SWCU195A December 2024 – May 2025 CC2744R7-Q1 , CC2745P10-Q1 , CC2745R10-Q1 , CC2745R7-Q1 , CC2755R10
If the SACI_CMD_DEBUG_REQ_KEY_ID command returns a 64-bit key ID, the host must use this command to request the 40 byte debug challenge vector.
The content of the challenge is configured via the Scfg.debugAuthCfg.challengeVector.
If Scfg.debugAuthCfg.challengeVector.lifetime = 0xF1A1A5A5 (SCFG_DBGAUTH_EPHEMERAL_LIFETIME)
The challenge vector will contain a cryptographically random number causing no two requested vectors to be identical.
If Scfg.debugAuthCfg.challengeVector.lifetime = 0x51445A5A (SCFG_DBGAUTH_ENDLESS_LIFETIME)
The challenge vector will not contain a cryptographically random number allowing every requested vector to be identical. This depends on the value of Scfg.debugAuthCfg.challengeVector.deviceConst.
If Scfg.debugAuthCfg.challengeVector.deviceConst= 0x3262A5A5 (SCFG_DBGAUTH_DEVICE_MAC_CONST)
The challenge vector will contain the device specific MAC address causing no two devices to produce the same challenge vector
If Scfg.debugAuthCfg.challengeVector.deviceConst = 0x62BB5A5A (SCFG_DBGAUTH_DEVICE_ZERO_CONST)
The challenge vector will not contain the device specific MAC address causing every requested vector from device to device to produce the same vector. This depends on the value of Scfg.debugAuthCfg.challengeVector.lifetime.
This command will trigger the start of the debug auth process. This process shall not be interrupted by non debug auth related commands. If it is, then the process will be halted and this command must be submitted again to restart the debug auth process. The list of debug auth related commands which can be sent without halting the ongoing debug auth process are:
SACI_CMD_DEBUG_REQ_KEY_ID
SACI_CMD_DEBUG_REQ_CHALLENGE
If this command is submitted again, it will technically begin a new debug authentication process which could result in a different challenge vector based on the configuration of Scfg.debugAuthCfg.challengeVector.
SACI_CMD_DEBUG_SUBMIT_CHALLENGE_RESP
This command will end the ongoing debug authentication process.
After executing this command and receiving the requested 40 byte debug challenge vector, the host must:
Sign the the 40 byte challenge vector with the private key corresponding to the public key configured on the device.
See SACI_CMD_DEBUG_REQ_KEY_ID for details on how to identify which private/public key pair to use
The type of cryptographic signing depends on the type of the key pair being used which depends on the configuration of Scfg.secBootCfg.policyCfg.authAlgorithm
After signing, the host must continue the debug auth process by sending the SACI_CMD_DEBUG_SUBMIT_CHALLENGE_RESP command.
| Words | Bits | Field | Value | Description |
|---|---|---|---|---|
|
0 |
7:0 |
cmdId |
0x1E |
Command ID |
|
15:8 |
respSeqNumber |
User defined |
Optional response sequence number, included in the response header |
|
|
31:16 |
reserved0 |
0x0000 |
Reserved |
|
|
1 |
31:0 | authLevel | User defined |
The requested authentication level for the debug authentication process being started
|
| Words | Bits | Field | Value | Description |
|---|---|---|---|---|
|
0 |
7:0 |
cmdId |
0x1E |
Command ID, copied from the first command parameter word |
|
15:8 |
respSeqNumber |
User defined |
Optional sequence number, copied from the first command parameter word |
|
|
23:16 |
result |
- |
Command result. One of the common results, or:
|
|
|
31:24 |
dataWordCount |
0 or 10 |
Size of additional response data, in number of 32-bit words |
|
|
41:1 |
31:0 | challengeVector | - | The requested 40 byte debug challenge vector |
These checks are performed before command execution, in the indicated order: