) in the IDE setting (Preprocessor->Defined symbols).

SE Manager API

The following SE Manager APIs are used in this example:

Getting Started

  1. Upgrade the kit’s firmware to the latest version (see Adapter Firmware under General Device Information in Simplicity Studio 5 Users Guide).
  2. Upgrade the device’s SE firmware to the latest version (see Secure Firmware under General Device Information in Simplicity Studio 5 Users Guide).
  3. Open any terminal program and connect to the kit’s VCOM port (if using Device Console in Simplicity Studio 5, Line terminator: must be set to None).
  4. Create this platform example project in the Simplicity IDE (see Examples in Simplicity Studio 5 Users Guide, check Platform() checkbox to browse the platform examples).
  5. Build the example and download it to the kit (see Simple Build and Flash Programmer in Simplicity Studio 5 Users Guide).
  6. Run the example and follow the instructions shown on the console.

Additional Information

  1. The key cannot be read if it has not been provisioned.
  2. The key provisioning and OTP initialization will fail if the key and OTP had already been provisioned and initialized.
  3. The secure boot cannot be enabled if the public sign key has not been provisioned.
  4. For a device with VSE, a reset will be issued when running specified SE Manager APIs.
  5. Warning: Loading the tamper and secure boot configuration, AES-128 key, public sign key and public command key into the SE OTP are a ONE-TIME-ONLY process. These assignment operations are irrevocable and persist for the life of the device.
  6. The default optimization level is Optimize for debugging (-Og) on Simplicity IDE and None on IAR Embedded Workbench.

Resources

AN1222: Production Programming of Series 2 Devices