topic Re: PN5190 security in Hardware

PN5190 security

alaahamo — Mon, 16 Sep 2024 08:36:52 GMT

Hello NXP community,

I’m currently working with the PN5190 frontend and have a couple of questions regarding its SPI communication with the microcontroller.

Is SPI communication encrypted when exchanging sensitive data?
Can we store the secret key for DESFire directly on the frontend? If not, what is the recommended method for secure key storage? Additionally, I couldn’t find detailed documentation on the encryption technology used for communication and key management. Could you point me in the right direction for this?

Thanks in advance for your help!

Re: PN5190 security

EduardoZamora — Wed, 18 Sep 2024 21:40:10 GMT

Hello @alaahamo,

A pure SPI communication based on Commands, Responses and Events is used to connect with host controller for configuration, NFC data exchange and high-level NFC protocol implementation. More information on this can be found in PN5190 instruction layer.

Key handling will depend on your setup/hardware; for example, you could consider using a MIFARE SAM. These devices offer secure storage and strong protection of highly sensitive keys.

If you are looking for information about DESFire devices, as some of the information and software supporting DESFire is under NDA (Non-Disclosure Agreement), the information is not public, and it is secured under Secure Files. Please consult the Non-Disclosure Agreement FAQs and Secure Access Rights | NXP Semiconductors for more information.

Regards,
Eduardo.

Re: PN5190 security

alaahamo — Thu, 19 Sep 2024 08:22:36 GMT

Hi Eduardo,

Thank you for your response.

I was searching for the way the keys are exchanged between the microcontroller and the frontend.
I think, in the lib they are using an encryption algorithm, when the key are in exchange process. My question is: Which kind of encryption algorithm is used there? There is no documentation regarding the SPI encryption.
Are the keys are shared and static? Do we have to change them?

Best regards,

Hamo

Re: PN5190 security

EduardoZamora — Thu, 19 Sep 2024 20:55:23 GMT

Hi,

What are the keys you are referring to? Some auth processes may involve calculations, and not a raw key exchange. However, it depends on the PICC being used, and this information is under NDA and secured in the Secure Files.

Regards,
Eduardo.

Re: PN5190 security

alaahamo — Fri, 20 Sep 2024 09:24:39 GMT

Hi,

I'm referring to the PICC_MasterKey_DES and PICC is used.

Regrads,
Hamo

Re: PN5190 security

EduardoZamora — Fri, 20 Sep 2024 18:22:17 GMT

Hi,

Assuming that you are working with MIFARE DESFire EV3 devices, information is not public and may be under Secure Files. For more information, please refer to the Secure Access Rights | NXP Semiconductors.

Regards,
Eduardo.