SE Anti-Rollback OTP Bit Consumption#

Introduction#

Series 3 devices introduce the use of external flash, which requires special attention to maintain device security. Because external flash can be more susceptible to modification, it introduces new challenges to protecting sensitive information stored outside the device. The SE's Multiple Time Programmable (MTP) memory helps mitigate these risks by preventing security settings from being reverted to earlier, potentially less secure states.

The SE MTP is a memory region within the SE that records the completion of certain security-related operations. This ensures the device cannot be rolled back to a previous, less secure configuration. Each time the SE’s MTP is updated, its Anti-Rollback SE OTP bit counter increments, preventing the MTP from being restored to an earlier version.

End of Life (EOL) Lifecycle Phase#

The SE OTP counter is at least 2 kB in size (~16k bits) and may be allowed to overflow into the next available SE OTP region if space permits. However, once all available OTP space is exhausted, the device enters an EOL (End of Life) state. This means any operation that would require the OTP counter to be incremented, including SE, Bootloader, or Application FW updates will not be able to be performed. A list of operations that consume SE OTP Bits is listed in the table below.

Note: Simplicity Commander will return a number of OTP bits consumed and remaining on devices through the command:

commander security otprollbackcount

Number of used OTP rollback bits: 9
Number of remaining OTP rollback bits: 65526
DONE

Reducing OTP Bit Consumption in Development Devices#

The following commands prevent OTP bits from being consumed, but should be used in a development setting only. While these commands will slow the consumption of OTP bits in development devices, OTP consumption will still occur; therefore, OTP exhaustion remains possible even when these commands are used.

Closing a Code Region#

When using Simplicity Commander, code regions are closed automatically when using the commander flash command. To avoid closing a code region when running this command, a user can specify the --noclose flag during flashing, which will leave the region open. This option is only intended for use to prevent exhaustion of OTP bits on development devices when continuous re-flashing is done.

commander flash example.hex --noclose -d sixg301

Parsing file example.hex...
Writing 168756 bytes starting at address 0x01000000
Erasing range 0x01000000 - 0x01007FFF (1 sector, 32 KB)
Erasing range 0x01008000 - 0x010B7FFF (1 sector, 704 KB)
Programming range 0x01000000 - 0x01001FFF (8 KB)
...
Programming range 0x010B6000 - 0x010B7FFF (8 KB)
Flashing completed successfully!
DONE

Note: Closing a code region is a prerequisite for Secure Boot, as it enables the SE to access Region 0 to perform signature validation on the bootloader firmware. Therefore, on development devices with secure boot enabled, code regions must be closed in order for firmware to be executed by the SE.

Skip IV Rolling#

In order to avoid resource exhaustion on development devices with AXiP or EXiP enabled, the transition to development command (also referred to as the Skip IV Roll command) can be used to issue a one-time command which will enforce the same IV to be used for the lifetime of the device. As this flag is enabled in OTP, this setting cannot be reversed once enabled. Devices with this option set must only be used for development purposes. Once Skip IV Rolling is enabled, devices should be considered non-secure and should not enter production, as reusing IVs on devices in the field can introduce vulnerabilities which could lead to data confidentiality being impacted. When this option is not set, IVs will continue to be rolled on each flash erase, which will maintain security of the encrypted data. For more details on AXiP and EXiP, refer to AN1509.

commander security transitiontodevelopment -d sixg301 

================================================================================
THIS IS A ONE-TIME command which permanently changes the security properties of the device.
Once done, the device permanently uses the same IV for encryption of flash, which is not
secure (using the same IV and same key can lead to exposure of the encrypted data).
This should only be enabled on development devices to prevent exhausting OTP rollback
bits after repeated flash/erase cycles.
Type 'continue' and hit enter to proceed or Ctrl-C to abort:
================================================================================
continue
The device has been permanently transitioned to NOT SECURE development mode
DONE

Sources of OTP Bit Consumption#

SE OTP bits are consumed regardless of if these operations are implemented via a DCI command or a SE Manager API.