SHA-1/HMAC Based Security & Authentication IC …

1 SDQP Fm+ kWP+ProtectorProductFolderSample &BuyTechnicalDocumentsTools &SoftwareSupport &Communitybq26100 SLUS696B JUNE2006 REVISEDAUGUST2015bq26100 SHA-1/HMACB asedSecurityand AuthenticationIC with SDQ Interface1 Features3 DescriptionThebq26100deviceprovidesa methodto1 ProvidesAuthenticationof BatteryPacksThroughauthenticatebatterypa cks,ensuringthat onlypacksSHA-1 EngineBasedHMAC manufacturedby authorizedsub-contractorsare used 160-BytesOne TimeProgrammable(OTP),16-in the end securityis achievedusingBytesEEPROMthe SHA-1hashfunctioninsidethe widelyadoptedkeyed-hashmessageauthentica tioncode(HMAC) unique128-bitkey is storedin eachOscillatorbq26100device,allowingthe hostto authenticate Low-PowerOperatingModes:eachpack. Active:< 50 AThebq26100devicecommunicatesto the system Sleep:8 A Typicalovera simpleone-wirebi-directionalserialinterf ace.

2 Single-WireSDQI nterfaceThe5-kbits/sSDQbusinterfacereduc escommunicationsoverheadintheexternal PowersDirectlyFromthe 6-LeadVSONP ackagepoweroverthe SDQbuslinevia an ApplicationsDeviceInformation(1) CellularPhonesPARTNUMBERPACKAGEBODYSIZE( NOM) PDAand SmartPhonesbq26100 VSON(6) MP3 Players(1) For all availablepackages,see the orderableaddendumat DigitalCamerasthe end of the datasheet. InternetAppliances HandheldDevicesTypicalApplicationDiagram 1An IMPORTANTNOTICEat the end of this datasheetaddressesavailability,warranty, changes,use in safety-criticalapplications,intellectual propertymattersand JUNE2006 Applicationand Pin Configurationand Deviceand (SDQ) Mechanical,Packaging,and RevisionHistoryNOTE:Pagenumbersfor previousrevisionsmay differfrompagenumbersin the (February2007)to RevisionBPage AddedESDR atingtable,FeatureDescriptionsection,Dev iceFunctionalModes,Applicationand Implementationsection,PowerSupplyRecomme ndationssection,Layoutsection,Deviceand DocumentationSupportsection,andMechanica l,Packaging,and ChangedSONto Changedformattingof 2006 2015, mm465312 ExposedThermal Pad3 mm3 JUNE2006 REVISEDAUGUST20155 Pin Configurationand FunctionsDRPP ackage6-PinVSONTop ViewPin SDQinterfaceto hostVSS2, 3, 4, 5 IGround6 (unlessotherwisenoted)(1)MINMAXUNITS upplyvoltage(SDQall with respectto VSS) (SDQ)5mATAO peratingfree-airtemperature 4085 CTJJ unctiontemperature 40150 CTstgStoragetemperature 65150 C(1)

3 StressesbeyondthoselistedunderAbsoluteMa ximumRatingsmay causepermanentdamageto the stressratingsonly,whichdo not implyfunctionaloperationof the deviceat theseor any otherconditionsbeyondthoseindicatedunder RecommendedOperatingConditions. Exposureto absolute-maximum-ratedconditionsfor extendedperiodsmay (HBM),per ANSI/ESDA/JEDECJS-001(1)2000 ElectrostaticV(ESD)VdischargeCharged-dev icemodel(CDM),per JEDEC specificationJESD22-C101(2)1500(1)JEDEC documentJEP155statesthat 500-VHBM allowssafe manufacturingwith a standardESDcontrolprocess.(2)JEDEC documentJEP157statesthat 250-VCDM allowssafe manufacturingwith a (unlessotherwisenoted) 40 CCopyright 2006 2015,TexasInstrumentsIncorporatedSubmitD ocumentationFeedback3 ProductFolderLinks:bq26100bq26100 SLUS696B JUNE2006 (1)DRP(VSON)UNIT6 PINSR C/WR JC(top)Junction-to-case(top) C/WR C/W C/W C/WR JC(bot)Junction-to-case(bottom) C/W(1)For moreinformationabouttraditionaland new thermalmetrics,see theSemiconductorand IC PackageThermalMetricsapplicationreport, parametersoveroperatingfree-airtemperatu reand supplyvoltagerange(unlessotherwisenoted) (memoryprogrammingand authenticationweretestedwith R1 = k , C1 = F overpullupvoltagerange)PARAMETERTESTCOND ITIONSMINTYPMAXUNITP owerup communicationdelayPowercapacitorchargeti me100msIsleepSleepcurrent811 AIsdq(Vsdq)VsdqCurrentVsdq Vsdq(min)50 s/byteEEPROMP rogrammingcurrent(peakcurrent)83 AEEPROMP eakcurrentduration100 sink currentVOL= (SDQ)Timingoverrecommendedoperatingtempe ratureand supplyvoltagerange(unlessotherwisenoted) (SeeFigure1)

4 MINNOMMAXUNITtRSTLR esettime low480 stRSTHR esettime high480 stPDLP resencedetect low60240 stPDHP resencedetect high1560 stRECR ecoverytime1 stSLOTH ostbit window60120 stLOW1 Hostsends1113 stLOW0 Hostsends060120 stLOWRH ostreadbit start113 stSLOTbq26100bit window60120 stSUbq26100datasetup1 stRDVbq26100datavalidexactly15 stRELEASEbq26100datarelease01545 s4 SubmitDocumentationFeedbackCopyright 2006 2015,TexasInstrumentsIncorporatedProduct FolderLinks:bq26100 Temperature (qC)Active Current (PA)-40-20020406080 VTemperature (qC)Sleep Current (PA)-40-20020406080 VtPDHtPDLtRSTLtRSTH(c) bq26100 Transmitted Bit Timing(a) Reset and Presence Timing(b) Host Transmitted Bit TimingtLOW1tLOW0 SLOT& JUNE2006 strisePulserise time110 stprogPulsehigh timeSinglebyte programming300 sKey programming3 stfallPulsefall time110 sFigure1.

5 ActiveCurrentAcrossSDQV oltageandFigure3. SleepCurrentAcrossSDQV oltageandTemperature(NotAuthenticating)T emperatureCopyright 2006 2015,TexasInstrumentsIncorporatedSubmitD ocumentationFeedback5 ProductFolderLinks:bq26100 Temperature (DC)Peak Current (PA)-40-20020406080 90360363366369372375378D005 Temperature (DC)VIH (V)-40-20020406080 VTemperature (DC)Active Current (PA)-40-20020406080 90222224226228230232D004bq26100 SLUS696B JUNE2006 (continued)Figure4. VIH AcrossSDQV oltageand TemperatureFigure5. ActiveCurrentAcrossTemperature(WhileAuth enticating)Figure6. PeakCurrentAcrossTemperature(WhileAuthen ticating)6 SubmitDocumentationFeedbackCopyright 2006 2015,TexasInstrumentsIncorporatedProduct FolderLinks:bq26100 EEPROM- Charge PumpDTOP- SHA-1/HMAC - SDQ- Ctrl and Status RegistersPowerRetificationATOP- Oscillator- LDO- POR- OTP Power JUNE2006 REVISEDAUGUST20157 bq26100deviceis a smallmemorydevicefor batterypacksor devicecontainsa mix ofOne TimeProgrammable(OTP)and multi-writeEEPROMnon-volatilememorywith authenticationfunctionsthatcan be usedto validatethe battery/accessoryfor usagein the host memoryconsistsof five 32-bytepagesof generaluse OTPnon-volatilememoryand a 16-bytepageof EEPROMto be usedat the hostsystemdesigner s externalhighvoltageis requiredfor programmingthe OTP,but is not necessaryforprogrammingthe 2006 2015,TexasInstrumentsIncorporatedSubmitD ocumentationFeedback7 ProductFolderLinks.

6 Bq26100bq26100 SLUS696B JUNE2006 bq26100devicehas a bq2022compatiblememoryand commandstructurewith new commandsto bq26100deviceusesa combinationof non-volatileOTPand programmedin the factoryas an externalvoltageis requiredto programthe bits; the EEPROMcan be programmedin the field,with the programmingvoltagegeneratedautomatically by an 32x8-bitsOTPare accessedwith the bq2022compatiblecommandset, whilea fifth pageof 32x8-bits are accessedwitha newcommandset. Eachpageof OTPcan be lockedonceprogrammed,blockingfurtherwrit esto the an additionalprovisionto allowfor pageredirectionat the hostin the eventthat a pageis redirectionis not automatic,but a hostsystemcan determinewherea pageredirectionis occurringand readthe appropriatepagefor EEPROM consistsof 16x8-bitsthat can be writtenin the sameway as for the writesis differentthanwritingto RAMto allowfor the internalchargepumpto createthe voltagenecessaryto set the bit bq26100devicecontainsa SHA-1engineto generatea modifiedversionof the FIPS180 challengeor publicmessagetransmittedfromthe hostand a secretkey storedon thebq26100deviceto generatea 160-bithashthat will be contentsof the challengeare unimportant,but eachchallengeshouldbe generatedrandomlyto improvethe securityof the computethe HMAC.

7 Let H designatethe SHA-1hashfunction,M designatethe messagetransmittedto thebq26100device,and KD designatethe unique128 bit devicekey of the (M)is definedas:H[KD||H(KD||M)]where || symbolizesan appendoperation(1)The message,M, is appendedto the devicekey,KD, and paddedto becomethe inputto the this first calculationis thenappendedto the devicekey,KD, paddedagain,and cycledthroughtheSHA-1hasha outputis the secretkey is storedin separateOTPavailablein key spaceis split into two 64-bitspacesthatcan be programmedand lockedat separatetimes,providingan opportunityto split the key betweentwo differentprogrammingentitiesto ensurethat no key leak can occurfroma PowerThe bq26100deviceusesa single-wirecommunicationprotocol,SDQ,tha t allowsfor broadcastor targetedcommunicationto a numberof deviceson the programmedwith a unique64-bitaddressand the protocolconsistsof an automaticarbitrationschemethat allowsthe hostto determinethe ID ofeverydeviceon the bq26100devicetakesadvantageof the pullupon the SDQline to powera capacitorconnectedto the PWRpin and the chargeon this capacitoris usedparasiticallywhenthe SDQline is low.

8 As a result,thereis no needfor additionalpowerto be suppliedto the 2006 2015,TexasInstrumentsIncorporatedProduct FolderLinks:bq26100 Master RX:0x55 ROMF unctionFlowProfileM/F = JUNE2006 use the profilecommandto determinehow the deviceshouldbe bq26100deviceenterssleepmodewhenthe SDQentersa stopstateor whenSDQencountersan bq26100 DeviceThe bq26100devicecommunicationprotocolstarts whenthe host pullsthe bus low for devicesonthe bus are to respondwith a presencepulse,whichis activelow. The host can thentransmitthe ROMF unctioncommand,whichis usedto addressthe deviceson the bus. The ROMfunctionsincludeMatchID, SkipID, ReadID, and host transmitsthe 64-bitID of the 1-wirebaseddeviceto ID is necessaryfor if one deviceis connectedto the 1-wireslavetransmitsits 64 bit commandis only usefulif thereis only onedeviceconnectedto the thereare multipledeviceson the bus.

9 This commandinitiatesa communicationwith asingledevice,but it is moreusefulin allowingthe host to determinethe addressof everydeviceon the bus. The MatchID can thenbe usedto communicatewith a 2006 2015,TexasInstrumentsIncorporatedSubmitD ocumentationFeedback9 ProductFolderLinks:bq26100 MemoryFunctionFlowHost TransmitsR/FNOYESYESYESYESR/F = 0xF0?Search IDbq26100 Transmits 1 ForEach Bit Startn = n + 1n = 63?YESbq26100 TransmitsPresenceHost Transmits Reset?YESNONONONONOR/F = 0x55?Match IDROMF unctionFlowR/F = 0xCC?Skip IDNOYESHost Transmits ID(LSB to MSB)YESR/F = 0x33?Read IDHost Transmits IDBit nNObq26100 Transmits ID(LSB to MSB)n = 0bq26100 Transmits IDBit nbq26100 Transmits IDBit nID Match?Bit n Match?bq26100 SLUS696B JUNE2006 (continued)Figure8. ROMF unctionFlowChartThe 64-bitdeviceID is madeup of an 8-bitfamilycode,48-bitrandomvalue,and a final 8-bitCRC(seeTable1).

10 Table1. Formatof 64-bitDeviceIDID MSBID LSBCRC(8 bits)RandomData(48 bits)FamilyCode(8 bits, defaultsto 0x09)ContactTexasInstrumentsif specificdatashouldbe programmedinto the ROMfunctioncommandis issuedand the bq26100deviceis selected,a MemoryFunctioncommandcan be MemoryFunctioncommandsare ReadMemory,ReadEEPROM,ReadStatus,ReadPag e,ReadPage4, ReadDigest,ReadControl,WriteMemory,Write Page4, WriteEEPROM,WriteStatus,WriteMessage,Wri teControl,and showsthe flow for the throughFigure15 illustratethe flow 2006 2015,TexasInstrumentsIncorporatedProduct FolderLinks:bq26100 WriteEEPROMFlowM/F = 0xAF?YESNOM/F = 0xF0?NOMemoryFunctionFlowROMF unctionFlowYESM/F = 0x0E?NOReadMemoryFlowYESM/F = 0xC3?NOReadPageFlowYESYESM/F = 0x0F?NOWriteMemoryFlowM/F = 0xDD?NOReadDigestFlowYESW riteMessageFlowYESM/F = 0x22?NOM/F = 0xAA?NOReadStatusFlowYESW riteStatusFlowYESM/F = 0x55?