SL2S3003 datasheet(14/82 Pages) NXP

14 / 82 page

NXP Semiconductors

SL2S3003/SL2S3003TT

ICODE 3 (TagTamper)

8.2.2 Originality signature

The ICODE 3 can verify the origin of a tag. The device compares the UID compared with an originality signature

stored in the configuration memory. The originality signature can be read either with the READ SIGNATURE

command (refer to Section 8.5.3.20 "READ SIGNATURE"), or with the READ CONFIG command (refer to

Section 8.5.3.21 "READ CONFIG"). The outcome of the command is verified on the reader side.

The originality signature can be customized for specific applications. At delivery, the ICODE 3 is

preprogrammed with the 32-byte NXP originality signature. The signature is unlocked in the dedicated memory.

If needed, the signature can be reprogrammed with a custom-specific signature using the WRITE CONFIG

command (refer to Section 8.5.3.22 "WRITE CONFIG") during the customization process. Next, the signature

can be permanently locked by setting the OTP_OS_LOCK bit to 1 with the WRITE CONFIG command to avoid

further modifications.

The ICODE 3 can be configured with a 48-byte signature using the OS_CFG_MODE in the configuration

memory (see Table 41). If the originality signature is set to 48 bytes, the customized signature must be

programmed into blocks 0 to 11 in the configuration memory. Then the WRITE CONFIG command is used to set

the configuration memory to "locked".

Note: If no customized originality signature is required, it is recommended to permanently lock the NXP

signature during the initialization process by setting the configuration memory to "locked" with the WRITE

CONFIG command.

8.2.2.1 Originality signature at delivery

At delivery, the ICODE 3 is programmed with a 32-byte NXP digital signature based on standard Elliptic Curve

Cryptography (curve name secp128r1), according to the ECDSA algorithm [6]. The use of a standard algorithm

and ECC curve ensures easy software integration. The originality check procedure in NFC devices does

not require specific hardware. During production, each ICODE 3 UID is signed with an NXP private key. The

resulting 32-byte signature is stored in the configuration memory blocks 0 to 7.

Config Block

Byte 0

Byte 1

Byte 2

Byte 3

OS_0 (LSB)

OS_1

OS_2

OS_3

OS_4

OS_5

OS_6

OS_7

OS_24

OS_25

OS_26

OS_27

OS_28

OS_29

OS_30

OS_31 (MSB)

Table 8. Originality Signature location in the configuration memory

Use the READ SIGNATURE command or the READ CONFIG command to retrieve the signature (refer to

Section 8.5.3.20 "READ SIGNATURE"). Verify the signature in the NFC device by using the corresponding ECC

public key provided by NXP [7].

If the NXP public key is stored in the reader device, the complete signature verification procedure can be

performed offline.

To verify the signature (for example with the use of the public domain crypto library OpenSSL), set the tool

domain parameters to secp128r1, defined within the standards for elliptic curve cryptography SEC [6].

SL2S3003/SL2S3003TT

All information provided in this document is subject to legal disclaimers.

Product data sheet

Rev. 3.0 — 28 March 2024

14 / 82

SL2S3003 Datasheet(PDF) 14 Page - NXP Semiconductors

SL2S3003 Datasheet(HTML) 14 Page - NXP Semiconductors

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82

Datasheet Download

Link URL