SPRUJ79 November 2024 F29H850TU , F29H859TU-Q1
CPU-based debug authentication enables users to write customized code for debug authorization, instead of a simple password scan and compare. In this mode, the application can execute challenge-response authentication schemes using cryptographic algorithms, including schemes involving public/private key encryption pairs. Challenge-response authentication provides stronger security by eliminating the need to store a common password across all devices which, if stolen, potentially compromises security for existing deployed devices.
When CPU-based authentication is selected in DEBUG_CFG for a particular ZONE or for C29DBGEN, the corresponding register bit fields (ZONE_DBGEN.ZONEx, C29DBGEN.ENA) become valid, and the password comparison is ignored. The ZONE_DBGEN and C29DBGEN registers are only accessible by CPU1.LINK2 and the HSM. The application authorization code, running on CPU1.LINK2 or on the HSM, can read values scanned into the SEC-AP through the debugger, and through the interactive challenge-response process determine if and when to enable debug by writing to the C29DBGEN or ZONE_DBGEN registers.