{"id":13830711,"url":"https://github.com/Infineon/optiga-trust-m","last_synced_at":"2025-07-09T12:31:33.039Z","repository":{"id":41196152,"uuid":"171871329","full_name":"Infineon/optiga-trust-m","owner":"Infineon","description":"OPTIGA™ Trust M Software Framework","archived":false,"fork":false,"pushed_at":"2024-03-27T05:11:45.000Z","size":143095,"stargazers_count":107,"open_issues_count":9,"forks_count":47,"subscribers_count":24,"default_branch":"develop","last_synced_at":"2024-03-28T03:43:31.945Z","etag":null,"topics":["aes","brainpool","cryptography","ecc","ecdhe","ecdsa","hardware-acceleration","hardware-security","hsm","protected-i2c","public-key-cryptography","rsa","security-chip"],"latest_commit_sha":null,"homepage":"https://infineon.github.io/optiga-trust-m/","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Infineon.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2019-02-21T12:52:52.000Z","updated_at":"2024-04-23T12:49:56.356Z","dependencies_parsed_at":"2023-02-01T02:45:45.131Z","dependency_job_id":"d0190c44-55e5-4856-91e0-9e645392ed04","html_url":"https://github.com/Infineon/optiga-trust-m","commit_stats":null,"previous_names":[],"tags_count":32,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Infineon%2Foptiga-trust-m","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Infineon%2Foptiga-trust-m/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Infineon%2Foptiga-trust-m/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Infineon%2Foptiga-trust-m/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Infineon","download_url":"https://codeload.github.com/Infineon/optiga-trust-m/tar.gz/refs/heads/develop","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225539515,"owners_count":17485342,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aes","brainpool","cryptography","ecc","ecdhe","ecdsa","hardware-acceleration","hardware-security","hsm","protected-i2c","public-key-cryptography","rsa","security-chip"],"created_at":"2024-08-04T10:01:06.462Z","updated_at":"2024-11-20T11:31:17.334Z","avatar_url":"https://github.com/Infineon.png","language":"C","funding_links":[],"categories":["C"],"sub_categories":[],"readme":"# Infineon OPTIGA\u0026trade; Trust M\r\n\r\n[View this ReadMe online](https://github.com/Infineon/optiga-trust-m/blob/develop/README.md)\r\n\r\n## Quick navigation\r\n\r\n1. [Security Solution](#security-solution)\r\n    * [Description](#description)\r\n    * [Key Features and benefits](#key-features-and-benefits)\r\n    * [Features table](#features-table)\r\n    * [Provisioning Options (V1, V3, Express, MTR)](#provisioning-options-v1-v3-express-mtr)\r\n2. [Get Started](#get-started)\r\n    * [Boards](#boards)\r\n    * [Examples](#examples)\r\n    * [Software Framework overview](#software-framework-overview)\r\n    * [Evaluation and developement kits](#evaluation-and-developement-kits)\r\n3. [Documentation](#documentation)\r\n    * [Usefull articles](#usefull-articles)\r\n    * [Datasheet and Co.](#datasheet-and-co)\r\n    * [Board assembly recommendations](#board-assembly-recommendations)\r\n4. [Contributing](#contributing)\r\n5. [License](#license)\r\n\r\n## Security Solution\r\n\r\n### Description\r\n\r\n\u003cimg src=\"https://github.com/Infineon/Assets/blob/master/Pictures/optiga_trust_m_uson10.png\" width=\"300\" \u003e\r\n\r\nThis repository contains a target-agnostic Software Framework for the [OPTIGA™ Trust M](https://www.infineon.com/optiga-trust) security solution. It is a base for other application notes.\r\n\r\n**Be aware that this software comes without any security claims and shall be used for evaluation purpose.**\r\n\r\n### Key Features and Benefits\r\n\r\n* High-end security controller\r\n* Common Criteria Certified EAL6+ (high) hardware\r\n* Turnkey solution\r\n* Up to 10kB user memory\r\n* PG-USON-10 package (3 x 3 mm)\r\n* Temperature range (−40°C to +105°C)\r\n* I2C interface with Shielded Connection (encrypted communication)\r\n* Cryptographic support:\r\n  * ECC : NIST curves up to P-521, Brainpool r1 curve up to 512,\r\n  * RSA® up to 2048\r\n  * AES key up to 256 , HMAC up to SHA512\r\n  * TLS v1.2 PRF and HKDF up to SHA512\r\n* Crypto ToolBox commands for SHA-256, ECC and RSA® Feature, AES, HMAC and Key derivation\r\n* Configurable device security monitor, 4 Monotonic up counters\r\n* Protected(integrity and confidentiality) update of data, key and metadata objects\r\n* Hibernate for zero power consumption\r\n* Lifetime for Industrial Automation and Infrastructure is 20 years and 15 years for other Application Profiles  \r\n\r\n### Features table\r\n\r\n\u003ctable class=\"tg\"\u003e\r\n  \u003ctr\u003e\r\n    \u003cth class=\"tg-fymr\"\u003eFeatures\u003c/th\u003e\r\n    \u003cth class=\"tg-fymr\"\u003eSupported Curve/Algorithm\u003c/th\u003e\r\n    \u003cth class=\"tg-fymr\"\u003eV1\u003c/th\u003e\r\n    \u003cth class=\"tg-fymr\"\u003eV3\u003c/th\u003e\r\n  \u003c/tr\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd class=\"tg-c3ow\" rowspan=\"2\"\u003eECC\u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003eECC NIST P256/384 \u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e✓\u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e✓\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003eECC NIST P521, ECC Brainpool P256/384/512 r1\u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e\u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e✓\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd class=\"tg-c3ow\"\u003eRSA\u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003eRSA® 1024/2048 \u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e✓\u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e✓\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd class=\"tg-c3ow\" rowspan=\"3\"\u003eKey Derivation\u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003eTLS v1.2 PRF SHA 256 \u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e✓\u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e✓\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003eTLS v1.2 PRF SHA 384/512 \u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e \u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e✓\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003eHKDF SHA-256/384/512  \u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e \u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e✓\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd class=\"tg-c3ow\"\u003eAES\u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003eKey size - 128/192/256 (ECB, CBC, CBC-MAC, CMAC)\u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e \u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e✓\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd class=\"tg-c3ow\"\u003eRandom Generation\u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003eTRNG, DRNG, Pre-Master secret for RSA® Key exchange\u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e✓\u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e✓\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd class=\"tg-c3ow\"\u003eHMAC\u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003eHMAC with SHA256/384/512 \u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e \u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e✓\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd class=\"tg-c3ow\"\u003eHash \u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003eSHA256 \u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e✓\u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e✓\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd class=\"tg-c3ow\" rowspan=\"2\"\u003eProtected data (object) update (Integrity)\u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003eECC NIST P256/384\u003c/br\u003eRSA® 1024/2048 \u003c/br\u003eSignature scheme as ECDSA FIPS 186-3/RSA SSA PKCS#1 v1.5 without hashing \u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e✓\u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e✓\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd class=\"tg-c3ow\"\u003eECC NIST P521,\u003c/br\u003eECC Brainpool P256/384/512 r1\u003c/br\u003eSignature scheme as ECDSA FIPS 186-3/RSA SSA PKCS#1 v1.5 without hashing\u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e \u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e✓\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd class=\"tg-c3ow\"\u003eProtected Data/key/metadata update (Integrity and/or confidentiality)\u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003eECC NIST P256/384/521\u003c/br\u003eECC Brainpool P256/384/512 r1\u003c/br\u003eRSA® 1024/2048\u003c/br\u003eSignature scheme as ECDSA FIPS 186-3/RSA SSA PKCS#1 v1.5 without hashing\u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e \u003c/td\u003e\r\n    \u003ctd class=\"tg-0pky\"\u003e✓\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n\u003c/table\u003e\r\n\r\n### Provisioning Options (V1, V3, Express, MTR)\r\n\r\n#### Configurations\r\n\r\nThere are three main provisioning options/confgiurations availble:\r\n\r\n**Note: All three configuration options have no effect on the corresponding features. For example, OPTIGA\u0026trade; Trust M Express has the same features as OPTIGA\u0026trade; Trust M V3, also the same API and hostcode can be used to work with all three solutions.**\r\n\r\n1. **OPTIGA\u0026trade; Trust M V1/V3** - a provisioning configuration which comes as a standard for all shipped devices. Unless mentioned differently all OPTIGA\u0026trade;Trust M chips on the market have this configuration.\r\n    * [Sample OPTIGA\u0026trade; Trust M V1 Open Objects Dump](https://github.com/Infineon/optiga-trust-m/files/9281936/trust_m1_json.txt)\r\n    * [Sample OPTIGA\u0026trade; Trust M V3 Open Objects Dump](https://github.com/Infineon/optiga-trust-m/files/9281926/trust_m3_json.txt)\r\n    * [Product Webpage](https://www.infineon.com/cms/en/product/security-smart-card-solutions/optiga-embedded-security-solutions/optiga-trust/optiga-trust-m-sls32aia/)\r\n2. **OPTIGA\u0026trade; Trust M Custom** - a custom provisioning option done on demand upon reaching a MoQ. Fully customisable solution including Security Monitor Configuration \r\n    * Please get in touch with your local Infineon Sales Representative to get more information\r\n3. **OPTIGA\u0026trade; Trust M Express** - a provisioning configuration which can be ordered standalone. This variant comes with three certificates/private keys pre-provisioned by Infineon. Certificates and communication secrets data can be downloaded through the CIRRENT™ Cloud ID\r\n    * [Sample OPTIGA\u0026trade;Trust M Express Open Objects Dump](https://github.com/Infineon/optiga-trust-m/files/9281778/trust_express_sample2_json.txt)\r\n    * [Product Webpage](https://www.infineon.com/cms/en/product/security-smart-card-solutions/optiga-embedded-security-solutions/optiga-trust/optiga-trust-m-express/)\r\n4. **OPTIGA\u0026trade; Trust M MTR** - a provisioning configuration which can be ordered standalone. This variant comes with three certificates/private keys pre-provisioned by Infineon. The first certificate and key are meant to be used for Matter Device Attestation. Certificates and communication secrets data can be downloaded through Kudelski keySTREAM.\r\n    * [Sample OPTIGA\u0026trade;Trust M MTR Open Objects Dump](https://github.com/Infineon/optiga-trust-m/files/14259804/optiga_trust_m_mtr_object_dump.txt)\r\n    * [Product Webpage](https://www.infineon.com/cms/en/product/security-smart-card-solutions/optiga-embedded-security-solutions/optiga-trust/optiga-trust-m-mtr)\r\n\r\n#### Comparison Table\r\n\r\n\u003ctable\u003e\r\n\u003cthead\u003e\r\n  \u003ctr\u003e\r\n    \u003cth\u003e\u003c/th\u003e\r\n    \u003cth\u003eV1\u003c/th\u003e\r\n    \u003cth\u003eV3\u003c/th\u003e\r\n    \u003cth colspan=\"3\"\u003eExpress\u003c/th\u003e\r\n    \u003cth colspan=\"3\"\u003eMTR³ \u003c/th\u003e\r\n  \u003c/tr\u003e\r\n\u003c/thead\u003e\r\n\u003ctbody\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd\u003e\u003c/td\u003e\r\n    \u003cth\u003eCertificate - \u003c/br\u003ePrivate Key\u003c/th\u003e\r\n    \u003cth\u003eCertificate - \u003c/br\u003ePrivate Key\u003c/th\u003e\r\n    \u003cth colspan=\"3\"\u003eCertificate¹ - Private Key\u003c/th\u003e\r\n    \u003cth colspan=\"3\"\u003eCertificate¹ - Private Key\u003c/th\u003e\r\n  \u003c/tr\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd\u003e\u003ca href=\"https://github.com/Infineon/optiga-trust-m/wiki/Data-and-Key-Store-Overview\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eObject IDs\u003c/a\u003e\u003c/td\u003e\r\n    \u003ctd\u003eE0E0 - E0F0\u003c/td\u003e\r\n    \u003ctd\u003eE0E0 - E0F0\u003c/td\u003e\r\n    \u003ctd\u003eE0E0 - E0F0\u003c/td\u003e\r\n    \u003ctd\u003eE0E1 - E0F1\u003c/td\u003e\r\n    \u003ctd\u003eE0E2 - E0FC\u003c/td\u003e\r\n    \u003ctd\u003eE0E0 - E0F0\u003c/td\u003e\r\n    \u003ctd\u003eE0E1 - E0F1\u003c/td\u003e\r\n    \u003ctd\u003eE0E2 - E0FC\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd\u003e\u003ca href=\"https://github.com/Infineon/optiga-trust-m/blob/develop/documents/OPTIGA_Trust_M_Keys_And_Certificates_v3.10.pdf\" target=\"_blank\" rel=\"noopener noreferrer\"\u003ePKI\u003c/a\u003e Top Level\u003c/td\u003e\r\n    \u003ctd\u003e\u003ca href=\"https://github.com/Infineon/optiga-trust-m/raw/support/m1/certificates/Infineon%20ECC%20Root%20CA%20C%20v01%2000.crt\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eECC Root CA1\u003c/a\u003e\u003c/td\u003e\r\n    \u003ctd\u003e\u003ca href=\"https://pki.infineon.com/OptigaECCRootCA2/OptigaECCRootCA2.crt\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eECC Root CA2\u003c/a\u003e\u003c/td\u003e\r\n    \u003ctd\u003e\u003ca href=\"https://pki.infineon.com/OptigaECCRootCA2/OptigaECCRootCA2.crt\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eECC Root CA2\u003c/a\u003e\u003c/td\u003e\r\n    \u003ctd\u003e\u003ca href=\"https://pki.infineon.com/OptigaECCRootCA2/OptigaECCRootCA2.crt\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eECC Root  CA2\u003c/a\u003e\u003c/td\u003e\r\n    \u003ctd\u003e\u003ca href=\"https://pki.infineon.com/OptigaRSARootCA2/OptigaRSARootCA2.crt\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eRSA Root CA2\u003c/a\u003e\u003c/td\u003e\r\n    \u003ctd\u003e\u003ca href=\"https://pki.infineon.com/OptigaECCRootCA2/OptigaECCRootCA2.crt\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eECC Root CA2\u003c/a\u003e\u003c/td\u003e\r\n    \u003ctd\u003e\u003ca href=\"https://pki.infineon.com/OptigaECCRootCA2/OptigaECCRootCA2.crt\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eECC Root  CA2\u003c/a\u003e\u003c/td\u003e\r\n    \u003ctd\u003e\u003ca href=\"https://pki.infineon.com/OptigaRSARootCA2/OptigaRSARootCA2.crt\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eRSA Root CA2\u003c/a\u003e\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd\u003e\u003ca href=\"https://github.com/Infineon/optiga-trust-m/blob/develop/documents/OPTIGA_Trust_M_Keys_And_Certificates_v3.10.pdf\" target=\"_blank\" rel=\"noopener noreferrer\"\u003ePKI\u003c/a\u003e Intermediate Level\u003c/td\u003e\r\n    \u003ctd\u003e\u003ca href=\"https://github.com/Infineon/optiga-trust-m/raw/support/m1/certificates/Infineon%20OPTIGA(TM)%20Trust%20M%20CA%20101.crt\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eInt. CA 101\u003c/a\u003e\u003c/td\u003e\r\n    \u003ctd\u003e\u003ca href=\"https://github.com/Infineon/optiga-trust-m/blob/develop/certificates/Infineon%20OPTIGA(TM)%20Trust%20M%20CA%20300.crt\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eInt. CA 300\u003c/a\u003e\u003c/td\u003e\r\n    \u003ctd\u003e\u003ca href=\"https://pki.infineon.com/OptigaTrustEccCA306/OptigaTrustEccCA306.crt\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eInt. CA 306\u003c/a\u003e\u003c/td\u003e\r\n    \u003ctd\u003e\u003ca href=\"https://pki.infineon.com/OptigaTrustEccCA306/OptigaTrustEccCA306.crt\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eInt. CA 306\u003c/a\u003e\u003c/td\u003e\r\n    \u003ctd\u003e\u003ca href=\"https://pki.infineon.com/OptigaTrustRsaCA309/OptigaTrustRsaCA309.crt\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eInt. CA 309\u003c/a\u003e\u003c/td\u003e\r\n    \u003ctd\u003e\u003ca href=\"https://pki.infineon.com/OptigaTrustEccCA306/OptigaTrustEccCA306.crt\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eInt. CA 306\u003c/a\u003e\u003c/td\u003e\r\n    \u003ctd\u003e\u003ca href=\"https://pki.infineon.com/OptigaTrustEccCA306/OptigaTrustEccCA306.crt\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eInt. CA 306\u003c/a\u003e\u003c/td\u003e\r\n    \u003ctd\u003e\u003ca href=\"https://pki.infineon.com/OptigaTrustRsaCA309/OptigaTrustRsaCA309.crt\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eInt. CA 309\u003c/a\u003e\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd\u003e\u003ca href=\"https://github.com/Infineon/optiga-trust-m/blob/develop/documents/OPTIGA_Trust_M_Keys_And_Certificates_v3.10.pdf\" target=\"_blank\" rel=\"noopener noreferrer\"\u003ePKI\u003c/a\u003e Bottom Level: Key Algorithm\u003c/td\u003e\r\n    \u003ctd\u003eNIST P-256\u003c/td\u003e\r\n    \u003ctd\u003eNIST P-256\u003c/td\u003e\r\n    \u003ctd\u003eNIST P-256\u003c/td\u003e\r\n    \u003ctd\u003eNIST P-256\u003c/td\u003e\r\n    \u003ctd\u003eRSA2048\u003c/td\u003e\r\n    \u003ctd\u003eNIST P-256\u003c/td\u003e\r\n    \u003ctd\u003eNIST P-256\u003c/td\u003e\r\n    \u003ctd\u003eRSA2048\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd\u003ePossible to Readout\u003c/td\u003e\r\n    \u003ctd\u003eYes\u003c/td\u003e\r\n    \u003ctd\u003eYes\u003c/td\u003e\r\n    \u003ctd\u003eYes\u003c/td\u003e\r\n    \u003ctd\u003eWith PBS¹\u003c/td\u003e\r\n    \u003ctd\u003eYes\u003c/td\u003e\r\n    \u003ctd\u003eYes\u003c/td\u003e\r\n    \u003ctd\u003eYes\u003c/td\u003e\r\n    \u003ctd\u003eYes\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd\u003ePossible to Update\u003c/td\u003e\r\n    \u003ctd\u003eOnly Certificate\u003c/td\u003e\r\n    \u003ctd\u003eOnly Certificate\u003c/td\u003e\r\n    \u003ctd\u003eOnly Certificate with PBS¹ and Auth.Ref.¹\u003c/td\u003e\r\n    \u003ctd\u003eOnly Certificate with PBS¹ and Auth.Ref.¹\u003c/td\u003e\r\n    \u003ctd\u003eOnly Certificate with PBS¹ and Auth.Ref.¹\u003c/td\u003e\r\n    \u003ctd\u003eOnly Certificate: Always, if LcsO \u003c Op, else with PBS¹ and Auth.Ref.¹\u003c/td\u003e\r\n    \u003ctd\u003eOnly Certificate with PBS¹ and Auth.Ref.¹\u003c/td\u003e\r\n    \u003ctd\u003eOnly Certificate with PBS¹ and Auth.Ref.¹\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n  \u003ctr\u003e\r\n    \u003ctd\u003eDefault Lifecycle State\u003c/td\u003e\r\n    \u003ctd\u003eCreation\u003c/td\u003e\r\n    \u003ctd\u003eCreation\u003c/td\u003e\r\n    \u003ctd\u003eOperational\u003c/td\u003e\r\n    \u003ctd\u003eOperational\u003c/td\u003e\r\n    \u003ctd\u003eOperational\u003c/td\u003e\r\n    \u003ctd\u003eInitialization\u003c/td\u003e\r\n    \u003ctd\u003eOperational\u003c/td\u003e\r\n    \u003ctd\u003eOperational\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n    \u003ctr\u003e\r\n    \u003ctd\u003eCommon Name²\u003c/td\u003e\r\n    \u003ctd\u003eStatic\u003c/td\u003e\r\n    \u003ctd\u003eStatic\u003c/td\u003e\r\n    \u003ctd\u003eUnique\u003c/td\u003e\r\n    \u003ctd\u003eUnique\u003c/td\u003e\r\n    \u003ctd\u003eUnique\u003c/td\u003e\r\n    \u003ctd\u003eUnique\u003c/td\u003e\r\n    \u003ctd\u003eUnique\u003c/td\u003e\r\n    \u003ctd\u003eUnique\u003c/td\u003e\r\n  \u003c/tr\u003e\r\n\u003c/tbody\u003e\r\n\u003c/table\u003e\r\n\r\n¹ *Certificate, Platform Binding Secret (PBS) and the Authorization Reference (Auth.Ref.) can be downloaded from CIRRENT™ Cloud ID (Express) or Kudelski keySTREAM (MTR) by claiming a Reel QR- or Bar- Code*\r\n\r\n² *End Device Certificate Common Name has either the same value across all devices (Static), or has a chip-unique value (Unique)*\r\n\r\n³ *It is expected from the Customer to perform \"late-stage provisioning\" on the OPTIGA\u0026trade; Trust M MTR chips, i.e. to download the Matter Certificates (DAC/PAI) from Kudelski keySTREAM and inject into dedicated slots on the OPTIGA\u0026trade; Trust M*\r\n\r\nIn addition to the certificates and private keys each OPTIGA\u0026trade; Trust M Express and OPTIGA\u0026trade; Trust M MTR comes with a chip unique Platform Binding Secret¹ and an Authorization Reference¹. The latter are two unique per chip 64 bytes long data objects which serve the following purposes:\r\n\r\n- Platform Binding Secret (PBS) used to establish a Shielded Connection between a Host MCU and OPTIGA\u0026trade; Trust M. Should be transfered from the Cloud Service to the respective MCU to run a protected I2C connection; e.g. readout a protected Certificate located in the 0xE0E1 Object ID (see table above). For more details about  Shielded Connection read [here](https://github.com/Infineon/optiga-trust-m/wiki/Shielded-Connection-101).\r\n- Authorization Reference (Auth. Ref.). Used to update/change Certificate, PBS and the Authorization Reference itself. Similar to the PBS shall be tranfered to the Host MCU to be used. Find more details in the [Solution Reference Manual](documents/OPTIGA™%20Trust%20M%20Solution%20Reference%20Manual.md)\r\n\r\n## Get Started\r\n\r\n### Boards\r\n\r\n| [OPTIGA\u0026trade; Trust M Evaluation Kit](https://github.com/Infineon/getstarted-optiga-trust-m/tree/main/xmc4800_evaluation_kit) | [OPTIGA\u0026trade; Trust IoT Security Development Kit](https://github.com/Infineon/getstarted-optiga-trust-m/tree/main/psoc62_secure_development_kit) | [OPTIGA™ Trust M Shields in Combination with PSoC™ 62S2 Wi-Fi BT Pioneer Kit](https://github.com/Infineon/getstarted-optiga-trust-m/tree/main/psoc62_cy8ckit_mikrobus)\r\n|     :---:      |     :---:      |     :---:      |\r\n| \u003ca href=\"https://github.com/Infineon/getstarted-optiga-trust-m/tree/main/xmc4800_evaluation_kit\"\u003e\u003cimg src=\"https://github.com/Infineon/Assets/raw/master/Pictures/OPTIGA_Trust_M_Eval_Kit%2002.jpg\" width=\"480\"\u003e\u003c/a\u003e   | \u003ca href=\"https://github.com/Infineon/getstarted-optiga-trust-m/tree/main/psoc62_secure_development_kit\"\u003e\u003cimg src=\"https://github.com/Infineon/Assets/raw/master/Pictures/optiga_trust_iot_secdevkit.png\" width=\"480\"\u003e\u003c/a\u003e     |\u003ca href=\"https://github.com/Infineon/getstarted-optiga-trust-m/tree/main/psoc62_cy8ckit_mikrobus\"\u003e\u003cimg src=\"https://github.com/Infineon/Assets/raw/master/Pictures/PSoC62S2_OPTIGA_Trust_M_MikroBUS.png\" width=\"480\"\u003e\u003c/a\u003e     |\r\n\r\nGet started with the [OPTIGA™ Trust M evaluation kit](https://www.infineon.com/cms/en/product/evaluation-boards/optiga-trust-m-eval-kit/), with the [OPTIGA™ Trust IoT Security Development kit](https://www.infineon.com/cms/en/product/evaluation-boards/optiga-trust-m-iot-kit/) or with any one of the available OPTIGA\u0026trade; Trust M Shields ([Shield2Go](https://www.infineon.com/cms/en/product/evaluation-boards/s2go-security-optiga-m/), [Express Shield](https://www.infineon.com/optiga-trust-m-express-shield), [MTR Shield](https://www.infineon.com/cms/en/product/evaluation-boards/trust-m-mtr-shield/)) in combination with the [PSoC\u0026trade; 62S2 Wi-Fi BT Pioneer Kit](https://www.infineon.com/cms/en/product/evaluation-boards/cy8ckit-062s2-43012/) using [this](https://github.com/Infineon/getstarted-optiga-trust-m) Application Note.\r\n\r\n### Examples\r\n\r\n1. [Get started guide](https://github.com/Infineon/getstarted-optiga-trust-m)\r\n1. ModusToolbox™ Code Examples\r\n    - [OPTIGA™ Trust M: Cryptography](https://github.com/Infineon/mtb-example-optiga-crypto)\r\n    - [OPTIGA™ Trust M: MQTT Client](https://github.com/Infineon/mtb-example-optiga-mqtt-client)\r\n    - [OPTIGA™ Trust M: Power management](https://github.com/Infineon/mtb-example-optiga-power-management)\r\n    - [OPTIGA™ Trust M: Data management](https://github.com/Infineon/mtb-example-optiga-data-management)\r\n1. [Off-Chip TLS example (mbedTLS)](https://github.com/Infineon/mbedtls-optiga-trust-m)\r\n1. [Linux Command Line Interface](https://github.com/Infineon/linux-optiga-trust-m)\r\n1. Cloud:\r\n    1. [AWS FreeRTOS example](https://github.com/Infineon/amazon-freertos-optiga-trust)\r\n    1. [Microsoft Azure IoT example](https://github.com/Infineon/azure-esp32-optiga-trust/)\r\n1. [Zephyr OS driver](https://github.com/Infineon/zephyr)\r\n1. [Arduino library](https://github.com/Infineon/arduino-optiga-trust-m)\r\n1. [Personalize OPTIGA™ Trust](https://github.com/Infineon/personalize-optiga-trust)\r\n1. [Python package](https://github.com/Infineon/python-optiga-trust)\r\n1. [I2C Utilities](https://github.com/Infineon/i2c-utils-optiga-trust)\r\n\r\n### Software Framework overview\r\n\r\n![](https://github.com/Infineon/Assets/raw/master/Pictures/optiga_trust_m_system_block_diagram_v4.png)\r\n\r\n1. See [Trust M Crypt API](https://github.com/Infineon/optiga-trust-m/wiki/Trust-M-Crypt-API) and [Trust M Util API](https://github.com/Infineon/optiga-trust-m/wiki/Trust-M-Util-API)  to know more about CRYPT and UTIL modules\r\n2. Information about the OPTIGA™ Trust M Command Library (CMD) can be found in the [Solution Reference Manual](documents/OPTIGA_Trust_M_Solution_Reference_Manual_v3.60.pdf)\r\n    In the same document you can find explanation of all Object IDs (OIDs) available for users as well as detailed technical explanation for all features and envisioned use cases.\r\n3. Infineon I\u003csup\u003e2\u003c/sup\u003eC Protocol implementation details can be found [here](documents/Infineon_I2C_Protocol_v2.03.pdf)\r\n4. Platform Abstraction Layer (PAL) overview and Porting Guide are presented in the [Wiki](https://github.com/Infineon/optiga-trust-m/wiki/Porting-Guide)\r\n\r\nFor more information please refer to the [Wiki page](https://github.com/Infineon/optiga-trust-m/wiki) of this project\r\n\r\n### Evaluation and developement kits\r\n\r\nExternal links, open in the same tab.\r\n\r\n* [OPTIGA™ Trust M evaluation kit](https://www.infineon.com/cms/en/product/evaluation-boards/optiga-trust-m-eval-kit/)\r\n* [OPTIGA™ Trust M Shield2Go](https://www.infineon.com/cms/en/product/evaluation-boards/s2go-security-optiga-m/)\r\n\r\n#### Notes to the S2Go Security OPTIGA\u0026trade;Trust M\r\n\r\n* Supply voltage VCC is max. 5.5 V, please refer to the OPTIGA™ Trust M datasheet for more details about maximum ratings\r\n* Ensure that no voltage applied to any of the pins exceeds the absolute maximum rating of VCC + 0.3 V\r\n* Pin out on top (head) is directly connected to the pins of the OPTIGA™ Trust M\r\n* If head is broken off, only one capacitor is connected to the OPTIGA™ Trust M\r\n\r\n  \u003cdetails\u003e\r\n  \u003csummary\u003e S2Go Security OPTIGA\u0026trade; M Pinout\u003c/summary\u003e\r\n  \u003cimg src=\"https://github.com/Infineon/Assets/blob/master/Pictures/optiga_trust_m_shield2go_pinout.png\" alt=\"drawing\"/\u003e\r\n  \u003c/details\u003e\r\n\r\n  \u003cdetails\u003e\r\n  \u003csummary\u003e S2Go Security OPTIGA\u0026trade; M Schematic\u003c/summary\u003e\r\n  \u003cimg src=\"https://github.com/Infineon/Assets/blob/master/Pictures/optiga_trust_m_shield2go_schematics.png\" alt=\"drawing\"/\u003e\r\n  \u003c/details\u003e\r\n\r\n#### Notes to the OPTIGA\u0026trade;Trust M [Variant] Shields\r\n\r\n* The product variant can be identified through the configuration LED.\r\n* The design of the Shield is for 3V3 VCC\r\n* Absolute max. rating of VCC is 5.5 V, please refer to the OPTIGA™ Trust M datasheet for more details about maximum ratings\r\n* Ensure that no voltage applied to any of the pins exceeds the absolute maximum rating of VCC + 0.3 V\r\n* Pin out of the shield is directly connected to the pins of the OPTIGA™ Trust M\r\n\r\n  \u003cdetails\u003e\r\n  \u003csummary\u003e OPTIGA\u0026trade; Trust M [Variant] Shield Pinout\u003c/summary\u003e\r\n  \u003cimg src=\"https://github.com/Infineon/Assets/blob/master/Pictures/optiga_trust_m_shield_pinout.png\" alt=\"drawing\"/\u003e\r\n  \u003c/details\u003e\r\n\r\n  \u003cdetails\u003e\r\n  \u003csummary\u003e OPTIGA\u0026trade; Trust M [Variant] Shield Schematic\u003c/summary\u003e\r\n  \u003cimg src=\"https://github.com/Infineon/Assets/blob/master/Pictures/optiga_trust_m_shield_mbus_schematics.png\" alt=\"drawing\"/\u003e\r\n  \u003c/details\u003e\r\n\r\n## Documentation\r\n\r\n### Usefull articles\r\n\r\n* [Initialisation hints (Wiki)](https://github.com/Infineon/optiga-trust-m/wiki/Initialisation-hints)\r\n* [Porting guide (Wiki)](https://github.com/Infineon/optiga-trust-m/wiki/Porting-Guide)\r\n* [Crypto performance (Wiki)](https://github.com/Infineon/optiga-trust-m/wiki/Crypto-Performance)\r\n* [In which form does OPTIGA\u0026trade;return keys and signatures? (Wiki)](https://github.com/Infineon/optiga-trust-m/wiki/Data-format-examples)\r\n* [Code Footprint (Wiki)](https://github.com/Infineon/optiga-trust-m/wiki/Code-Footprint)\r\n* [Device Error Codes (Wiki)](https://github.com/Infineon/optiga-trust-m/wiki/Device-Error-Codes)\r\n* [Protected Update for Data Objects](https://github.com/Infineon/optiga-trust-m/wiki/Protected-Update-for-Data-Objects)\r\n* [Shielded Connection (Wiki)](https://github.com/Infineon/optiga-trust-m/wiki/Shielded-Connection-101)\r\n* **User API**\r\n  * [Crypt API (Wiki)](https://github.com/Infineon/optiga-trust-m/wiki/Trust-M-Crypt-API)\r\n  * [Util API (Wiki)](https://github.com/Infineon/optiga-trust-m/wiki/Trust-M-Util-API)\r\n* [Hardware-Security: \"Einfach (und) Sicher\" (external link, opens in the same tab)](https://vimeo.com/279839814) in German, [Slides](https://github.com/Infineon/Assets/blob/master/PDFs/2018-06-04_Building-IoT_HW-Sec_Lesjak_vFinal.pdf) in English\r\n\r\n### Datasheet and Co.\r\n\r\nFor high level description and some important excerpts from the documentation please refer to [Wiki page](https://github.com/Infineon/optiga-trust-m/wiki)\r\n\r\nOther downloadable PDF documents can be found below:\r\n\r\n1. [OPTIGA™ Trust M Datasheet v3.61](documents/OPTIGA_Trust_M_Datasheet_v3.61.pdf) (PDF)\r\n2. [OPTIGA™ Trust M Solution Reference Manual v3.60](documents/OPTIGA_Trust_M_Solution_Reference_Manual_v3.60.pdf) (PDF)\r\n3. [OPTIGA™ Trust M Keys and Certificates v3.10](documents/OPTIGA_Trust_M_Keys_And_Certificates_v3.10.pdf) (PDF)\r\n4. [OPTIGA™ Trust Config Guide v2.20](documents/OPTIGA_Trust_M_ConfigGuide_v2.2.pdf) (PDF)\r\n5. [Infineon I2C protocol specification v2.03](documents/Infineon_I2C_Protocol_v2.03.pdf) (PDF)\r\n\r\n### Board assembly recommendations\r\n\r\nIf you are planning to integrate OPTIGA™ Trust M in your PCB design have a look at the recommendations found [here (external, opens in the same tab)](https://www.infineon.com/dgdl/Infineon-Additional_product_information_SON_packages-AN-v00_01-EN.pdf?fileId=db3a30433e82b1cf013e82faab2000e5).\r\n\r\n\r\n## Contributing\r\n\r\nPlease read [CONTRIBUTING.md](CONTRIBUTING.md) for details on our code of conduct, and the process for submitting pull requests to us.\r\n\r\n## License\r\nThis project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FInfineon%2Foptiga-trust-m","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FInfineon%2Foptiga-trust-m","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FInfineon%2Foptiga-trust-m/lists"}