Skip to content

HardFOC driver

SE050 Driver

A C++17 driver for the NXP EdgeLock SE050 secure element. It brings up the T=1 over I2C link, selects the IoT applet and sends its commands: random numbers, secure objects, on-chip EC key generation, ECDSA signing and verification, AES, and an optional GlobalPlatform SCP03 channel, on any MCU with I2C.

Quickstart API guide Source on GitHub

The driver has no platform code. You give it a small class that writes and reads bytes on I2C and, if your board wires it, drives the SE050's ENA pin; it does the rest: T=1 framing and CRC, chaining, waiting-time extensions, APDU and TLV encoding, and the SCP03 wrap. It allocates nothing and contains no keys.

Plug & Trust secure element SE050 NXP Semiconductors (EdgeLock)
Function
Key storage and crypto: ECC (NIST P-192 to P-521, Brainpool, Curve25519), RSA, AES, SHA-1 and SHA-2, HMAC, TRNG
Host interface
I2C target, address 0x48, T=1 over I2C (UM11225); up to 1 MHz, 3.4 MHz with clock stretching
Supply
VIN, VCC 1.62 V to 3.6 V (1.8 V typical); 6 V absolute maximum
Memory and security
Up to 50 kB user flash; CC EAL 6+; SCP03 bus encryption
Package and range
HX2QFN20, 3 mm × 3 mm; −25 °C to 85 °C or −40 °C to 105 °C by part number
Driver uses
The IoT applet over plaintext T=1, or over a platform SCP03 channel with keys you provision

Datasheet (NXP) · APDU specification AN12413 · Errata sheet

What you get

  • One object per chip. se050::Device<YourI2c> exposes the applet's commands: GetRandom, WriteBinary, ReadObject, GenerateEcKeyPair, EcdsaSign, EcdsaVerify, CipherAesEcb and more. See the API guide.
  • The link layer handled. T1Session frames blocks, checks the CRC-16, chains in both directions and answers WTX and resynchronisation requests. See T=1 over I2C.
  • Keys stay in the chip. Key pairs are generated inside the SE050; the host only ever sees public keys and signatures. See Security model.
  • SCP03 without default keys. The secure channel opens only with keys you supply at run time; the driver ships no NXP default keys. See Security model.
  • Zero-overhead portability. The port is a CRTP class: no virtual calls, no heap, no RTOS dependency. See Porting.
  • Tested without hardware. Host unit tests run the driver against a model of the SE050's T=1 target. See Testing and CI.

Where to go next

  • Quickstart

    Wire four signals, write the port, read random bytes from the chip.

  • Hardware

    Pins, supplies, I2C speed and address, power-down and reset.

  • Security model

    What the driver protects, key provisioning, SCP03, deployment flows.

  • API guide

    Bring-up, objects, keys and signatures, raw APDUs and errors, task by task.

  • Porting

    Implement the I2C interface for your MCU.

  • API reference

    Every class and function, generated from the headers.