Module privwrite 

PrivWrite command.

Writes a P-256 private key from the host into a slot.

Project policy

This command is intentionally NOT used for the user identity key. User identity keys (slots 0..=4 in this project) are generated on-chip via crate::AteccChannel::genkey_create so that the private material never traverses the host or the USB bus. PrivWrite exists here for bring-up and for the V3 attestation slot (slot 7) only, both controlled by a privileged path in tools/hsm-host.

Modes

Two modes exist:

• Cleartext (param1 = 0x00). Only accepted before the data zone is locked. Used during bring-up to load known test keys.
• Encrypted (param1 = 0x40). Required after data zone lock. The data field carries ciphertext plus a 32-byte MAC. The driver does not currently expose the encrypted path: the orchestration is service-layer work that depends on crate::AteccChannel::nonce_random + crate::AteccChannel::gendig and the matching host-side key derivation. It will be added when that orchestration lands.

Reference: CryptoAuthLib lib/calib/calib_priv_write.c, constants PRIV_WRITE_MODE_ENCRYPT (0x40).

Data layout

Cleartext: 4-byte zero padding then the 32-byte raw private scalar (big-endian, the natural P-256 byte order).

[00 00 00 00] [P-256 scalar, 32 bytes BE]

Constants

PRIVWRITE_CLEARTEXT_SIZE

Cleartext PrivWrite payload size (4 padding + 32 scalar).

PRIVWRITE_MODE_CLEARTEXT 🔒

param1 mode for cleartext PrivWrite (data zone unlocked only).