This example uses the SE Manager API to demonstrate the tamper feature on the supported Series 2 Secure Vault device.
For demonstration purposes, a private command key is stored in the device’s memory to sign the access certificate for tamper disable. The device’s public command key in the SE OTP must match with the public key of this private command key to disable tamper signals.
The default private command key (cmd-unsafe-privkey.pem
) can be found in the Windows folder below.
C:\SiliconLabs\SimplicityStudio\v5\developer\adapter_packs\secmgr\scripts\offline
The public key of cmd-unsafe-privkey.pem
is:
X - B1BC6F6FA56640ED522B2EE0F5B3CF7E5D48F60BE8148F0DC08440F0A4E1DCA4
Y - 7C04119ED6A1BE31B7707E5F9D001A659A051003E95E1B936F05C37EA793AD63
If the device does not have public command key in the SE OTP, the program will prompt the user to program the public key above to the device.
The user can change the private command key (private_command_key[]
) in app_se_manager_tamper_disable.c
to match with the device’s public command key in the SE OTP for tamper disable.
The example redirects standard I/O to the virtual serial port (VCOM) of the kit. By default, the serial port setting is 115200 bps and 8-N-1 configuration.
The example has been instrumented with code to count the number of clock cycles spent in different operations. The results are printed on the VCOM serial port console. This feature can be disabled by defining SE_MANAGER_PRINT=0
(default is 1) in the IDE setting (Preprocessor->Defined symbols
).
Level | Responses | Description |
---|---|---|
0 | Ignore | No action is taken |
1 | Interrupt | The SETAMPERHOST interrupt on the host is triggered |
2 | Filter | A counter in the tamper filter is increased |
4 | Reset | The device is reset |
7 | Erase OTP | Erases the OTP configuration of the device (make the device and all wrapped secrets unrecoverable) |
Number | Name | Default level | User level in this example |
---|---|---|---|
0 | Reserved | — | — |
1 | Filter Counter | 0 | 1 |
2 | SE Watchdog | 4 | 4 |
3 | Reserved | — | — |
4 | SE RAM CRC | 4 | 4 |
5 | SE Hardfault | 4 | 4 |
6 | Reserved | — | — |
7 | Software Assertion | 4 | 4 |
8 | Reserved | — | — |
9 | UserCodeAuth | 0 | 0 |
10 | MailboxAuth | 0 | 1 |
11 | DCIAuth | 0 | 0 |
12 | OTP Read | 4 | 4 |
13 | Reserved | — | — |
14 | Self-test | 4 | 4 |
15 | TRNG Monitor | 0 | 1 |
16 | PRS0 | 0 | 1 (Push button PB0) |
17 | PRS1 | 0 | 1 (None) |
18 | PRS2 | 0 | 2 (Push button PB0) |
19 | PRS3 | 0 | 2 (None) |
20 | PRS4 | 0 | 4 (Push button PB1) |
21 | PRS5 | 0 | 4 (Software) |
22 | PRS6 | 0 | 7 (None) |
23 | PRS7 | 0 | 7 (None) |
24 | DECOUPLE BOD | 4 | 4 |
25 | TempSensor | 0 | 2 |
26 | VGlitch Falling | 0 | 2 |
27 | VGlitch Rising | 0 | 2 |
28 | SecureLock | 4 | 4 |
29 | SE Debug | 0 | 0 |
30 | Digital glitch | 0 | 2 |
31 | SE ICACHE | 4 | 4 |
The disable tamper command simply reverts all masked tamper sources (TAMPER_DISABLE_MASK
in app_se_manager_tamper_disable.h
) to the hardcoded configuration (default levels in table above).
The default value of TAMPER_DISABLE_MASK
is 0x00fa0000
so PRS7, PRS6, PRS5, PRS4, PRS3, and PRS1 are restored to the default level 0 (Ignore) after running the disable tamper command.
Setting | User value in this example |
---|---|
Filter - trigger threshold | 4 |
Filter - reset period | ~33 seconds |
Flags | Digital Glitch Detector Always On: Disabled |
Reset threshold | 5 |
The following SE Manager APIs are used in this example:
sl_se_init
sl_se_deinit
sl_se_init_command_context
sl_se_deinit_command_context
sl_se_get_reset_cause
sl_se_get_status
sl_se_read_otp
sl_se_init_otp
sl_se_validate_key
sl_se_get_storage_size
sl_se_generate_key
sl_se_export_public_key
sl_se_read_pubkey
sl_se_init_otp_key
sl_se_get_serialnumber
sl_se_get_challenge
sl_se_ecc_sign
sl_se_disable_tamper
sl_se_roll_challenge
Adapter Firmware
under General Device Information in Simplicity Studio 5 Users Guide).Secure Firmware
under General Device Information in Simplicity Studio 5 Users Guide).Device Console
in Simplicity Studio 5, Line terminator:
must be set to None
).Platform()
checkbox to browse the platform examples).Optimize for debugging (-Og)
on Simplicity IDE and None
on IAR Embedded Workbench.