nerves_key v0.3.2 NervesKey View Source
This is a high level interface to provisioning and using the NervesKey or any ATECC508A/608A that can be configured similarly.
Link to this section Summary
Types
Which device/signer certificate pair to use
Functions
Clear out the auxiliary certificates
Create a signing key pair
Return default provisioning info for a NervesKey
Read the device certificate from the slot
Check whether the auxiliary certificates were programmed
Read the manufacturer's serial number
Provision a NervesKey in one step
Provision the auxiliary device/signer certificates on a NervesKey
Check whether the NervesKey has been provisioned
Read the signer certificate from the slot
Link to this section Types
certificate_pair()
View Source
certificate_pair() :: :primary | :aux
certificate_pair() :: :primary | :aux
Which device/signer certificate pair to use
Link to this section Functions
clear_aux_certificates(transport)
View Source
clear_aux_certificates(ATECC508A.Transport.t()) :: :ok
clear_aux_certificates(ATECC508A.Transport.t()) :: :ok
Clear out the auxiliary certificates
This function overwrites the auxiliary certificate slots with
create_signing_key_pair(opts \\ [])
View Source
create_signing_key_pair(keyword()) ::
{X509.Certificate.t(), X509.PrivateKey.t()}
create_signing_key_pair(keyword()) :: {X509.Certificate.t(), X509.PrivateKey.t()}
Create a signing key pair
This returns a tuple that contains a new signer certificate and private key. It is compatible with the ATECC508A certificate compression.
Options:
- :years_valid - how many years this signing key is valid for
default_info(transport)
View Source
default_info(ATECC508A.Transport.t()) :: NervesKey.ProvisioningInfo.t()
default_info(ATECC508A.Transport.t()) :: NervesKey.ProvisioningInfo.t()
Return default provisioning info for a NervesKey
This function is used for pre-programmed NervesKey devices. The serial number is a Base32-encoded version of the ATECC508A/608A's globally unique serial number. No additional care is needed to keep the number unique.
device_cert(transport, which \\ :primary)
View Source
device_cert(ATECC508A.Transport.t(), certificate_pair()) :: X509.Certificate.t()
device_cert(ATECC508A.Transport.t(), certificate_pair()) :: X509.Certificate.t()
Read the device certificate from the slot
The device must be programmed for this to work.
has_aux_certificates?(transport)
View Source
has_aux_certificates?(ATECC508A.Transport.t()) :: boolean()
has_aux_certificates?(ATECC508A.Transport.t()) :: boolean()
Check whether the auxiliary certificates were programmed
manufacturer_sn(transport)
View Source
manufacturer_sn(ATECC508A.Transport.t()) :: binary()
manufacturer_sn(ATECC508A.Transport.t()) :: binary()
Read the manufacturer's serial number
provision(transport, info, signer_cert, signer_key)
View Source
provision(
ATECC508A.Transport.t(),
NervesKey.ProvisioningInfo.t(),
X509.Certificate.t(),
X509.PrivateKey.t()
) :: :ok
provision( ATECC508A.Transport.t(), NervesKey.ProvisioningInfo.t(), X509.Certificate.t(), X509.PrivateKey.t() ) :: :ok
Provision a NervesKey in one step.
See the README.md for how to use this. This function locks the ATECC508A down, so you'll want to be sure what you pass it is correct.
This function does it all. It requires the signer's private key so handle that with care. Alternatively, please consider sending a PR for supporting off-device signatures so that HSMs can be used.
provision_aux_certificates(transport, signer_cert, signer_key)
View Source
provision_aux_certificates(
ATECC508A.Transport.t(),
X509.Certificate.t(),
X509.PrivateKey.t()
) :: :ok
provision_aux_certificates( ATECC508A.Transport.t(), X509.Certificate.t(), X509.PrivateKey.t() ) :: :ok
Provision the auxiliary device/signer certificates on a NervesKey.
This function creates and saves the auxiliary certificates. These
are only needed if the ones written by provision/4
are not
usable. They are not used unless explicitly requested. See the
README.md for details.
You may call this function multiple times after the ATECC508A has been provisioned.
provisioned?(transport)
View Source
provisioned?(ATECC508A.Transport.t()) :: boolean()
provisioned?(ATECC508A.Transport.t()) :: boolean()
Check whether the NervesKey has been provisioned
signer_cert(transport, which \\ :primary)
View Source
signer_cert(ATECC508A.Transport.t(), certificate_pair()) :: X509.Certificate.t()
signer_cert(ATECC508A.Transport.t(), certificate_pair()) :: X509.Certificate.t()
Read the signer certificate from the slot