DS2432P ,1k-Bit Protected 1-Wire EEPROM with SHA-1 EngineFEATURES PIN ASSIGNMENT 1128 bits of 5V EEPROM memory parti-tioned into four pages of 256 bits, a ..
DS2432P-W01+4T ,1Kb Protected 1-Wire EEPROM with SHA-1 EngineFEATURES PIN CONFIGURATIONS 1128 Bits of 5V EEPROM Memory TOP VIEW Partitioned Into Four Pages ..
DS2433 ,4 kbit 1-Wire EEPROMPIN DESCRIPTION 8-bit family code specifies DS2433PR-35 SOcommunication requirements to readerPin ..
DS2433+ ,4Kb 1-Wire EEPROMblock diagram in Figure 1 shows the relationships between the major control and memory sections oft ..
DS2433S ,4 kbit 1-Wire EEPROMFEATURES PIN ASSIGNMENT§ 4096 bits Electrically Erasable ProgrammableNC 1 8 NCRead Only Memory (EEP ..
DS2433X ,4 kbit 1-Wire EEPROMPIN DESCRIPTION§ 8-bit family code specifies DS2433PR-35 SOICcommunication requirements to readerPi ..
E53NA50 ,NABSOLUTE MAXIMUM RATINGSSymbol Parameter Value UnitV Drain-source Voltage (V =0) 500 VDS GSV 500 VD ..
EA2-12 ,COMPACT AND LIGHTWEIGHTAPPLICATIONSElectronic switching systems, PBX, key telephone systems, automatic test equipment and ..
EA2-12NU ,COMPACT AND LIGHTWEIGHTFEATURESª Low power consumptionª Compact and light weightª 2 form c contact arrangementª Low magnet ..
EA2-12S ,COMPACT AND LIGHTWEIGHTFEATURESª Low power consumptionª Compact and light weightª 2 form c contact arrangementª Low magnet ..
EA2-12TNU ,COMPACT AND LIGHTWEIGHTAPPLICATIONSElectronic switching systems, PBX, key telephone systems, automatic test equipment and ..
EA2-4.5NU ,COMPACT AND LIGHTWEIGHTAPPLICATIONSElectronic switching systems, PBX, key telephone systems, automatic test equipment and ..
DS2432P
1k-Bit Protected 1-Wire EEPROM with SHA-1 Engine
FEATURES1128 bits of 5V EEPROM memory parti-tioned into four pages of 256 bits, a 64-bit
write-only secret and up to 5 general purpose
read/write registersOn-chip 512-bit SHA-1 engine to compute
160-bit Message Authentication Codes(MAC) and to generate secretsWrite access requires knowledge of the secret
and the capability of computing and transmit-
ting a 160-bit MAC as authorizationSecret and data memory can be write-pro-tected (all or page 0 only) or put in EPROM-
emulation mode (“write to 0”, page 1)Unique, factory-lasered and tested 64-bit reg-
istration number assures absolute traceability
because no two parts are alikeBuilt-in multidrop controller ensures compati-
bility with other 1-Wire net productsReduces control, address, data and power to a
single data pinDirectly connects to a single port pin of a mi-croprocessor and communicates at up to 16.3k
bits per secondOverdrive mode boosts communication speed
to 142k bits per secondLow cost 6-lead TSOC surface mount pack-age, or solder-bumped Flipchip packageReads and writes over a wide voltage range of
2.8V to 5.25V from -40°C to +85°C
PIN ASSIGNMENT
TSOC (150mil)1-WIRE
GND
top viewside view
See www.dalsemi.com for mechanical
specifications of packages.
ORDERING INFORMATIONDS2432P6-lead TSOC package
DS2432P/T&RTape & Reel DS2432P
DS2432XFlipchip package, tape & reel
DESCRIPTIONThe DS2432 combines 1024 bits of EEPROM, a 64-bit secret, an 8-byte register/control page with up to 5
user read/write bytes, a 512-bit SHA-1 engine and a fully-featured 1-Wire interface in a single chip. EachDS2432 has its own 64-bit ROM registration number that is factory lasered into the chip to provide a
guaranteed unique identity for absolute traceability. Data is transferred serially via the 1-Wire protocol,
which requires only a single data lead and a ground return. The DS2432 has an additional memory area
called the scratchpad that acts as a buffer when writing to the main memory, the register page or when
installing a new secret. Data is first written to the scratchpad from where it can be read back. After thedata has been verified, a copy scratchpad command will transfer the data to its final memory location,
provided that the DS2432 receives a matching 160-Bit MAC. The computation of the MAC involves the
DS2432
1k-Bit Protected 1-Wire™
EEPROM with SHA-1 Engine
PRELIMINARYDS2432
160-bit message authentication codes (MAC) when reading a memory page or to compute a new secret,
instead of loading it. Applications of the DS2432 include intellectual property security, after-market
management of consumables, and taper proof data carriers.
OVERVIEWThe block diagram in Figure 1 shows the relationships between the major control and memory sections ofthe DS2432. The DS2432 has five main data components: 1) 64-bit lasered ROM, 2) 64-bit scratchpad, 3)
four 32-byte pages of EEPROM, 4) 64-bit register page, 5) 64-bit Secrets Memory, and 6) a 512-bit
SHA-1 Engine (SHA = Secure Hash Algorithm). The hierarchical structure of the 1-Wire protocol is
shown in Figure 2. The bus master must first provide one of the seven ROM Function Commands, 1)
Read ROM, 2) Match ROM, 3) Search ROM, 4) Skip ROM, 5) Resume Communication, 6) Overdrive-Skip ROM or 7) Overdrive-Match ROM. Upon completion of an Overdrive ROM command byte
executed at standard speed, the device will enter Overdrive mode where all subsequent communication
occurs at a higher speed. The protocol required for these ROM function commands is described in Figure
9. After a ROM function command is successfully executed, the memory functions become accessible
and the master may provide any one of the seven memory function commands. The protocol for thesememory function commands is described in Figure 7. All data is read and written least significant bit first.
DS2432 BLOCK DIAGRAM Figure 11-Wire net
PRELIMINARYDS2432
64-BIT LASERED ROMEach DS2432 contains a unique ROM code that is 64 bits long. The first eight bits are a 1-Wire family
code. The next 48 bits are a unique serial number. The last eight bits are a CRC of the first 56 bits. (See
Figure 3). The 1-Wire CRC is generated using a polynomial generator consisting of a shift register and
XOR gates as shown in Figure 4. The polynomial is X8 + X5 + X4 + 1. Additional information about the
Dallas 1-Wire Cyclic Redundancy Check is available in the Book of DS19xx iButton Standards fromDallas Semiconductor. The shift register bits are initialized to zero. Then starting with the least significant
bit of the family code, one bit at a time is shifted in. After the 8th bit of the family code has been entered,
then the serial number is entered. After the 48th bit of the serial number has been entered, the shift register
contains the CRC value. Shifting in the eight bits of CRC should return the shift register to all zeros.
HIERARCHCAL STRUCTURE FOR 1-WIRE PROTOCOL Figure 2
64-BIT LASERED ROM Figure 3MSBLSB48-Bit Serial Number
MSBLSBMSBLSBMSBLSB
PRELIMINARYDS2432
1-WIRE CRC GENERATOR Figure 4
MEMORY MAPThe DS2432 has four memory areas: data memory, secrets memory, register page with special function
registers and user-bytes, and a scratchpad. The data memory is organized in pages of 32 bytes. Secret,
register page and scratchpad are 8 bytes each. The scratchpad acts as a buffer when writing to the data
memory, loading the initial secret or when writing to the register page.
Data memory, secrets memory and register page are located in a linear address space, as shown in
Figure 5. The data memory and the register page have unrestricted read access. Writing to the data
memory and the register page requires the knowledge of the secret.
DS2432 MEMORY MAP Figure 5
Address RangeDescriptionNote1) Once programmed to AAh or 55h this address becomes read-only. All other codes can be stored but
will neither write-protect the address nor activate any function.
PRELIMINARYDS2432
The secret can be installed either by copying data from the scratchpad to the secrets memory or by
computation using the current secret and the scratchpad contents as partial secret. The secret cannot be
read directly; only the SHA engine has access to it for computing message authentication codes.
The address range 0088h to 008Fh, also referred to as register page, contains special function registers as
well as general-purpose user-bytes and one factory byte. Once programmed to AAh or 55h, most of these
bytes become write-protected and can no longer be altered. All other codes will neither write-protect the
address nor activate the special function associated to that particular byte. Special functions are: 1) write-
protecting only the secret, 2) write-protecting all four data memory pages simultaneously, 3) activatingEPROM mode for data memory page 1 only, and 4) write-protecting data memory page 0 only. Once the
EPROM mode is activated, bits in the address range 0020h through 003Fh can only be altered from a
logic 1 to a logic 0, provided that the data memory is not write protected.
The factory byte will either read 55H or AAh. Typically, this address will read 55h, indicating that theaddresses 008E and 008F are read/write user-bytes without any special function or locking mechanism.
The code of AAh indicates that these two bytes are programmed with a 16-bit manufacturer ID and then
write-protected at the factory. The manufacturer ID can be a customer-supplied identification code that
assists the application software in identifying the product the DS2432 is associated with and in faster
selection of the applicable secret. To setup and register a manufacturer ID contact the factory.
The address range 0090h to 0097h provides an alternate way to read the device’s ROM registration
number. The family code is stored at the lower address followed by the 48-bit serial number and the 8-bit
CRC, which is stored at address 0097h. In reading through these addresses (0090h to 0097h) the bus
master will receive the individual bits of the registration number in exactly the same sequence as with aROM function command.
ADDRESS REGISTERS Figure 6Bit #76543210
Target Address (TA1)T3T2
(0)
Target Address (TA2)T11T10
Ending Address with
Data Status (E/S)(Read Only)
ADDRESS REGISTERS AND TRANSFER STATUSThe DS2432 employs three address registers: TA1, TA2 and E/S (Figure 6). These registers are common
to many other 1-Wire devices but operate slightly differently with the DS2432. Registers TA1 and TA2must be loaded with the target address to which the data will be written or from which data will be read.
Register E/S is a read-only transfer-status register, used to verify data integrity with write commands.
Since the scratchpad of the DS2432 is designed to accept data in blocks of eight bytes only, the lower
three bits of TA1 will be forced to 0 and the lower three bits of the E/S register (Ending Offset) will
PRELIMINARYDS2432
number of data bits sent by the master is not an integer multiple of 8 or if the data in the scratchpad is not
valid due to a loss of power. A valid write to the scratchpad will clear the PF bit. Bits 3, 4 and 6 have no
function; they always read 1. The Partial Flag supports the master checking the data integrity after a
Write command. The highest valued bit of the E/S register, called AA or Authorization Accepted, acts asa flag to indicate that the data stored in the scratchpad has already been copied to the target memory
address. Writing data to the scratchpad clears this flag.
WRITING WITH VERIFICATIONTo write data to the DS2432, the scratchpad has to be used as intermediate storage. First the master issues
the Write Scratchpad command to specify the desired target address, followed by the data to be written to
the scratchpad. Note that writes to data memory must be performed on 8-byte boundaries with the3 LSBs of the target address (T2..T0) equal to 000b. If T2..T0 are sent with non-zero values, the device
will set these bits to zero and will write to the modified address upon completion of the command
sequence. In addition, the entire 8-byte scratchpad will be copied to memory when commanded,
therefore eight bytes of data should be written into the scratchpad to ensure that the data to be copied is
known. Under certain conditions (see Write Scratchpad command) the master will receive an invertedCRC16 of the command, address (actual address sent) and data at the end of the write scratchpad
command sequence. Note that the CRC is calculated based on the actual target address sent and not the
modified address in the case of a non-zero T2..T0. Knowing this CRC value, the master can compare it
to the value it has calculated itself to decide if the communication was successful and proceed to the
Copy Scratchpad command. If the master could not receive the CRC16, it should send the ReadScratchpad command to verify data integrity. As preamble to the scratchpad data, the DS2432 repeats the
target address TA1 and TA2 and sends the contents of the E/S register. If the PF flag is set, data did not
arrive correctly in the scratchpad or there was a loss of power since data was last written to the
scratchpad. The master does not need to continue reading; it can start a new trial to write data to the
scratchpad. Similarly, a set AA flag together with a cleared PF flag indicates that the device did notrecognize the Write command. If everything went correctly, both flags are cleared. Now the master can
continue reading and verifying every data byte. After the master has verified the data, it can send the
Copy Scratchpad command, for example. This command must be followed exactly by the data of the
three address registers TA1, TA2 and E/S. The master should obtain the contents of these registers by
reading the scratchpad.
MEMORY AND SHA FUNCTION COMMANDSDue to its design as a secure device the DS2432 has to behave differently from other 1-Wire memory
devices. Although most of the memory of the DS2432 can be read the same way as any other 1-Wire
memory, attempts to read the secret will result in FFh-bytes rather than real data. The “Memory and SHA
Function Flow Chart” (Figure 7) describes the protocols necessary for accessing the memory andoperating the SHA engine. The communication between master and DS2432 takes place either at regular
speed (default, OD = 0) or at Overdrive Speed (OD = 1). If not explicitly set into the Overdrive Mode the
DS2432 assumes regular speed.
Write Scratchpad [0Fh]The Write Scratchpad command applies to the data memory, the secret and the writable addresses in theregister page. If the bus master sends a target address higher than 90h, the command will not be executed.
After issuing the write scratchpad command, the master must first provide the 2-byte target address,
followed by the data to be written to the scratchpad. The data will be written to the scratchpad starting at
PRELIMINARYDS2432
8 bytes, especially if the data is to be loaded as a secret. If the master sends less than eight data bytes and
does not read back the scratchpad for verification, parts of the new secret may be random data that is
unknown to the master. Only full data bytes are accepted. If the last data byte is incomplete its content
will be ignored and the partial byte flag PF will be set.
When executing the Write Scratchpad command the CRC generator inside the DS2432 (see Figure 12)
calculates a CRC of the entire data stream, starting at the command code and ending at the last data byte
as sent by the master. This CRC is generated using the CRC16 polynomial by first clearing the CRC
generator and then shifting in the command code (0FH) of the Write Scratchpad command, the TargetAddresses (TA1 and TA2), and all the data bytes. Note that the CRC16 calculation is performed with the
actual TA1 sent by the master even though the DS2432 will set TA1 bits T2..T0 to 000b for the actual
Write Scratchpad command. The master may end the Write Scratchpad command at any time. However,
if the scratchpad is filled to its capacity, the master may send 16 read time slots and will receive the CRC
generated by the DS2432.
If a Write Scratchpad is attempted with a target address in data memory (00h-7Fh) or the register page
(88h to 8Fh), then a subsequent Read Scratchpad command will read AAh or 55h for addresses that are
write-protected rather than the value that was written in the Write Scratchpad command. Similarly, if the
target address is within page 1 and the page is in EPROM mode, the read-back from the scratchpad willproduce data that is the logical AND of the original scratchpad data and the current content of the target
memory area.
Read Scratchpad [AAh]The Read Scratchpad command allows verifying the target address and the integrity of the scratchpad
data. After issuing the command code, the master begins reading. The first two bytes will be the target
address with T2 to T0 = 0. The next byte will be the ending offset/data status byte (E/S) followed by thescratchpad data, which may be different from what the master has originally sent. This is of particular
importance if the target address is the secret, the register page or page 1 in EPROM mode. The master
should read through the end of the scratchpad after which it will receive the inverted CRC. This is based
on data as it was sent by the DS2432. If the master continues reading after the CRC all data will be
logic 1’s.
Load First Secret [5Ah]The Load First Secret command is used to replace the device’s current secret with the contents of the
scratchpad, provided that the secret is not write-protected. This command does not require the knowledge
of the device’s current secret. Before the Load First Secret command can be used the master must have
written the new secret to the scratchpad using the starting address of the secret (0080h). After issuing theLoad First Secret command, the master must provide a 3-byte authorization pattern, which should have
been obtained by an immediately preceding Read Scratchpad command. This 3-byte pattern must exactly
match the data contained in the three address registers (TA1, TA2, E/S, in that order). If the pattern
matches and the secret is not write-protected, the AA (Authorization Accepted) flag will be set and the
copy will begin. All eight bytes of scratchpad contents will be copied to the secret’s memory location.The device-internal data transfer takes 10 ms maximum during which the voltage on the 1-Wire bus must
not fall below 2.8V. A pattern of alternating 1’s and 0’s will be transmitted after the data has been copied
until the master issues a reset pulse.
Instead of using Load First Secret, a new secret alternatively be loaded with the Copy Scratchpad
PRELIMINARYDS2432
Memory and SHA Functions Flow Chart Figure 7From ROM Functions
Flow Chart (Figure 9)
PRELIMINARYDS2432
Memory and SHA Functions Flow Chart (continued) Figure 7
PRELIMINARYDS2432
Memory and SHA Functions Flow Chart (continued) Figure 7
PRELIMINARYDS2432
Memory and SHA Functions Flow Chart (continued) Figure 7
PRELIMINARYDS2432
Memory and SHA Functions Flow Chart (continued) Figure 7
PRELIMINARYDS2432
Memory and SHA Functions Flow Chart (continued) Figure 7
PRELIMINARYDS2432
Memory and SHA Functions Flow Chart (continued) Figure 7
PRELIMINARYDS2432
Compute Next Secret [33h]Some applications may require a higher level of security than can be achieved by a single, directly written
secret. For additional security the DS2432 can compute a new secret based on the current secret, the
contents of a selected memory page, and a partial secret that consists of all data in the scratchpad. To
install a computed secret the master issues the Compute Next Secret command, which activates the
512-bit SHA-1 engine, provided that the secret is not write-protected. Table 1 shows how the various datacomponents involved enter the SHA engine and how a portion of the SHA result is loaded into the
secret's memory location. The SHA computation algorithm itself is explained later in this document. The
Compute Next Secret command can be applied as often as desired to increase the level of security. The
bus master does not need to know the device’s current secret in order to successfully compute a new one
and then overwrite the existing secret.
SHA-1 Input Data for Compute Next Secret Command Table 1
Result of Compute Next Secret
LegendAfter issuing the Compute Next Secret command the master must provide a 2-byte target address to select
