DS2705_V01 MAXIM | Alldatasheet
Document overview
- Manufacturer or author: Provided By ALLDATASHEET.COM(FREE DATASHEET DOWNLOAD SITE)
- PDF pages: 18
Technical content
The DS2705 provides the master side of a Secure Hash Algorithm (SHA) based token authentication scheme. Hardware-based SHA authentication allows for security without the added cost and complexity of a microprocessor-based system. Batteries and other accessories are authenticat ed using a single contact through the Dallas 1-Wire ® interface. Authentication is performed on demand or automatically, with the pass/fail status reported on open-drain output pins to signal the charge system and/or drive LEDs. The DS2705 stores a predetermined challenge-and- response pair in nonvolatile (NV) EEPROM. The DS2705 works in conjunction with Dallas Battery Management SHA-1 token products, including the DS2703 and DS2704.
APPLICATIONS
Portable DVD and Media Players Cradle and Accessory Chargers Cell Phones/Smartphones PIN CONFIGURATION
FEATURES
Initiates Challenge-and-Response Authentication based on the SHA-1 Algorithm Dallas 1-Wire Master/Slave Interface Operates at Standard and Overdrive Speeds Input and Output pins for Initiating Challenge and Reporting Authentication Pass/Fail Programmable Configuration Operates from 2.5V to 5.5V Supply Tiny μMAX Package (Pb-Free) APPLICATION EXAMPLE
ORDERING INFORMATION
PART TEMP RANGE MARKING PIN-PACKAGE DS2705U+ -20°C to +85°C D2705 μMAX DS2705U+/T&R -20°C to +85°C D2705 DS2705U+ in Tape-and-Reel DS2705 SHA-1 Authentication Master www.maxim-ic.com μMAX PASS VDD MDQ SDQ VPP VSS FAIL CHAL + Denotes lead-free package. 1-Wire is a registered trademark of Dallas Semiconductor.
DS2705: SHA-1 Authentication Master 2 of 18 ABSOLUTE MAXIMUM RATINGS Voltage Range on All Pins (Except VPP), Relative to VSS -0.3V to +5.5V Voltage Range on VPP Pin, Relative to VSS -0.3V to +18V Continuous Source Current, MDQ 20mA Operating Temperature Range -40°C to +85°C Storage Temperature Range -55°C to +125°C Soldering Temperature See IPC/JE DEC J-STD-020A Specification Stresses beyond those listed under “Absolute Maximum Ratings” may c ause permanent damage to the device. These are stress rating s only, and functional operation of the device at these or any other conditions beyond those i ndicated in the operational sections of the specifications is not implied. Exposure to the absolute maximum rating conditions for extended periods may affect device. DC ELECTRICAL CHARACTERISTICS (2.5V ≤ VDD ≤ 5.5V, TA = -20°C to +85°C.) PARAMETER SYMBOL CONDITIONS MIN TYP MAX UNITS IDD1 Active mode, MDQ low, IO_MDQ = 0 2.5 mA IDD2 Active mode, MDQ idle, IO_MDQ = 0 90 130 μA Sleep mode, IO_MDQ = 0 (Note 2) 1 3 μA Supply Current IDD3 -20°C ≤ TA ≤ 70°C Sleep mode, IO_MDQ = 0 (Note 2) 1 2 μA Programming Voltage: VPP VPP Program pulse (Notes 1, 3) 14.5 15.0 V Input Logic High: MDQ, SDQ, CHAL VIH (Note 1) 1.8 V Input Logic Low: MDQ, SDQ, CHAL VIL (Note 1) 0.6 V Output Logic Low: MDQ, SDQ V OL1 IOL = 4mA (Note 1) 0.4 V Output Logic Low: PASS, FAIL VOL2 IOL = 10mA (Note 1) 0.4 V Pulldown: VPP IPD1 300 μA Pulldown: SDQ, CHAL I PD2 (Note 5) 0.125 μA IOH Communication mode (Note 6) 0.25 2.5 mA Pullup: MDQ VOH Computation mode IOH = 2.0mA (Note 7) VDD - 0.1 V Input Capacitance: MDQ, SDQ C IN 60 pF EEPROM RELIABILITY SPECIFICATION (2.5V ≤ VDD ≤ 5.5V, TA = -20°C to +85°C.) PARAMETER SYMBOL CONDITIONS MIN TYP MAX UNITS EEPROM Write Time t EEW (Note 3) 15 ms EEPROM Write Endurance N EEC (Notes 3, 4) 1,000 Cycles
DS2705: SHA-1 Authentication Master 3 of 18 AC ELECTRICAL CHARACTERISTICS: MASTER 1-Wire INTERFACE (2.5V ≤ VDD ≤ 5.5V, TA = -20°C to +85°C.) PARAMETER SYMBOL CONDITIONS MIN TYP MAX UNITS STANDARD BUS TIMING Time Slot t MSLOT (Note 10) 90 μs Recovery Time t MREC (Note 10) 7.5 10 12.5 μs Write-0 Low Time t MLOW0 (Note 10) 88.5 μs Write-1 Low Time t MLOW1 (Note 10) 1.05 1.5 2.25 μs Read-Data Sample Window t MRDV (Note 10) 4.0 5.5 7.0 μs Reset-Time Low t MRSTL (Note 10) 510 680 850 μs Presence-Detect High t MPDH (Note 10) 2 75 μs Presence-Detect Low t MPDL (Note 10) 2 400 μs OVERDRIVE BUS TIMING Time Slot t MSLOT (Note 10) 12 μs Recovery Time t MREC (Note 10) 1 2 2.5 μs Write-0 Low Time t MLOW0 (Note 10) 10.5 μs Write-1 Low Time t MLOW1 (Note 10) 0.35 0.5 0.65 μs Read-Data Sample Window t MRDV (Note 10) 1.1 1.5 1.9 μs Reset-Time Low t MRSTL (Note 10) 53 70 88 μs Presence-Detect High t MPDH (Note 10) 2 7 μs Presence-Detect Low t MPDL (Note 10) 2 41 μs
DS2705: SHA-1 Authentication Master 4 of 18 AC ELECTRICAL CHARACTERISTICS: SLAVE 1-Wire INTERFACE (2.5V ≤ VDD ≤ 5.5V, TA = -20°C to +85°C.) PARAMETER SYMBOL CONDITIONS MIN TYP MAX UNITS STANDARD BUS TIMING Time Slot t SLOT 60 120 μs Recovery Time t REC 1 μs Write-0 Low Time t LOW0 60 120 μs Write-1 Low Time t LOW1 1 15 μs Read-Data Valid t RDV 15 μs Reset-Time High t RSTH 480 μs Reset-Time Low t RSTL 480 960 μs Presence-Detect High t PDH 15 60 μs Presence-Detect Low t PDL 60 240 μs OVERDRIVE BUS TIMING Time Slot t SLOT 6 16 μs Recovery Time t REC 1 μs Write-0 Low Time t LOW0 6 16 μs Write-1 Low Time t LOW1 1 2 μs Read-Data Valid t RDV 2 μs Reset-Time High t RSTH 48 μs Reset-Time Low t RSTL 48 80 μs Presence-Detect High t PDH 2 6 μs Presence-Detect Low t PDL 8 24 μs
DS2705: SHA-1 Authentication Master 5 of 18 AC ELECTRICAL CHARACTERISTICS (2.5V ≤ VDD ≤ 5.5V, TA = -20°C to +85°C.) PARAMETER SYMBOL CONDITIONS MIN TYP MAX UNITS Programming Pulse Width t PPW 17 ms Programming Pulse Rise Time t PPR (Note 8) 0.5 5 μs Programming Pulse Fall Time t PPF (Note 8) 0.5 5 μs Strong Pullup Delay Time t SPUD 2 10 μs Strong Pullup Period t SPUP 30.25 34.00 48.00 ms Challenge Delay Time t CHD 45 65 85 ms Authentication Attempt Time t AAT (Note 9) 61 490 ms FAIL Pin Pulse Frequency tFPF FOM = 1, 50% duty cycle 1.5 2 2.5 Hz Note 1: All voltages are referenced to V SS. Note 2: IDD3 Sleep mode conditions: CHAL pin inactive OR (CHAL active AND (PAA = 0 AND PPT = 00 AND FOM = 0 AND Initial Authentication sequence complete)) [Above conditions disable the internal oscillator] Note 3: Programming temperature range is TA = 0°C to 50°C. Note 4: 5 years data retention at 70°C Note 5: If CHAL pin left unconnected, CHP bit = 0 required for an authentication attempt to be initiated on power up. See Table 1. Note 6: Typical Communication mode MDQ pullup behavior equivalent to 3kΩ resistor. Note 7: Typical Computation mode MDQ pullup behavior approximates a 50Ω resistor. Note 8: Exceeding maximum rise and fall time specifications may affect device reliability. Note 9: tAAT = Retries per Attempt x (264bits x 90μs + 3 x (tMRSTL + tRSTH) + tSPUD) = [1 to 8] x (23.7ms + 3.54ms + 34ms) MAX[7 retries]: 490ms, MIN[no retries]: 61ms with standard timings Note 10: 1. 1-Wire Master timings based on ± 25% clock tolerance from nominal. 2. t RPDT [defined in design documentation] = tMRSTL + tMRSTH 3. t MPDL-MAX = tMRSTH-MIN – tMPDH-MAX, represents the maximum presence pulse low time allowed from the slave. 4. Bus rise time of ~1 μs required to settle to logic high by tMRDV after MDQ released at tMLOW1 PIN DESCRIPTION PIN μMAX TDFN SYMBOL FUNCTION 1 1 CHAL Challenge Strobe Input Pin. Initiates authentication. Active level/edge set by CHP bit. 2 2 PASS Authentication “PASS” Result Open-Drain Output Pin 3 3 FAIL Authentication “FAIL” Result Open-Drain Output Pin (Programmable As Low Or Pulse) 4 4 VSS Supply Return Pin, GND Reference for Logic Signals 5 5 VPP EEPROM Programming Voltage Input 6 6 SDQ Slave Serial interface Data I/O Pin. Bidirectional data transmit and receive at 16kbps or 143kbps. Bus master must provide a weak pullup. 7 7 MDQ Master Serial interface Data I/O Pin. Bidirectional data transmit and receive at 16kbps or 143kbps. Provides a weak pullup in communication mode and strong pullup in computation mode. 8 8 VDD Supply Input Pin. Bypass to VSS with 0.1μF capacitor.
Figure 2. Typical Application Circuit
- CHAL pin at the active logic level on IC power-up (detected after challenge delay time tCHD). Positive or
negative logic level is determined by the CHP bit.
- CHAL pin edge trigger after power-up period. Positi ve or negative edge trigger is determined by the CHP
- Detection of Asynchronous 1-Wire Presence Pulse by insertion of battery with 1-Wire device (token).
- Periodic Authentication Attempt issuing a 1-Wire Rese t on MDQ to test for presence of a 1-Wire token.
CHP bit. Table 2 shows the timing and sequence of detecting presence with an edge on CHAL.
Table 1. Presence Detection/Authentication on Power-up Using CHAL Pin RTA1:0 bits. Minimum time is tSHA, maximum time is 8*tSHA. Table 2. Insertion Detection/Authentication Using Transition On CHAL Pin removed. Table 3 shows the sequence and display activity for presence detection on MDQ. Table 3. Asynchronous And Periodic Presence Detection Using MDQ Pin
DS2705: SHA-1 Authentication Master 9 of 18 AUTHENTICATION SEQUENCE Following the detection of the battery, the DS2705 initiates the authentication sequence. The sequence is executed in whole each time authentication is initiated. See Figure 4. 1. Test for presence with 1-Wire RESET. 2. Issue SKIP ROM (SKIP NET ADDRESS) command. 3. Issue Write Challenge command with 64-bit Challenge data. 4. Issue Compute MAC without ROMID command to SHA-1 token. 5. Provide strong pullup on DQ output. 6. Issue 8 write 0 timeslots. 7. Issue read time slots to receive MAC from token. 8. Compare local and token MAC results. 9. If configured for multiple attemp ts, re-try until authentication complete. 10. Test for presence with 1-Wire RESET. 11. Update status on PASS or FAIL pins. Note: If the DS2705 does not receive a presence pulse after presence has been established, or the presence test in step 9. fails, then the status is reported as not present with both the PASS and FAIL pins hi-Z. PREPROGRAMMED CHALLENGE AND RESPONSE A challenge response authentication system does not requir e a truly random set of challenges. The set of unique challenges must be sufficiently large that it precludes t he use of a lookup table type of attack. If a large enough set of unique challenges is dispersed over a population of portable devices, t hen each portable device does not need to store the secret key and duplicate the computation of the MAC. It need only store one challenge response pair to provide a practical barrier to battery clones. This system requires that every battery contain the secret key and SHA-1 algorithm so that it is compatible with any portable device it might be required to power. The DS2705 stores the preprogrammed challenge and response MAC. This serves to lo wer the cost and increase the secrecy of the key since the key does not have to be programmed into the DS2705. Dallas Semiconductor recommends not using any challenge response pair where either the challenge or MAC is all ‘0’s or all ‘1’s to prevent accidental authentication of an open or shorted communication bus.
(64-bit) challenge to the remote token in preparation for a Compute MAC command. Figure 3. Write Challenge (MDQ) Compute MAC without ROM ID [36h, XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX]. The Compute MAC command executes a MAC computation in the remote token and reads back the 20-byte result. Figure 4. Compute and Return MAC (MDQ)
8 Write 0
160 Read Time Slots
captured by observing bus traffic. recommended to configure the DS2705 for at least one retry. CHAL pin returning to inactive logic level. Table 4. PASS/FAIL Outputs
0 Hi-Z LOW Complete: Fail 1 Hi-Z Pulse
from floating during normal operation.
Table 5. Configuration Register PASS output hi-Z until authentication complete. presence not detected, status outputs are cleared to hi-Z. hi-Z and status flags are cleared to zero if presence not detected.
1 Yes
Authentication sequence initiated tCHD ms delay after Presence Detect from token.
0 High to low transition; active low
1 Low to high transition; active high
0 FAIL pin held low
1 FAIL pin pulsed low at 2Hz 50% duty cycle
0 Standard 1-wire communication (Master and Slave)
1 Overdrive 1-wire communi cation (Master and Slave)
locations inside the DS2705. Writing any other value to the lock bits will perform no operation.
response and configuration parameters. Addresses desig nated as “Reserved” typically return FFh when read. programming pulse is required on the VPP pin. Figure 5. EEPROM Access via Shadow RAM Table 6. Memory Map sequence, and 1-Wire signaling. the DS2705 as a slave on the SDQ pin, separate output and input pins can be connected together. pulse, which effectively terminates the transaction.
Figure 6. 1-Wire Bus Interface Circuitry, DS2705 as Slave command. It is preserved on the DS2705 for compatibility with multidrop enabled slaves such as the DS2703/4. shadow. See the Memory section for more details.
command is required to transfer data from the shadow to the EEPROM. See the Memory section for more details. complete. A reset on SDQ at any time during the copy sequence will prematurely terminate the operation. Figure 7. Copy EEPROM Sequence ‘0’s during copy, ‘1’s afterwards. Recall Data [B8h]. This command recalls the contents of all EEPROM cell loca tions to the shadow RAM memory. attempt is in progress on the MDQ pin.
Table 7. Slave Function Commands
and read data. The 1-Wire bus master initiates all these types of signaling except the presence pulse. waits for tPDH and then transmits the presence pulse for tPDL. Figure 8. 1-Wire Initialization Sequence pulled low and held low for the duration of the write-time slot. A read-time slot is initiated when the bus master pulls the 1-Wire bus line from a logic-high level to a logic-low level. specifications in the Electrical Characteristics table for more information.
DS2705: SHA-1 Authentication Master 18 of 18 Figure 9. 1-Wire Write and Read-Time Slots
PACKAGE INFORMATION
(For the latest package outline information, go to www.maxim-ic.com/DallasPackInfo.)