Running in software simulation — all crypto done by the Python
cryptography library. Swap one import to go hardware.
JTAG State Machine
LOCKED
LOCKED
↓ ECDSA-P256 auth
UNLOCKED
↓ relock / timeout / reset / tamper
LOCKED
Authentication Flow
ECDSA-P256
1
GET_CHALLENGE — software requests a fresh nonce
2
CHALLENGE — controller returns 32-byte nonce + algo
3
SUBMIT_RESPONSE — software signs nonce with private key
4
ECDSA verify — controller verifies sig against enrolled pubkey
5
AUTH_SUCCESS / AUTH_FAIL — session token issued or rejected
Session & Lockout Status
JTAG State
LOCKED
Active Role
—
Session Token
—
TTL Remaining
—
Session lifetime
0%
Auth Attempts
0 / 5
Lockout
Inactive
Lifecycle
PRODUCTION
Entropy Source
secrets.token_bytes()
Crypto Backend
ATECCSimulator (SW)
Tamper-Evident Audit Log
Hash-chained
Each entry includes:
prev_hash → HMAC-SHA256(prev_hash + event + ts).
No CLEAR API exists. Entries evict FIFO at 1000 max.
Role-Based Access Control
| Operation | READ_ONLY | DIAGNOSTICS | ENGINEERING |
|---|---|---|---|
| READ_REGISTER | ✓ | ✓ | ✓ |
| READ_MEMORY | ✓ | ✓ | ✓ |
| RUN_DIAGNOSTIC | ✗ | ✓ | ✓ |
| WRITE_REGISTER | ✗ | ✗ | ✓ |
| WRITE_MEMORY | ✗ | ✗ | ✓ |
| FLASH_FIRMWARE | ✗ | ✗ | ✓ |
| READ_KEYS 🔒 | ✗ | ✗ | ✗ |
| DISABLE_SECURITY 🔒 | ✗ | ✗ | ✗ |
| BYPASS_SECURE_BOOT 🔒 | ✗ | ✗ | ✗ |
🔒 PROTECTED_OPS — always denied regardless of role or authentication state.
Component Mapping
Phase 1 — Simulation
Python 3.10+ process
ATECCSimulator (SW ECDSA)
secrets.token_bytes() PRNG
In-memory key store
localhost TCP RPC
pytest 172 tests
Phase 2 — Hardware
STM32F407G-DISC1
ATECC608A HW engine
ATECC608A TRNG (SP 800-90B)
Fused key slots (NVM)
SPI/I²C + pyOCD
STM32 RDP hardware gate
Device Lifecycle
DEVELOPMENT
→
PRODUCTION
→
SERVICE
→
DECOMMISSION