NXP Semiconductors SE051P2HQ1/Z011AZ

Overview

SE051P2HQ1/Z011AZ from NXP Semiconductors is a Common Criteria EAL 6+ certified secure element IC designed as an I²C-connected auxiliary security device for IoT host controllers. It supports SCP03-secured communication, cryptographic offload (ECC, AES, SHA), and root-of-trust services including key provisioning, certificate management, and secure boot attestation. It is deployed in embedded Linux and RTOS-based edge nodes requiring hardware-enforced identity and data protection.

For engineers reviewing the SE051P2HQ1/Z011AZ datasheet, SE051P2HQ1/Z011AZ pinout, SE051P2HQ1/Z011AZ application, or SE051P2HQ1/Z011AZ equivalent, this page delivers verified technical context, I²C interface behavior, SCP03 binding requirements, secure applet versioning (v07.02), and real-world integration constraints for i.MX RT, Kinetis, and Raspberry Pi platforms.

Technical Context

The SE051P2HQ1/Z011AZ operates exclusively as an I²C target device, with no controller-mode capability. Its Java Card OS implements GlobalPlatform SCP03 v1.2 using three static 128-bit AES keys (Key-ENC, Key-MAC, Key-DEK) stored in the Secondary Security Domain - not within the applet - enabling mutual authentication, command/response MACing, and payload encryption over the physical I²C bus.

It runs the SE05X_C applet variant (v07.02), supports Platform SCP binding to host MCUs/MPUs, and requires explicit CMake configuration (PTMW_SE05X_Ver=07_02, PTMW_Applet=SE05X_C) in the Plug & Trust Middleware. No RSA support is included, and SSSFTR_SE05X_RSA must be disabled during build.

Key Specifications

Availability

SE051P2HQ1/Z011AZ is available at Aetrix Electronics and suitable for industrial IoT gateways, smart metering endpoints, medical edge devices, and automotive telematics modules requiring stable component supply, long-term lifecycle assurance, and traceable sourcing of CC EAL 6+ certified secure elements.

Supply support for SE051P2HQ1/Z011AZ includes scheduled delivery planning, volume procurement assistance, BOM continuity management, traceable sourcing, and lifecycle availability coordination for OEM customers, industrial embedded developers, connected-device designers, and electronics production programs.

Manufacturer

NXP Semiconductors is a global semiconductor company headquartered in Eindhoven, Netherlands, specializing in secure connectivity, automotive, industrial, and IoT solutions.

The EdgeLock SE05x family - including SE051P2HQ1/Z011AZ - was designed to deliver plug-and-trust hardware root-of-trust for resource-constrained IoT endpoints, enabling rapid integration of FIPS 140-2/3-aligned cryptography and GlobalPlatform-compliant secure channel protocols.

FAQ

What is the primary interface and addressing mode used by the SE051P2HQ1/Z011AZ?

The SE051P2HQ1/Z011AZ communicates exclusively via I²C as a target device with a fixed 7-bit slave address of 0x48. It does not support SPI, UART, or contactless interfaces. Host MCU/MPU must act as I²C controller, and all APDU exchanges follow ISO/IEC 7816-4 conventions over this bus. The SE051P2HQ1/Z011AZ does not implement I²C controller functionality or multi-master arbitration.

Does the SE051P2HQ1/Z011AZ support RSA cryptography?

No, the SE051P2HQ1/Z011AZ does not support RSA operations. Its cryptographic engine is optimized for ECC (NIST P-256 and P-384), AES-128/256, and SHA-256. Build configurations for the Plug & Trust Middleware must explicitly disable SSSFTR_SE05X_RSA, and the SE05X_C v07.02 applet running on SE051P2HQ1/Z011AZ omits RSA key generation, signing, or verification capabilities.

How is secure binding implemented between the host processor and the SE051P2HQ1/Z011AZ?

Secure binding uses GlobalPlatform SCP03 v1.2, requiring pre-provisioning of three static 128-bit AES keys (Key-ENC, Key-MAC, Key-DEK) into both the host firmware and the SE051P2HQ1/Z011AZ's Secondary Security Domain. The Plug & Trust Middleware enables SCP03 via CMake flags (e.g., PTMW_SCP=PlatfSCP03), and session keys are derived dynamically to prevent replay attacks. Binding is mandatory for encrypted, authenticated communication.

Which applet version and variant is preloaded on the SE051P2HQ1/Z011AZ?

SE051P2HQ1/Z011AZ ships with the SE05X_C applet variant, version 07.02. This is confirmed by NXP's official CMake configuration tables and product-specific build settings. Applet version 07.02 supports ECC P-256/P-384, AES-128/256, SHA-256, and SCP03 binding - but excludes RSA and legacy FIPS 140-2 modes deprecated after v04.05.00.

Can the SE051P2HQ1/Z011AZ operate as an I²C controller to manage external sensors?

No. Unlike certain SE05x variants (e.g., SE052F), the SE051P2HQ1/Z011AZ is strictly an I²C target device. It has no secondary I²C controller interface and cannot initiate transactions with sensors or peripherals. All communication is initiated by the host MCU/MPU, and the SE051P2HQ1/Z011AZ responds only to valid APDUs addressed to its 0x48 slave address.