Keys and certificates

The OPTIGA™ Authenticate NBT uses a set of keys and certificates to enable its brand protection features.

Default keys and certificates

Initial PKI keys and certificates are generated during the production flow of the OPTIGA™ Authenticate NBT.

Table 1 Default keys and certificates.

Name

Location/Link

OPTIGA™ Authenticate NBT device key

on device

OPTIGA™ Authenticate NBT device certificate

on device

Infineon NFC bridge and CL tag devices manufacturing CA key

-

Infineon NFC bridge and CL tag devices manufacturing CA certificate

PEM, CRT, Infineon.com, GitHub (Android, IOS)

Infineon NFC bridge and CL tag devices root CA key

-

Infineon NFC bridge and CL tag devices root CA certificate

PEM, CRT, Infineon.com, GitHub (Android, IOS)

  • OPTIGA™ Authenticate NBT device key

    • Device-unique private key, generated during the production flow.

    • Location: Injected into OPTIGA™ Authenticate NBT’s protected key storage.

  • OPTIGA™ Authenticate NBT device certificate

    • Device-unique certificate, generated during the production flow, contains device-unique public key.

    • Location: Embedded into the OPTIGA™ Authenticate NBT’s initial NDEF message (external type).

  • Infineon NFC bridge and CL tag devices manufacturing key

    • Intermediate CA private key, used to sign OPTIGA™ Authenticate NBT’s device certificate.

    • Location: Safely stored within Infineon’s secure environment.

  • Infineon NFC bridge and CL tag devices manufacturing CA certificate

    • Intermediate CA certificate, contains the intermediate CA’s public key.

    • Location: Product website, GitHub repos, and here.

  • Infineon NFC bridge and CL tag devices root CA key

    • Root CA private key, used to sign the intermediate manufacturing certificate.

    • Location: Safely stored within Infineon’s secure environment.

  • Infineon NFC bridge and CL tag devices root CA certificate

    • Root CA certificate, contains the root CA’s public key.

    • Location: Product website, GitHub repos, and here.

Dummy keys and certificates

In order to showcase the personalization and operation of the OPTIGA™ Authenticate NBT, we also provide dummy keys and certificates. These are just intended for evaluation purposes and SHALL NOT be used in productive environments.

Table 2 Dummy asymmetric keys and certificates.

Name

Link

OPTIGA™ Authenticate NBT dummy device key

PEM, GitHub (Android, IOS)

OPTIGA™ Authenticate NBT dummy device certificate

PEM, GitHub (Android, IOS)

OPTIGA™ Authenticate NBT dummy manufacturing CA key

PEM

OPTIGA™ Authenticate NBT dummy manufacturing CA certificate

PEM, GitHub (Android, IOS)

OPTIGA™ Authenticate NBT dummy root CA key

-

OPTIGA™ Authenticate NBT dummy root CA certificate

PEM

The OPTIGA™ Authenticate NBT also contains a dummy symmetric AES key as its default value. This key is injected to the OPTIGA™ Authenticate NBT during the production flow for evaluation purposes and SHALL NOT be used in productive environments.

Table 3 Default (dummy) symmetric keys.

Name

Value (hex)

OPTIGA™ Authenticate NBT default BMK

37 3f 50 60 40 9b a0 14 b6 9a 62 76 22 f2 3b 59

  • OPTIGA™ Authenticate NBT default brand protection MAC’ing key (BMK)

    • Dummy symmetric key, used to generate the COTT value.

    • Location: Injected into OPTIGA™ Authenticate NBT’s protected key storage, GitHub repos, and here.