S32K144 SecOC Implementation - Freshness Value Manager and Anti-Replay Solutio

[Kishore_14]

Hardware: S32K144EVB
Current Setup: CSEc module operational with CMAC functions working.
Requirement: SecOC (Secure Onboard Communication) implementation.

For SecOC implementation on S32K144, does NXP provide:

1. Built-in Freshness Value Manager (FVM) for SecOC compliance?
2. Hardware-based anti-replay mechanisms suitable for SecOC?
3. Any other S32K144 features that support SecOC freshness management?

SecOC-specific requirements:
- Freshness value generation for message authentication
- Anti-replay attack protection for CAN messages
- Synchronization between ECUs for freshness values

1. Does S32K144 have built-in FVM or similar for SecOC?
2. Any NXP SecOC reference implementations or application notes?

[lukaszadrapa]

Hi @Kishore_14 

You don’t need anything special for SecOC. As long as the hardware can do AES‑128 CMAC, it’s sufficient. That’s the only crypto primitive SecOC actually uses. CSEc (SHE‑based) on the S32K is fully enough - it gives you HW‑accelerated AES‑CMAC and protected key slots, which is exactly what SecOC needs.

All the other CSEc features (secure boot MAC, key derivation, random number, etc.) is nice to have but SecOC doesn’t depend on it. Freshness values and anti‑replay counters are handled completely in software by the FVM. Hardware doesn’t provide any special counter for this. CSEc provides only features given by SHE specification.

Regards,

Lukas