Module genkey 

GenKey command.

Generates a P-256 ECC key pair inside a slot, or computes the public key corresponding to a private key already stored in a slot.

Two operating modes are exposed:

• AteccChannel::genkey_create: instruct the chip to generate a new P-256 private key entirely on-chip in the target slot. The private key never leaves the device. The corresponding 64-byte public key is returned. Subject to KeyConfig.Private and the data zone lock state.

• AteccChannel::genkey_public: compute and output the public key corresponding to the private key already stored in the target slot. Read-only operation, useful at boot to retrieve the chip’s identity without re-generating the private key.

Reference: CryptoAuthLib lib/calib/calib_genkey.c, constants GENKEY_MODE_NEW_PRIVATE (0x04), GENKEY_MODE_PUBLIC (0x00).

Public key format

The returned 64 bytes are the uncompressed P-256 public key encoded as X || Y, each coordinate big-endian and 32 bytes wide. To produce the SEC1 uncompressed form expected by most libraries (including p256), prepend the 0x04 octet:

sec1 = [0x04] || X || Y

Constants

GENKEY_MODE_CREATE 🔒

param1 mode bits: generate a brand new private key inside the slot.

GENKEY_MODE_PUBLIC 🔒

param1 mode bits: only output the public key for the existing private key in the slot.

PUBLIC_KEY_SIZE

Size of the returned public key in bytes (X || Y, raw P-256).