NXP Semiconductors SE051A2HQ1/Z01XEZ

Overview

SE051A2HQ1/Z01XEZ from NXP Semiconductors is a Common Criteria EAL 6+ certified secure element IC designed as an auxiliary root-of-trust device for IoT endpoints. It implements I²C-based host-target communication, supports SCP03-secured channels with AES-128 session keys, and delivers cryptographic services including ECC P-256/P-384, RSA-2048/3072, and SHA-256/384. It is deployed in embedded security modules requiring tamper-resistant key storage and TLS onboarding.

For engineers reviewing the SE051A2HQ1/Z01XEZ datasheet, SE051A2HQ1/Z01XEZ pinout, SE051A2HQ1/Z01XEZ application, or SE051A2HQ1/Z01XEZ equivalent, this page provides verified technical context, confirmed CMake build configuration (PTMW_SE05X_Ver = 07_02, SSSFTR_SE05X_RSA = disabled), SCP03 binding capability, and validated alternative part options for secure IoT design-in.

Technical Context

The SE051A2HQ1/Z01XEZ operates exclusively as an I²C target device under host controller direction, with no autonomous bus master capability. Its firmware implements Java Card OS v3.0.5 with Secure Element applet SE05X_A, supporting ISO/IEC 7816-4 APDUs and GlobalPlatform SCP03 v1.2 for mutual authentication and encrypted channel establishment.

It uses static AES-128 keys (Key-ENC, Key-MAC, Key-DEK) stored in the Secondary Security Domain to derive ephemeral S-ENC, S-MAC, and S-RMAC session keys per transaction. The device requires explicit CMake configuration (SSS_PFSCP_ENABLE_SE051A_0001A920) to enable platform binding and does not support contactless antenna interfaces.

Key Specifications

Availability

SE051A2HQ1/Z01XEZ is available at Aetrix Electronics and suitable for industrial IoT gateways, medical edge devices, and smart metering systems requiring stable component supply, long-term lifecycle assurance, and certified cryptographic integrity.

Supply support for SE051A2HQ1/Z01XEZ includes scheduled delivery planning, volume procurement assistance, BOM continuity management, traceable sourcing, and lifecycle availability coordination for OEM customers, industrial embedded developers, connected-device designers, and electronics production programs.

Manufacturer

NXP Semiconductors is a global semiconductor company headquartered in Eindhoven, Netherlands, specializing in secure connectivity solutions for automotive, industrial, and IoT markets.

The EdgeLock SE05x product line - including SE051A2HQ1/Z01XEZ - is engineered specifically for scalable, standards-compliant root-of-trust deployment in resource-constrained IoT endpoints, with emphasis on seamless integration via I²C and middleware abstraction.

FAQ

What is the exact security certification level of SE051A2HQ1/Z01XEZ?

SE051A2HQ1/Z01XEZ is certified to Common Criteria EAL 6+ under AVA_VAN.5 and ASE_TSP.1, validated against physical probing, differential power analysis, and fault injection. This certification applies specifically to the SE051A2 variant with OEF ID A920 and applet SE05X_A, as documented in NXP's CC certification report #CCRA-2022-0012. The SE051A2HQ1/Z01XEZ device inherits this certification without deviation.

Does SE051A2HQ1/Z01XEZ support contactless communication or NFC?

No, SE051A2HQ1/Z01XEZ does not support contactless interfaces. Unlike SE052 variants, it lacks native antenna connection pins and RF front-end circuitry. Its interface is strictly wired I²C (SDA/SCL/VDD/GND/RESET), and all documentation - including AN13013 Table 7 and NXP's SE051 product brief - confirms absence of contactless capability for the SE051A2 variant.

What I²C address does SE051A2HQ1/Z01XEZ use by default?

SE051A2HQ1/Z01XEZ uses a fixed 7-bit I²C address of 0x48 (0x90 write, 0x91 read) in standard and fast modes. This address is hard-coded in the SE05X_A applet and cannot be reconfigured. It is consistent across all SE051A2 units and verified in NXP's fsl_sss_i2c.c driver implementation and AN13013 Section 4.1.2.1 CMake configuration notes.

Which cryptographic algorithms are hardware-accelerated in SE051A2HQ1/Z01XEZ?

SE051A2HQ1/Z01XEZ hardware-accelerates ECC P-256 and P-384 scalar multiplication, SHA-256 and SHA-384 hashing, and AES-128 encryption/decryption for SCP03 session keys. RSA-2048/3072 is supported but runs in firmware (not hardware-accelerated), as confirmed by SSSFTR_SE05X_RSA = disabled in its official CMake settings (OEF ID A920, Table 7, AN13013).

How is Platform SCP binding configured for SE051A2HQ1/Z01XEZ?

Platform SCP binding for SE051A2HQ1/Z01XEZ requires enabling SSS_PFSCP_ENABLE_SE051A_0001A920 in fsl_sss_ftr.h.in and setting PTMW_SE05X_Auth = None and PTMW_SCP = SCP03_SSS in CMake. The static AES-128 keys (Key-ENC/MAC/DEK) must be provisioned identically in both host firmware and SE051A2HQ1/Z01XEZ's SSD before first use - no factory-default keys are active.