Technical support

What is the recommended period for exchanging symmetric keys? Do embedded encryption chips make this switch?
Answer: The symmetric key exchange period can occur with each new communication opening, this would be the best way to implement a secure channel. The EC508 is capable of negotiating new keys using ECDH, but it is necessary to send the command to do so, it is not done automatically.

​

What problems might we  encounter when encrypting using C and decrypting in another language?
Answer: The same standard encryption algorithm is used, therefore, there should be no compatibility problems.

​

Would Block Chain suit security and privacy for IoT? Is it doable? Is it applicable?
Answer: Blockchain is the nomenclature for verifying the digital signature of sent data. This level of security is what we see to ensure integrity and authenticity. According to the descriptions, there is no mention of privacy since they are public documents.

​

A public key is made from the private key. Is it possible to have a public key that does not have a reverse path to the private key?
Answer: The public key is always generated by a private key, so there is no way for an unaltered public key not to have its respective private pair.

​

In the case of encryption chips with symmetric keys, does the chip change periodically? When should the key be changed?
Answer: The chip offers a mechanism for exchanging symmetric keys as it does not have an internal symmetric encryption mechanism. Steps:
1 - Generate new ECC key pair (one or both;
2 – Send a new public key to the partner (one or both);
3 – Generate the ECDH command with the partner’s new public key (both);
4 – The result of the ECDH is the new symmetric key (both).

​

ECC and RSA are algorithms just for generating the key pair. Correct?
In addition to generating keys, they can perform digital signature, signature verification and negotiation of new keys in the case of ECC, and encrypt and decrypt data in RSA.

​

How do I know which technology I have to use in my product? Does this depend on the computational power of my product?
Answer: If security is implemented by software, yes, it depends on computing power. If it is done by external hardware, it depends on the level of security you want to achieve. The question is usually the opposite. What level of security do I need and after that define the hardware.

​

How many private keys can be stored on a Microchip ATECC508a?
Answer: The ECC508 has 16 slots that can store private keys. Eight of these slots are larger and can be configured to store public keys and digital signatures.

​

Hash only uses asymmetric crypto?
Answer: Hash is a “summarization” algorithm. Entering the same data always generates the same “summary”, so let’s consider a symmetric algorithm.

​

To use a cryptographic chip, do I have to write a hal (hardware abstract layer), or are there already ready-made implementations?
Answer: The ECC508 component uses I2C communication and Microchip provides implemented libraries for the Cortex-M line, and one for PIC will soon also be available. It is possible to use it on other microcontrollers, but the HAL writing for the microcontroller needs to be adapted.

​

Is ECDH proof of a "man in the middle" attack?
Answer: Yes, since only the receiver and the sender know the key, as they negotiated keys using ECDH, the receiver will not be able to change the data and send the data with the same cryptographic key. The best implementation to avoid the “men in the middle” is digital signature.

​

Is NIST the official guide (including source code) for all these cryptography and technologies?
Answer: NIST (United States) is equivalent to Inmetro in Brazil. In the case of encryption, it is responsible for regulating what level of encryption is recommended for transactions, to prevent fraud. NIST tests and certifies the security of algorithms. Certified source code is available in some opensource implementations such as openSSL and wolfSSL.

​

Can the Microchip  ATECC508 component be used with any uC line? What would be the minimum uC requirement for use?
Answer: Yes, the Microchip ATECC508 can be used with any uC line, the requirement is that this line has I2C or UART communication, if using the 1-wire interface.