DS1963S

20 of 37

performing an Authenticate Host command should have first performed the Compute Challenge function

in order to fill the scratchpad with pseudo-random data.

Compute SHA Functions (continued) Figure 8

SHA Engine computes

Message Authentication Code

of secret of the selected page,

data of the selected page and

15 bytes of scratchpad data

SHA Engine computes

Message Authentication Code

data of the selected page and

15 bytes of scratchpad data

of secret of the selected page,

SHA Engine computes

Message Authentication Code

of secret of selected page,

data of the selected page,

3 bytes of scratchpad data

Serial Number of device and

PRNG Counter,

Page =

0 or 8 ?

Y

Page =

0 or 8 ?

Page =

0 or 8 ?

Y

Y

N

N

N

SUCCESS

SUCCESS

SUCCESS

FAIL

FAIL

N

C3h

Sign Data

Page

N

CCh

Compute

Challenge

AAh

Authenticate

Host

?

N

?

º

Ù

M = MATCH

(TA1[7:6]

SEC#[2:1])

AUTH = 0

X = 0 ; CHLG = 0

T4:T0 = 00000b

AUTH = 0 ; MATCH = 0

M = 0 ; X = 1; CHLG = 1

T4:T0 = 00000b

?

HIDE = 1 ; MATCH = 0

M = 0 ; X = 1

T4:T0 = 00000b

CHLG = 1 ?

N

º

AUTH = (TA1[7:5]

SEC#)

CHLG = 0

To Compute SHA Command (Figure 7)

Y

From previous page

Y

Y

Y

SEC# = TA1[7:5]

The Compute Challenge function stores the upper 3 bits of TA1 in a latch called SEC#, which is next

used with the Authenticate Host function. Only if Authenticate Host and Compute Challenge call upon

the same memory page (same secret) will the AUTH-flag be set. This prevents the AUTH-flag from

being set with the secret of another page that may belong to a different application or service provider.

The two most significant bits of SEC# are also used with Validate Data Page, Sign Data Page and Read

Authenticated Page when determining the M control bit. This makes a difference only for those

applications that use host/user authentication. The M control bit is only set if the MATCH-flag is set and

the target memory page is adjacent to the page that was used for authentication. This allocates one pair of

secrets (0 and 1, 2 and 3, 4 and 5, 6 and 7) and the pages associated with these secrets to one service

provider.