nerves-hub / atecc508a

Elixir interface for the ATECC508A/ATECC608A

ATECC508A

The ATECC508A Crypto Authentication (or the newer ATECC608A) is the main component of the NervesKey. If your device needs to authenticate with NervesHub or another cloud service using client-side SSL, this library could be of interest. The higher level NervesKey package will likely make more sense and you're recommended to start there.

Installation

The package can be installed by adding atecc508a to your list of dependencies in mix.exs:

def deps do
  [
    {:atecc508a, "~> 0.3.0"}
  ]
end

Documentation can be found at https://hexdocs.pm/atecc508a.

Quick start

Connect an ATECC508A or ATECC608A to an I2C bus on your device. If this is a new device, it won't be configured and therefore it can't do much exciting. You can still read the configuration block, though. Here's a walk-through:

iex> {:ok, i2c} = ATECC508A.Transport.I2C.init(bus_name: "i2c-1")
{:ok, {ATECC508A.Transport.I2C, {#Reference<0.713213266.268828681.225043>, 96}}}
iex> ATECC508A.Configuration.read(i2c)
{:ok,
 %ATECC508A.Configuration{
   chip_mode: 0,
   counter0: 4294967295,
   counter1: 4294967295,
   i2c_address: 192,
   i2c_enable: 85,
   key_config: <<51, 0, 51, 0, 51, 0, 28, 0, 28, 0, 28, 0, 28, 0, 28, 0, 60, 0,
     60, 0, 60, 0, 60, 0, 60, 0, 60, 0, 60, 0, 28, 0>>,
   last_key_use: <<0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0>>,
   lock_config: 85,
   lock_value: 85,
   otp_mode: 0,
   reserved0: 193,
   reserved1: 0,
   reserved2: 0,
   rev_num: :ecc608a_1,
   rfu: <<0, 0>>,
   selector: 0,
   serial_number: <<1, 35, 185, 8, 198, 142, 22, 255, 238>>,
   slot_config: <<131, 32, 135, 32, 143, 32, 196, 143, 143, 143, 143, 143, 159,
     143, 175, 143, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ...>>,
   slot_locked: 65535,
   user_extra: 0,
   x509_format: <<0, 0, 0, 0>>
 }}

Most functions in this library end up in ATECC508A.Request, but there are many modules that make working with the device easier elsewhere.

Device configuration

Figuring out how to configure devices is perhaps the most consuming part of using an ATECC508A/ATECC608. Take a look at the device configuration section in the NervesKey documentation. That configuration supports authenticating TLS connections to Nerves Hub and other cloud services. The NervesKey library also makes provisioning the chip much easier than using this library directly. For integrating with Erlang's TLS stack, see nerves_key_pkcs11.

atecc508a's Issues

module ATECC508A.Certificate.Template is not available

Upgraded:
  atecc508a 1.0.0 => 1.1.0

....

==> nerves_key
Compiling 7 files (.ex)
warning: ATECC508A.Certificate.Template.device/2 is undefined (module ATECC508A.Certificate.Template is not available or is yet to be defined)
Invalid call found at 2 locations:
  lib/nerves_key/data.ex:43: NervesKey.Data.slot_data/3
  lib/nerves_key/data.ex:98: NervesKey.Data.write_aux_certs/4

warning: ATECC508A.Certificate.Template.signer/1 is undefined (module ATECC508A.Certificate.Template is not available or is yet to be defined)
Invalid call found at 2 locations:
  lib/nerves_key/data.ex:38: NervesKey.Data.slot_data/3
  lib/nerves_key/data.ex:93: NervesKey.Data.write_aux_certs/4

warning: ATECC508A.Certificate.Template.device/2 is undefined (module ATECC508A.Certificate.Template is not available or is yet to be defined)
  lib/nerves_key.ex:116: NervesKey.device_cert/2

warning: ATECC508A.Certificate.Template.signer/1 is undefined (module ATECC508A.Certificate.Template is not available or is yet to be defined)
  lib/nerves_key.ex:141: NervesKey.signer_cert/2

Serialize requests

Multiple users of this library can easily interfere with each other since some requests take a very long time for the ATECC508A to respond. The timeouts on waking up the device are much shorter and the device will "fail" to wakeup if one of those long requests is pending.

Cache information from the device

Since the device is so slow and so much of it is read-only, it would really be nice to cache responses to avoid waiting.