NXP Semiconductors OM-A5000ARD Specification sheet

AN13256
Get started with EdgeLock A5000 support package
Rev. 1.0 — 28 March 2022 Application note
Document information
Information Content
Keywords EdgeLock A5000 Secure Authenticator, Plug & Trust Secure Authenticator
Abstract This document is the entry point for getting familiar with EdgeLock A5000
support package contents and how to get started with them.

NXP Semiconductors AN13256
Get started with EdgeLock A5000 support package
Revision history
Revision number Date Description
1.0 2022-03-28 Initial version
Revision history
AN13256 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2022. All rights reserved.
Application note Rev. 1.0 — 28 March 2022
2 / 30

NXP Semiconductors AN13256
Get started with EdgeLock A5000 support package
1 About EdgeLock A5000 Secure Authenticator Plug & Trust family
The A5000 Plug & Trust device offers enhanced Common Criteria EAL 6+ based
security, for unprecedented protection against the latest attack scenarios. This ready-
to-use family of authenticator for IoT devices provides a root of trust at the IC level and
supports the increasing demand for easy-to-design and scalable IoT security.
Delivered as a ready-to-use solution, the EdgeLock A5000 includes a complete product
support package that simplifies design-in and reduces time to market. The EdgeLock
A5000 support package offers:
•Software enablement for different MCUs and MPUs.
•Integration with the most common OSs including Linux, Windows, RTOS and Android.
•Sample code for major IoT security use cases.
•Extensive application notes.
•The development kit is compatibile with i.MX, I.MX RT and Kinetis® MCU boards.
Figure 1. EdgeLock A5000 support package overview
As such, the EdgeLock A5000 support package supplies you with all you need to
evaluate, prototype and implement your next secure IoT application. This document lists
the existing material within EdgeLock A5000 support package, organized in the following
sections:
•EdgeLock A5000 development kits.
•Supported MCU / MPU boards.
•EdgeLock Plug and Trust middleware.
•Support documentation.
To implement inclusive language, the terms "master/slave" has been replaced by
"controller/target", following the recommendation MIPI.
AN13256 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2022. All rights reserved.
Application note Rev. 1.0 — 28 March 2022
3 / 30

NXP Semiconductors AN13256
Get started with EdgeLock A5000 support package
2 EdgeLock A5000 development boards
The EdgeLock A5000 secure authenticator is supported by a development board that can
be connected with any MCU board using the compatible Arduino headers or via direct
I2C connection. Table 1 summarizes the ordering details of the EdgeLock development
boards:
Part number 12NC Description Picture
OM-A5000ARD 935424319598 Arduino® compatible
development kit
OM-SE050RPI 935379833598 Raspberry Pi to
OMSE050ARD
adapter board.
Table 1. EdgeLock A5000 development boards.
Note: You have two options to connect the Raspberry Pi to the OM-A5000ARD board:
1. Using the OM-SE05xRPI adapter board. This board does not include any active
component.
2. Using the OM-SE05xARD connected with wires, as described in AN12570.
AN13256 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2022. All rights reserved.
Application note Rev. 1.0 — 28 March 2022
4 / 30

NXP Semiconductors AN13256
Get started with EdgeLock A5000 support package
3 Supported MCU/MPU boards
The EdgeLock A5000 security IC is designed to be used as a part of an IoT system. It
works as an auxiliary security device attached to a host controller (MCU or MPU board).
The host controller communicates with EdgeLock A5000 through an I²C interface with the
host controller being the controller and the EdgeLock A5000 being the target.
Table 2 summarizes the ordering details of the MCU / MPU boards supported by the
EdgeLock Plug & Trust middleware:
Part number 12NC Description Picture
FRDM-64F 935326293598 Freedom development
platform for Kinetis
K64, K63 and K24
MCUs
MIMXRT1060-EVK 935368284598 MIMXRT1060-EVK low
cost evaluation kit for
Cortex-M7
MIMXRT1170-EVK 935378982598 MIMXRT1170-EVK low
cost evaluation kit for
Cortex-M7
MCIMX8M-EVK 935378743598 Evaluation Kit for the
i.MX 8M Applications
Processor
LPC55S69-EVK 935377412598 LPCXpresso55S69
Development Board
Table 2. Evaluation MCU/MPU boards details
AN13256 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2022. All rights reserved.
Application note Rev. 1.0 — 28 March 2022
5 / 30

NXP Semiconductors AN13256
Get started with EdgeLock A5000 support package
3.1 MCUExpresso EdgeLock A5000 examples
The EdgeLock Plug & Trust middleware includes a set of project examples that
demonstrate the use of EdgeLock A5000 in the latest Authenticator security use cases.
For MCU based projects the example can be either:
•Imported from the CMake-based build system included in the EdgeLock Plug & Trust
middleware package.
•Imported from the MCUXpresso SDKs made available for the MIMXRT1170-EVK, the
MIMXRT1060-EVK, the FRDM-64F and the LPC55S69-EVK MCU boards.
The CMake-based build system is briefly explained in Section 4.2.
For the MIMXRT1170-EVK, the MIMXRT1060-EVK, the FRDM-64F and the LPC55S69-
EVK, a set of project examples can be directly imported from the board SDK package to
your MCUXpresso workspace.
These project examples offer a quick way to evaluate EdgeLock A5000 features, and its
source code can be re-used for your own implementations. The latest SDK packages can
be found in EdgeLock A5000 product website, under the Tools & Software tab, as shown
in Figure 2.
Figure 2. MCU board SDKs with EdgeLock A5000 examples
Note: The MCU SDKs can be downloaded also from the MCUXpresso SDK Builder
website, but may not include all the EdgeLock A5000 project examples or the latest
version of them.
The NXP Plug & Trust middleware supports the A5000 Secure Authenticator and the
SE05x Secure Element product family through the SSS and se05x API. Table 3 lists all
examples supported by the A5000 Secure Authenticator when using the FRDM-64F
MCUXpresso SDK.
AN13256 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2022. All rights reserved.
Application note Rev. 1.0 — 28 March 2022
6 / 30

NXP Semiconductors AN13256
Get started with EdgeLock A5000 support package
Example Name Description
se05x_GetInfo This project can be used to get A5000/SE05x platform
information.
se05x_Minimal This is a bare minimum example for A5000/SE05x. This gets the
amount of free avialable memory in byte.
se05x_cloud_aws This demo demonstrates connection to AWS IoT Console
using pre-provisioned device credentials and publish/subscribe
procedure using MQTT.
se05x_cloud_azure This demo demonstrates connection to Azure IoTHub using
pre-provisioned device credentials and demonstrates publish/
subscribe procedure using MQTT.
se05x_cloud_gcp This demo demonstrates connection to Google Cloud Platform
using pre-provisioned device credentials and demonstrates
publish/subscribe procedure using MQTT.
se05x_cloud_ibm_watson This demo demonstrates connection to IBM Watson IoT platform
using pre-provisioned device credentials and publish/subscribe
procedure using MQTT.
se05x_ex_ecc This example does a elliptic curve cryptography signing and
verify operation.
se05x_ex_hkdf This example does a HMAC Key derivation operation based on
the info and salt.
se05x_ex_md This example does a Message Digest hashing operation.
se05x_symmetric This example does a symmetric cryptography AES encryption
and decryption operation.
se05x_iot_agent_demo This is an example for the EdgeLock 2GO agent.
se05x_vcom The vcomSE050 demo application allows the board to be used
as a bridge between the PC and the secure module and enables
the execution of the config tool and other utilities from the PC.
Table 3. EdgeLock A5000 FRDM-64F MCUXpresso SDK examples
The Plug & Trust Middleware uses the feature file fsl_sss_ftr.h to select a dedicated
EdgeLock product IC and the corresponding Authenticator application or IoT applet. The
fsl_sss_ftr.h is located in the project source folder. To take advantage of EdgeLock
A5000 features, it is required to change the following options in the fsl_sss_ftr.h
header file:
1. Set the #define SSS_HAVE_APPLET_AUTH flag to 1 and disable all other applet
variants be setting the flags to 0 (see Figure 3).
2. The authentication application version flag #define
SSS_HAVE_SE05X_VER_07_02 must be set to 1 and all other application version
flags must be set to 0 as shown in Figure 4.
3. Re-build the MCU Expresso project so that the settings are applied.
In Table 5 you can find the corresponding application note reference which explains
how to get started with EdgeLock Plug & Trust middleware using the OM-A5000ARD
and the MIMXRT1170-EVK,MIMXRT1060-EVK, FRDM-64F or LPC55S69-EVK
boards. It provides detailed instructions to run projects imported either from the MCU
Expresso SDK or the CMake-based build system included in the EdgeLock Plug & Trust
middleware.
AN13256 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2022. All rights reserved.
Application note Rev. 1.0 — 28 March 2022
7 / 30

NXP Semiconductors AN13256
Get started with EdgeLock A5000 support package
Figure 3. Plug & Trust middleware feature file fsl_sss_ftr.h - select AUTH application
AN13256 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2022. All rights reserved.
Application note Rev. 1.0 — 28 March 2022
8 / 30

NXP Semiconductors AN13256
Get started with EdgeLock A5000 support package
Figure 4. Plug & Trust middleware feature file fsl_sss_ftr.h - select application version 7.2
3.2 MPU EdgeLock A5000 examples
A pre-compiled Linux image with the EdgeLock Plug & Trust middleware is available for
the MCIMX8M-EVK. This pre-compiled Linux image can be directly flashed into a micro-
SD card, and booted from MCIMX8M-EVK for evaluation of EdgeLock A5000 features.
Note: To take advantage of EdgeLock A5000 features, please select the corresponding
CMake options as described in Section 4.2 and rebuild the middleware.
The AN13027 explains How to get started with the OM-A5000ARD board and i.MX 8M
board.
The latest EdgeLock Plug & Trust middleware software package pre-installed on a
bootable SD Card image version can be found in product website, under the Tools &
Software tab, as shown in Figure 5.
AN13256 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2022. All rights reserved.
Application note Rev. 1.0 — 28 March 2022
9 / 30

NXP Semiconductors AN13256
Get started with EdgeLock A5000 support package
Figure 5. Bootable SD Card image for MCIMX8M-EVK
The AN12570 explains how to get started with the OM-A5000ARD board and the
Raspberry Pi board, as a reference for any other device running a Linux distribution.
AN13256 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2022. All rights reserved.
Application note Rev. 1.0 — 28 March 2022
10 / 30

NXP Semiconductors AN13256
Get started with EdgeLock A5000 support package
4 EdgeLock Plug & Trust middleware
The EdgeLock Plug & Trust middleware is a single software stack designed to facilitate
the integration of NXP security ICs into your microcontroller or microprocessor software.
This middleware has built-in cryptographic and device identity features, abstracts the
commands and communication interface exposed by NXP security ICs, and it is directly
accessible from stacks like OpenSSL, mbedTLS or other cryptographic libraries. In
addition, it includes code examples for quick integration of feaures and uses cases such
as TLS and cloud service onboarding. It also comes with support for various NXP MCU /
MPU platforms and can be ported to multiple host platforms and host operating systems.
•Section 3.1 describes how to use the MCUExpresso EdgeLock A5000 examples.
•Section 3.2 explain how use pre-compiled Linux image for the MCIMX8M-EVK.
The EdgeLock Plug & Trust middleware exposes an API called Secure Sub System
(SSS), which supports the access to the cryptography and identity features of:
•A71CH
•EdgeLock SE050
•EdgeLock SE051
•Auth-EdgeLock A5000
Figure 6 is a simplified representation of the layers and components of EdgeLock Plug &
Trust middleware:
Figure 6. NXP Plug & Trust middleware block diagram
4.1 Download EdgeLock Plug & Trust middleware
The latest EdgeLock Plug & Trust middleware version can be found in EdgeLock A5000
product website, under the Tools & Software tab, as shown in Figure 7
AN13256 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2022. All rights reserved.
Application note Rev. 1.0 — 28 March 2022
11 / 30

NXP Semiconductors AN13256
Get started with EdgeLock A5000 support package
Figure 7. Download EdgeLock Plug & Trust middleware
4.2 Building and compiling EdgeLock Plug & Trust middleware
The EdgeLock Plug & Trust middleware is delivered with CMake files that include
the set of directives and instructions describing the project's source files and targets.
The CMake files allow developers to build EdgeLock A5000 middleware in their target
platform, enable or disable features or change setting flags, among others. The CMake-
based compilation option is provided as a covenient way for developers to run a project
example on different target platforms; e.g. Windows and Linux PCs and embedded
platforms.
The project settings can be specified dynamically using the CMake GUI. Figure 8 shows
a CMake GUI screenshot with EdgeLock A5000 project settings.
To build the middleware to support the A5000 Secure Authenticator application the
following CMake setting needs to be modified before building the middlware:
•Select AUTH for the CMake option PTWM_Applet.
•Select 07_02 for the CMake option PTWM_SE05X_Ver.
• Disable the CMake option SSSFTR_SE05X_RSA.
The project settings can be specified dynamically using the CMake GUI. The Figure
below shows a CMake GUI screenshot with EdgeLock A5000 project settings.
AN13256 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2022. All rights reserved.
Application note Rev. 1.0 — 28 March 2022
12 / 30

NXP Semiconductors AN13256
Get started with EdgeLock A5000 support package
Figure 8. CMake options
4.3 Code documentation
The code documentation provided as part of EdgeLock Plug & Trust middleware package
is supplied in HTML and PDF form. The primary audience of this HTML documentation
are programmers, developers, system architects and system designers. It includes:
•Technical API reference guide.
•Instructions to compile and build EdgeLock Plug & Trust middleware.
•Instructions to run the ssscli tool. See Section 4.4 for more details.
•Developer guides to execute the demo and examples.
To open the HTML documentation:
1. Download EdgeLock Plug & Trust middleware as explained in Section 4.
2. Unzip the EdgeLock Plug & Trust middleware package.
AN13256 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2022. All rights reserved.
Application note Rev. 1.0 — 28 March 2022
13 / 30

NXP Semiconductors AN13256
Get started with EdgeLock A5000 support package
3. In the unzipped package, go to simw-top\doc\ folder.
4. Double click in the index.html file.
5. A browser with the documentation landing page will open as shown in Figure 9:
Figure 9. HTML code documentation
6. From the same browser, you can navigate through the different document sections
using the left-hand side menu or the hyper-linked table of contents shown in the
center. For instance, to check the EdgeLock Plug & Trust middleware description,
click on Section 3. Plug & Trust MW Stack on the left hand side menu as
shown in Figure 10:
Figure 10. EdgeLock Plug & Trust middleware description
AN13256 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2022. All rights reserved.
Application note Rev. 1.0 — 28 March 2022
14 / 30

NXP Semiconductors AN13256
Get started with EdgeLock A5000 support package
4.4 EdgeLock A5000 ssscli tool
The ssscli is a command line tool that can be used to send commands to EdgeLock
A5000 interactively through the command line. For example, you can use the ssscli
to create keys and credentials in the EdgeLock A5000 security IC during evaluation,
development and testing phases. The ssscli tool is written in Python and supports
complex provisioning scripts that can be run in Windows, Linux, OS X and other
embedded devices. It can be used to:
•Insert keys and certificates
•Read reference-keys and certificates
•Delete (erase) keys and certificates
•Generate keys inside the EdgeLock A5000
•Attach policies to objects
•List all secure objects
•Retrieve the A5000 device unique ID
•Run some basic operations like sign/verify and encrypt/decrypt operations
The EdgeLock Plug & Trust middleware code documentation provides detailed usage
examples of the ssscli tool. To find these usage examples:
1. Download EdgeLock Plug & Trust middleware as explained in Section 4.
2. Unzip the EdgeLock Plug & Trust middleware package.
3. Go to simw-top\doc\ folder.
4. Double click in the index.html file.
AN13256 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2022. All rights reserved.
Application note Rev. 1.0 — 28 March 2022
15 / 30

NXP Semiconductors AN13256
Get started with EdgeLock A5000 support package
5. Click on Section 9 CLI tool and then click on the Section 9.6 Usage
examples as shown in Figure 11
Figure 11. ssscli documentation
AN13256 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2022. All rights reserved.
Application note Rev. 1.0 — 28 March 2022
16 / 30

NXP Semiconductors AN13256
Get started with EdgeLock A5000 support package
6. You will see a new page with examples describing how to use ssscli tool for the most
common operations:
Figure 12. ssscli usage examples
Note: The subsystem option auth shall be used to open a session using connect
command. All SE05X specific commands certuid, readidlist, reset and uid are
supported by EdgeLock A5000.
4.4.1 EdgeLock A5000 ssscli tool example
The EdgeLock Plug & Trust middleware includes all components required to verify the
EdgeLock A5000 under Windows using the ssscli tool without the need to build the
middleware. To be able to connect the A5000-ARD board to a Windows PC, one of the
following MCU boards running a VCOM to T1 Over I2C firmware is required:
•MIMXRT1170-EVK
•MIMXRT1060-EVK
•FRDM-64F
•LPC55S69-EVK
The MCU boards are connected via USB to the Windows PC and the MCU board VCOM
to T1 Over I2C firmware is acting as a bridge between the PC VCOM interface and the
A5000 Secure Authenticator.
This setup also allows to run the A5000 middleware Visual Studio project examples on a
Windows platform. Further details can be found in AN12398 EdgeLock SE05x Quick start
guide with Visual Studio project examples explains.
In Table 5 you can find the corresponding application note reference which explains the
correct OM-A5000ARD and MCU board connecting. The quick start guides for the MCU
boards are also including the correct OM-A5000ARD jumper configuration.
AN13256 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2022. All rights reserved.
Application note Rev. 1.0 — 28 March 2022
17 / 30

NXP Semiconductors AN13256
Get started with EdgeLock A5000 support package
The precompiled VCOM binaries for the MIMXRT1170-EVK, the MIMXRT1060-EVK,
the FRDM-64F and the LPC55S69-EVK MCU boards are located in .\simw-top
\binaries\MCU\se05x. Because the EdgeLock A5000 Secure Authenticator and
the SE05x Secure Element family are using the same API one of the following VCOM
binaries can be used for the A5000 Secure Authenticator:
•se05x_vcom-T1oI2C-evkmimxrt1170.bin
•se05x_vcom-T1oI2C-evkmimxrt1060.bin
•se05x_vcom-T1oI2C-frdmk64f.bin
•se05x_vcom-T1oI2C-lpcxpresso55s69.bin
The pre-compiled Windows ssscli tool is located in .\simw-top\binaries
\PCWindows\ssscli.
4.4.1.1 List all A5000 secure objects
To list all secure objects from EdgeLock A5000 dynamic file system, follow these steps:
1. First, open a command prompt and navigate to .\simw-top\binaries
\PCWindows\ssscli.
2. You can use the following command to display the ssscli build in help:
ssscli --help.
Figure 13. ssscli help
AN13256 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2022. All rights reserved.
Application note Rev. 1.0 — 28 March 2022
18 / 30

NXP Semiconductors AN13256
Get started with EdgeLock A5000 support package
3. To get all option for the connect command use: ssscli connect --help.
Figure 14. ssscli connect help
The EdgeLock A5000 Secure Authenticator supports the same specific commands as
the EdgeLock SE05x product variants.
ssscli se05x --help
Figure 15. ssscli se05x help
4. Connect to the EdgeLock SE05x using the executable ssscli.exe. You
need to indicate the VCOM port number corresponding to your MCU VCOM
port. The subsystem option auth shall be to open a session with the A5000
AN13256 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2022. All rights reserved.
Application note Rev. 1.0 — 28 March 2022
19 / 30

NXP Semiconductors AN13256
Get started with EdgeLock A5000 support package
Secure Authenticator.The following commands will connect to the A5000 Secure
Authenticator, list all A5000 secure objects and close the connection.
•ssscli connect auth vcom COMxx
•ssscli se05x readidlist
•ssscli disconnect
Figure 16. ssscli readidlist example
AN13256 All information provided in this document is subject to legal disclaimers. © NXP B.V. 2022. All rights reserved.
Application note Rev. 1.0 — 28 March 2022
20 / 30