• One of a Family of 9 Devices with User Memories from 1 Kbit to 256-Kbit
• 4-Kbit (512-byte) EEPROM User Memory
– Four 128-byte (1-Kbit) Zones
– Self-timed Write Cycle
– Single Byte or 16-byte Page Write Mode
– Programmable Access Rights for Each Zone
• 2-Kbit Configuration Zone
– 37-byte OTP Area for User-defined Codes
– 160-byte Area for User-defined Keys and Passwords
• High Security Features
– 64-bit Mutual Authentication Protocol (Under license of ELVA)
– Encrypted Checksum
– Stream Encryption
– Four Key Sets for Authentication and Encryption
– Eight Sets of Two 24-bit Passwords
– Anti-tearing Function
– Voltage and Frequency Monitor
• Smart Card Features
– ISO 7816 Class A (5V) or Class B (3V) Operation
– ISO 7816-3 Asynchronous T = 0 Protocol (Gemplus
– Multiple Zones, Key Sets and Passwords for Multi-application Use
– Synchronous 2-wire Serial Interface for Faster Device Initialization
– Programmable 8-byte Answer-To-Reset Register
– ISO 7816-2 Compliant Modules
• Embedded Application Features
– Low Voltage Operation: 2.7V to 5.5V
– Secure Nonvolatile Storage for Sensitive System or User Information
– 2-wire Serial Interface
– 1.0 MHz Compatibility for Fast Operation
– Standard 8-lead Plastic Packages, Green Compliant (exceeds RoHS)
– Same Pinout as 2-wire Serial EEPROMs
• High Reliability
– Endurance: 100,000 Cycles
– Data Retention: 10 years
– ESD Protection: 4,000V min
Note: This is a summary document. A complete document is
available under NDA. For more information, please contact your
local Atmel sales office.
Rev. 2023JS–SMEM–3/09
DescriptionThe AT88SC0404C member of the CryptoMemory
Random
Generator
Authentication,
Encryption and
Certification Unit
EEPROM
Answer to Reset
Data Transfer
Password
Verification
Reset Block
Asynchronous
ISO Interface
Synchronous
Interface
Power
Management
VCC
GND
SCL/CLK
SDA/IO
RST
ory providing 4 Kbits of user memory with advanced security and cryptographic features built in.
The user memory is divided into four 128-byte zones, each of which may be individually set with
different security access rights or effectively combined together to provide space for 1 to 4 data
files.
®
family is a high-performance secure mem-
Smart Card
Applications
Embedded
Applications
The AT88SC0404C provides high security, low cost, and ease of implementation without the
need for a microprocessor operating system. The embedded cryptographic engine provides for
dynamic and symmetric mutual authentication between the device and host, as well as performing stream encryption for all data and passwords exchanged between the device and host. Up to
four unique key sets may be used for these operations. The AT88SC0404C offers the ability to
communicate with virtually any smart card reader using the asynchronous T = 0 protocol (Gemplus Patent) defined in ISO 7816-3.
Through dynamic and symmetric mutual authentication, data encryption, and the use of
encrypted checksums, the AT88SC0404C provides a secure place for storage of sensitive information within a system. With its tamper detection circuits, this information remains safe even
under attack. A 2-wire serial interface running at 1.0 MHz is used for fast and efficient communications with up to 15 devices that may be individually addressed. The AT88SC0404C is
available in industry standard 8-lead packages with the same familiar pinout as 2-wire serial
EEPROMs.
Figure 2. Block Diagram
Pin
Descriptions
Supply Voltage (VCC)The VCC input is a 2.7V to 5.5V positive voltage supplied by the host.
Clock (SCL/CLK)In the asynchronous T = 0 protocol, the SCL/CLK input is used to provide the device with a car-
Reset (RST)The AT88SC0404C provides an ISO 7816-3 compliant asynchronous answer to reset
2
rier frequency f. The nominal length of one bit emitted on I/O is defined as an “elementary time
unit” (ETU) and is equal to 372/f. When the synchronous protocol is used, the SCL/CLK input is
used to positive edge clock data into the device and negative edge clock data out of the device.
sequence. When the reset sequence is activated, the device will output the data programmed
AT88SC0404C
2023JS–SMEM–3/09
AT88SC0404C
into the 64-bit answer-to-reset register. An internal pull-up on the RST input pad allows the
device to be used in synchronous mode without bonding RST. The AT88SC0404C does not
support the synchronous answer-to-reset sequence.
Serial Data (SDA/IO)The SDA pin is bidirectional for serial data transfer. This pin is open-drain driven and may be
wired with any number of other open drain or open collector devices. An external pull-up resistor
should be connected between SDA and V
tance loading the SDA bus will determine the rise time of SDA. This rise time will determine the
maximum frequency during read operations. Low value pull-up resistors will allow higher frequency operations while drawing higher average power. SDA/IO information applies to both
asynchronous and synchronous protocols.
When the synchronous protocol is used, the SCL/CLK input is used to positive edge clock data
into the device and negative edge clock data out of the device.
Table 2. DC Characteristics
Applicable over recommended operating range from VCC = +2.7 to 5.5V, TAC = -40oC to +85oC (unless otherwise noted)
SymbolParameterTest ConditionMinTypMaxUnits
(2)
V
CC
I
CC
I
CC
I
CC
I
CC
I
SB
(1)
V
IL
(1)
V
IL
(1)
V
IL
(1)(2)
V
IH
(1)(2)
V
IH
(1)(2)
V
IH
I
IL
I
IL
I
IL
I
IH
I
IH
I
IH
V
OH
V
OL
I
OH
Notes:1. VIL min and VIH max are reference only and are not tested.
Supply Voltage2.75.5V
Supply Current (VCC = 5.5V)Async READ at 3.57MHz5mA
Supply Current (VCC = 5.5V)Async WRITE at 3.57MHz5mA
Supply Current (VCC = 5.5V)Synch READ at 1MHz5mA
Supply Current (VCC = 5.5V)Synch WRITE at 1MHz5mA
Standby Current (VCC = 5.5V)VIN = VCC or GND100uA
SDA/IO Input Low Threshold0VCC x 0.2V
SCL/CLK Input Low Threshold0VCC x 0.2V
RST Input Low Threshold0VCC x 0.2V
SDA/IO Input High ThresholdVCC x 0.7V
SCL/CLK Input High ThresholdVCC x 0.7V
RST Input High ThresholdVCC x 0.7V
SDA/IO Input Low Current0 < V
SCL/CLK Input Low Current0 < V
RST Input Low Current0 < V
< VCC x 0.1515uA
IL
< VCC x 0.1515uA
IL
< VCC x 0.1550uA
IL
SDA/IO Input High CurrentVCC x 0.7 < VIH < V
SCL/CLK Input High CurrentVCC x 0.7 < VIH < V
RST Input High CurrentVCC x 0.7 < VIH < V
SDA/IO Output High Voltage20K ohm external pull-upVCC x 0.7V
SDA/IO Output Low VoltageIOL = 1mA0VCC x 0.15V
SDA/IO Output High CurrentV
OH
2. To prevent Latch Up Conditions from occurring during Power Up of the AT88SCxxxxC, Vcc must be turned on before applying Vih. For Powering Down, Vih must be removed before turning vcc off.
. The value of this resistor and the system capaci-
CC
CC
CC
CC
CC
CC
CC
20uA
100uA
150uA
CC
20uA
V
V
V
V
2023JS–SMEM–3/09
3
Table 3. AC Characteristics
Applicable over recommended operating range from VCC = +2.7 to 5.5V,
= -40oC to +85oC, CL = 30pF (unless otherwise noted)
T
AC
SymbolParameterMinMaxUnits
f
CLK
f
CLK
f
CLK
t
t
t
t
t
AA
t
HD.STA
t
SU.STA
t
HD.DAT
t
SU.DAT
t
SU.STO
t
DH
t
WR
t
WR
Async Clock Frequency (VCC Range: +4.5 - 5.5V)15MHz
Async Clock Frequency (VCC Range: +2.7 - 3.3V)14MHz
Synch Clock Frequency01MHz
Clock Duty cycle4060%
Rise Time - I/O, RST1uS
R
Fall Time - I/O, RST1uS
F
Rise Time - CLK9% x perioduS
R
Fall Time - CLK9% x perioduS
F
Clock Low to Data Out Valid35nS
Start Hold Time200nS
Start Set-up Time200nS
Data In Hold Time10nS
Data In Set-up Time100nS
Stop Set-up Time200nS
Data Out Hold Time20nS
Write Cycle Time (at 25⋅C) 5mS
Write Cycle Time (-40o to +85oC) 7mS
Device
Operation For
Synchronous
Protocols
CLOCK and DATA TRANSITIONS: The SDA pin is normally pulled high with an external
device. Data on the SDA pin may change only during SCL low time periods (see Figure 5 on
page 5). Data changes during SCL high periods will indicate a start or stop condition as defined
below.
START CONDITION: A high-to-low transition of SDA with SCL high is a start condition which
must precede any other command (see Figure 6 on page 6).
STOP CONDITION: A low-to-high transition of SDA with SCL high is a stop condition. After a
read sequence, the stop command will place the EEPROM in a standby power mode (see Fig-
ure 6 on page 6).
ACKNOWLEDGE: All addresses and data words are serially transmitted to and from the
EEPROM in 8-bit words. The EEPROM sends a zero to acknowledge that it has received each
word. This happens during the ninth clock cycle.
MEMORY RESET: After an interruption in protocol, power loss or system reset, any 2-wire part
can be reset by following these steps:
1.Clock up to 9 cycles.
2.Look for SDA high in each cycle while SCL is high.
3.Create a start condition.
4
AT88SC0404C
2023JS–SMEM–3/09
Figure 3. Bus Timing for 2 wire communications
CONDITION
S
S
DATA
CHANGE
ALLOWED
SCL: Serial Clock, SDA: Serial Data I/O
Figure 4. Write Cycle Timing:
SCL: Serial Clock, SDA: Serial Data I/O
CL
AT88SC0404C
DA
Figure 5. Data Validity
8th BIT
WORDn
Note:The write cycle time tWR is the time from a valid stop condition of a write sequence to the end of
the internal clear/write cycle.
ACK
STOP
(1)
t
WR
START
CONDITION
5
2023JS–SMEM–3/09
Figure 6. Start and Stop Definitions
Figure 7. Output Acknowledge
Device
Architecture
User ZonesThe EEPROM user memory is divided into 4 zones of 1024 bits each. Multiple zones allow for
different types of data or files to be stored in different zones. Access to the user zones is allowed
only after security requirements have been met. These security requirements are defined by the
user during the personalization of the device in the configuration memory. If the same security
requirements are selected for multiple zones, then these zones may effectively be accessed as
one larger zone.
6
AT88SC0404C
2023JS–SMEM–3/09
AT88SC0404C
Figure 8. User Zone
ZONE$0$1$2$3$4$5$6$7
$00
User 0
-128 Bytes
-
$78
$00
User 1
User 2
User 3
-128 Bytes
-
$78
$00
-128 Bytes
-
$78
$00
-128 Bytes
-
$78
Control LogicAccess to the user zones occurs only through the control logic built into the device. This logic is
configurable through access registers, key registers and keys programmed into the configuration
memory during device personalization. Also implemented in the control logic is a cryptographic
engine for performing the various higher-level security functions of the device.
Configuration
Memory
2023JS–SMEM–3/09
The configuration memory consists of 2048 bits of EEPROM memory used for storing passwords, keys and codes and for defining security levels to be used for each user zone. Access
rights to the configuration memory are defined in the control logic and may not be altered by the
user.
7
Figure 9. Configuration Memory
$0$1$2$3$4$5$6$7
$00Answer To Reset
$08Fab CodeMTZCard Manufacturer Code
$10Lot History CodeRead Only
$18DCR Identification Number Nc
$20AR0PR0AR1PR1AR2PR2AR3PR3
$28
Reserved$30
$38
$40
Issuer Code
$48
$50
$58
$60
$68
For Authentication and Encryption useCryptography
$70
$78
$80
$88
$90
$98
For Authentication and Encryption useSecret
$A0
$A8
$B0PACWrite 0PACRead 0
Identification
Access Control
$B8PACWrite 1PACRead 1
$C0PACWrite 2PACRead 2
$C8
$D0
$D8
$E0
$E8PACWrite 7PACRead 7
$F0
$F8
8
AT88SC0404C
Reserved
ReservedForbidden
Password
2023JS–SMEM–3/09
AT88SC0404C
V
cc
I/O-SDA
RST
CLK-SCL
AT R
V
cc
I/O-SDA
RST
CLK-SCL
1
2
3
45
Security FusesThere are three fuses on the device that must be blown during the device personalization pro-
cess. Each fuse locks certain portions of the configuration memory as OTP memory. Fuses are
designed for the module manufacturer, card manufacturer and card issuer and should be blown
in sequence, although all programming of the device and blowing of the fuses may be performed
at one final step.
Protocol
Selection
Asynchronous
T = 0 Protocol
The AT88SC0404C supports two different communication protocols.
•Smart Card Applications: The asynchronous T = 0 protocol defined by ISO 7816-3 is used
for compatibility with the industry’s standard smart card readers.
•Embedded Applications: A 2-wire serial interface is used for fast and efficient
communication with logic or controllers.
The power-up sequence determines which of the two communication protocols will be used.
This power-up sequence complies with ISO 7816-3 for a cold reset in smart card applications.
•V
•Set I/O-SDA in receive mode.
•Provide a clock signal to CLK-SCL.
•RST goes high after 400 clock cycles.
The device will respond with a 64-bit ATR code, including historical bytes to indicate the memory
density within the CryptoMemory family. Once the asynchronous mode has been selected, it is
not possible to switch to the synchronous mode without powering off the device.
Figure 10. Asynchronous T = 0 Protocol (Gemplus Patent)
goes high; RST, I/O-SDA and CLK-SCL are low.
CC
Synchronous
2-wire Serial
Interface
2023JS–SMEM–3/09
The synchronous mode is the default after powering up VCC due to an internal pull-up on RST.
For embedded applications using CryptoMemory in standard plastic packages, this is the only
communication protocol.
•Power-up V
•After stable V
Figure 11. Synchronous 2-wire Protocol
Note:Five clock pulses must be sent before the first command is issued.
, RST goes high also.
CC
, CLK-SCL and I/O-SDA may be driven.
CC
9
Communication
Security Modes
Communications between the device and host operate in three basic modes. Standard mode is
the default mode for the device after power-up. Authentication mode is activated by a successful
authentication sequence. Encryption mode is activated by a successful encryption activation following a successful authentication.
Anti-tearingIn the event of a power loss during a write cycle, the integrity of the device’s stored data may be
recovered. This function is optional: the host may choose to activate the anti-tearing function,
depending on application requirements. When anti-tearing is active, write commands take longer
to execute, since more write cycles are required to complete them, and data are limited to eight
bytes.
Data are written first to a buffer zone in EEPROM instead of the intended destination address,
but with the same access conditions. The data are then written in the required location. If this
second write cycle is interrupted due to a power loss, the device will automatically recover the
data from the system buffer zone at the next power-up.
In 2-wire mode, the host is required to perform ACK polling for up to 8 ms after write commands
when anti-tearing is active. At power-up, the host is required to perform ACK polling, in some
cases for up to 2 ms, in the event that the device needs to carry out the data recovery process.
Write LockIf a user zone is configured in the write lock mode, the lowest address byte of an 8-byte page
constitutes a write access byte for the bytes of that page.
Example: The write lock byte at $080 controls the bytes from $080 to $087.
The write lock byte may also be locked by writing its least significant (rightmost) bit to “0”. Moreover, when write lock mode is activated, the write lock byte can only be programmed – that is,
bits written to “0” cannot return to “1”.
In the write lock configuration, only one byte can be written at a time. Even if several bytes are
received, only the first byte will be taken into account by the device.
10
AT88SC0404C
2023JS–SMEM–3/09
AT88SC0404C
CS
VERIFY CS
Write DATA
VERIFY RPW
D ATA
Checksum (CS)
VERIFY CS
Password
Verification
Authentication
Protocol
Passwords may be used to protect read and/or write access of any user zone. When a valid
password is presented, it is memorized and active until power is turned off, unless a new password is presented or RST becomes active. There are eight password sets that may be used to
protect any user zone. Only one password is active at a time, but write passwords give read
access also.
The access to a user zone may be protected by an authentication protocol. Any one of four keys
may be selected to use with a user zone.
The authentication success is memorized and active as long as the chip is powered, unless a
new authentication is initialized or RST becomes active. If the new authentication request is not
validated, the card loses its previous authentication and it should be presented again. Only the
last request is memorized.
Note:Password and authentication may be presented at any time and in any order. If the trials limit has
been reached (after four consecutive incorrect attempts), the password verification or authentication process will not be taken into account.
Figure 13. Password and Authentication Operations
ChecksumThe AT88SC0404C implements a data validity check function in the form of a checksum, which
may function in standard, authentication or encryption modes.
In the standard mode, the checksum is implemented as a Modification Detection Code (MDC), in
which the host may read an MDC from the device in order to verify that the data sent was
received correctly.
In the authentication and encryption modes, the checksum becomes more powerful since it provides a bidirectional data integrity check and data origin authentication capability in the form of a
Message Authentication Code (MAC). Only the host/device that carried out a valid authentication is capable of computing a valid MAC. While operating in the authentication or encryption
modes, the use of a MAC is required. For an ingoing command, if the device calculates a MAC
different from the MAC transmitted by the host, not only is the command abandoned but the
mode is also reset. A new authentication and/or encryption activation will be required to reacti-
2023JS–SMEM–3/09
vate the MAC.
11
EncryptionThe data exchanged between the device and the host during read, write and verify password
commands may be encrypted to ensure data confidentiality.
The issuer may choose to require encryption for a user zone by settings made in the configuration memory. Any one of four keys may be selected for use with a user zone. In this case,
activation of the encryption mode is required in order to read/write data in the zone and only
encrypted data will be transmitted. Even if not required, the host may elect to activate encryption
provided the proper keys are known.
Supervisor ModeEnabling this feature allows the holder of one specific password to gain full access to all eight
password sets, including the ability to change passwords.
Modify ForbiddenNo write access is allowed in a user zone protected with this feature at any time. The user zone
must be written during device personalization prior to blowing the security fuses.
Program OnlyFor a user zone protected by this feature, data within the zone may be changed from a “1” to a
“0”, but never from a “0” to a “1”.
Initial Device
Programming
To enable the security features of CryptoMemory, the device must first be personalized to set up
several registers and load in the appropriate passwords and keys. This is accomplished through
programming the configuration memory of CryptoMemory using simple write and read commands. To gain access to the configuration memory, the secure code must first be successfully
presented. For the AT88SC0404C device, the secure code is $60 57 34. After writing and verifying data in the configuration memory, the security fuses must be blown to lock this information in
the device. For additional information on personalizing CryptoMemory, please see the application notes Programming CryptoMemory for Embedded Applications and InitializingCryptoMemory for Smart Card Applications (at www.Atmel.com).
Ordering Information
Ordering CodePackageVoltage RangeTemperature Range
AT88SC0404C-MJ
AT88SC0404C-MP
AT88SC0404C-PU
AT88SC0404C-SU
AT88SC0404C-WI7 mil wafer2.7V–5.5VIndustrial (−40°C–85°C)
Package Type
M2 – J ModuleM2 ISO 7816 Smart Card Module
M2 – P ModuleM2 ISO 7816 Smart Card Module with Atmel
Note:1. Formal drawings may be obtained from an Atmel sales office.
12
AT88SC0404C
2023JS–SMEM–3/09
Packaging Information
Module Size: M2
Dimension*: 12.6 x 11.4 [mm]
Glob Top: Square - 8.8 x 8.8 [mm]
Thickness: 0.58 [mm]
Pitch: 14.25 mm
Ordering Code: MP
Module Size: M2
Dimension*: 12.6 x 11.4 [mm]
Glob Top: Round - 8.5 [mm]
Thickness: 0.58 [mm]
Pitch: 14.25 mm
∅
Ordering Code: MJ
*Note: The module dimensions listed refer to the dimensions of the exposed metal contact area. The actual dimensions
of the module after excise or punching from the carrier tape are generally 0.4 mm greater in both directions
(i.e., a punched M2 module will yield 13.0 x 11.8 mm).
AT88SC0404C
2023JS–SMEM–3/09
13
Ordering Code: SU
1150 E. Cheyenne Mtn. Blvd.
Colorado Springs, CO 80906