Secure Smart Card Controller

SmartMX2-P40 family is a secure microcontroller family designed and manufactured by NXP Semiconductors. It is part of the SmartMX2-IC family produced in 90 nm CMOS technology. SmartMX2-P40 is an ISO/IEC 7816 compliant contact secure microcontroller platform, built around the proven and powerful MRK3-SC RISC core. The overall architecture of P40 has been streamlined to meet the performance requirements of payment and eGovernment contact smart card applications.

NXP‘s SmartMX2 P40 security architecture is built on more than 15 years of experience in this area. The SmartMX2-P40 product family provides embedded firmware forming a Hardware Abstraction Layer (HAL). The use of this HAL makes it easier to efficiently develop embedded software for the device.

SmartMX2-P40 supports DES, AES, ECC, RSA cryptography, hash computation, and random-number generation. For asymmetric RSA and ECC cryptography, a dedicated coprocessor supports RSA key lengths up to 4096 bits and ECC key lengths up to 521 bits. Coprocessors for symmetric ciphers support DES (single DES, 2-key 3DES, and 3-key 3DES), plus AES cryptography with bit lengths of 128-bit, 192-bit, or 256-bit. The memory configuration, which combines up to 265 KB User ROM, 6 KB RAM, up to 72 KB EEPROM, handles static code and dynamic data separately, and enables fast code execution from ROM.

The P40 family also provides a ready-to-use crypto library with highly efficient software APIs for all cryptographic functions (RSA key length up to 2048 bits, ECC up to 384 bits).

This document describes in detail the SmartMX2 P40 devices offering 13 KB to 72 KB EEPROM.

Table 1. Feature table

Product type	EEPROM [KB]	User ROM [KB]	Total RAM [B]	RAM allocation CPU/PKCC	Coprocessor			ISO/IEC 7816 IO pads	Interface option
					PKC	DES	AES
P40C012	13	up to 265	6144	dynamic	yes	yes	yes	1	ISO 7816
P40C040	40	up to 265	6144	dynamic	yes	yes	yes	1
P40C072	72	up to 265	6144	dynamic	yes	yes	yes	1

General remarks

This document offers an introduction into the features and the architecture of the SmartMX2 P40 products.

The product data sheet and other detailed documentation, e.g. for Card Operating System (COS) development are available through NXP’s portal for secured documentation. Access to such documents is granted on a need-to-know basis. Contact NXP sales for registration and access.

Naming conventions

Table 2. Naming conventions

P40xeee
x	Interface and feature configuration identifier, as currently defined, e.g.: x = C: Asymmetric and symmetric cryptography implemented, ISO/IEC 7816 contact interface
eee	Indication of the Non-Volatile memory size in KB eee = 040: For example: 40 KB EEPROM implemented

Contact interfaces

Operating in accordance with ISO/IEC 7816, the SmartMX2 P40 contact interface is supported by a built-in Universal Asynchronous Receiver/Transmitter (UART). P40 UART enables data rates of up to 688 kbit/s allowing for the automatic generation of all typical baud rates and supports transmission protocols T=0 and T=1.

Public Key Crypto (PKC) coprocessor

The PKCC is speeding up the computation of public-key cryptographic operations within the P40C012/040/072.

The PKC coprocessor flexible interface provides programmers with the freedom to implement their own cryptographic algorithms. A Common Criteria certified crypto library from NXP providing a large range of required functions is available for all devices in order to support customers in implementing public key-based solutions.

Coprocessor for DES and AES

The DES algorithm, widely used for symmetric encryption, is supported by a dedicated, high performance, highly attack-resistant hardware coprocessor. Relevant standards (ISO/IEC, ANSI, FIPS) are fully supported. A secure crypto library element for DES is available.

The same coprocessor supports secure AES as well. The implementation is based on FIPS197 as standardized by the National Institute for Standards and Technology (NIST), for key lengths of 128-bit, 192-bit, and 256-bit with performance levels comparable to DES. AES is the next generation for symmetric data encryption and recommended successor to DES providing significantly improved security level. A secure crypto library element for AES is available.

Security features

Advanced 0.09 μm CMOS technology, with seven metal layers, provides enhanced protection against reverse engineering and probing attacks, and produces a highly protective mesh of active and dynamic multi-threaded shielding.

SmartMX2 P40 incorporates a wide range of both inherent and OS-controlled security features as a countermeasure against all types of attacks. NXP Semiconductors apply their extensive knowledge of chip security, very dense CMOS technology and active shielding methodology.

As attacks evolve over time, the multi-dimensional approach of the SmartMX2 P40 security architecture allows for more proactive and continuous enhancements of the security mechanisms compared to alternative and less versatile approaches. This makes SmartMX2 P40 a future-proof secure micro-controller platform neutralizing all side channel and fault attacks as well as reverse engineering efforts.