NXP Semiconductors SE051W2HQ1/Z019TZ

Overview

SE051W2HQ1/Z019TZ from NXP Semiconductors is a Common Criteria EAL 6+ certified secure element IC designed for root-of-trust implementation in IoT endpoints. It supports I²C host interface, SCP03-secured communication, AES-128/ECDSA-P256 cryptographic operations, and pre-provisioned Platform SCP keys (OEF ID A739). It is deployed in secure boot, device authentication, and TLS credential storage for industrial gateways.

For engineers reviewing the SE051W2HQ1/Z019TZ datasheet, SE051W2HQ1/Z019TZ pinout, SE051W2HQ1/Z019TZ application, or SE051W2HQ1/Z019TZ equivalent, this page delivers verified technical context, CMake build configuration guidance (PTMW_SE05X_Ver = 07_02, SSSFTR_SE05X_RSA disabled), SCP03 key enablement (SSS_PFSCP_ENABLE_SE051W_0005A739), and integration constraints for Linux/mbedTLS/OpenSSL stacks.

Technical Context

The SE051W2HQ1/Z019TZ implements a Java Card OS-based secure subsystem with dedicated cryptographic co-processor for asymmetric (ECDSA-P256) and symmetric (AES-128) operations. Its I²C interface operates at up to 1 MHz with configurable address (0x48 default) and supports both plain and SCP03-encrypted command/response APDUs.

It integrates a tamper-resistant hardware security module compliant with ISO/IEC 15408 EAL 6+ and supports GlobalPlatform SCP03 binding using three static 128-bit AES keys (Key-ENC, Key-MAC, Key-DEK), with session keys derived per transaction to prevent replay attacks.

Key Specifications

Availability

SE051W2HQ1/Z019TZ is available at Aetrix Electronics and suitable for industrial IoT gateways, smart metering systems, and medical edge devices requiring stable component supply, long-term lifecycle assurance, and CC EAL 6+ compliance.

Supply support for SE051W2HQ1/Z019TZ includes scheduled delivery planning, volume procurement assistance, BOM continuity management, traceable sourcing, and lifecycle availability coordination for OEM customers, industrial embedded developers, connected-device designers, and electronics production programs.

Manufacturer

NXP Semiconductors is a global semiconductor leader specializing in secure connectivity solutions for automotive, industrial, and IoT markets, with over 30 years of embedded security IP development.

The EdgeLock SE05x product line - including SE051W2HQ1/Z019TZ - is engineered specifically for scalable, drop-in root-of-trust deployment in resource-constrained IoT endpoints, emphasizing certified security, minimal host software footprint, and seamless middleware integration.

FAQ

What is the certified security level of SE051W2HQ1/Z019TZ?

SE051W2HQ1/Z019TZ is certified to Common Criteria EAL 6+, the highest publicly available assurance level for commercial secure elements. This certification covers resistance to physical probing, differential power analysis, fault injection, and logical attacks - validated by accredited labs per ISO/IEC 15408. The certification applies directly to the SE051W2HQ1/Z019TZ silicon and its preloaded SE05X_C applet.

Does SE051W2HQ1/Z019TZ support RSA cryptography?

No, SE051W2HQ1/Z019TZ does not support RSA. Its cryptographic engine is optimized for ECDSA-P256 and AES-128 only. The CMake build flag SSSFTR_SE05X_RSA must be disabled, and attempts to invoke RSA operations will result in unsupported command errors. This design reduces memory footprint and attack surface while meeting modern IoT PKI requirements.

How is SCP03 binding configured for SE051W2HQ1/Z019TZ in the Plug & Trust middleware?

SCP03 binding for SE051W2HQ1/Z019TZ is enabled by setting SSS_PFSCP_ENABLE_SE051W_0005A739 = 1 in fsl_sss_ftr.h.in and selecting PTMW_SE05X_Ver = 07_02 and PTMW_Applet = SE05X_C in CMake. The static AES-128 keys (Key-ENC/MAC/DEK) are pre-provisioned and referenced via the OEF ID A739; no runtime key injection is required for basic binding.

Which host platforms and OSes are officially supported with SE051W2HQ1/Z019TZ?

SE051W2HQ1/Z019TZ is officially supported on Linux (including MCIMX8M-EVK and Raspberry Pi), FreeRTOS, Zephyr, mbedOS, Windows, and Android via the Full Multiplatform Plug & Trust Middleware. Integration examples exist for i.MX RT1060/RT1170, Kinetis K64F, LPC55S69, and i.MX 8M - all using I²C as the sole physical interface.

What development board is compatible with SE051W2HQ1/Z019TZ for rapid prototyping?

The OM-SE051ARD Arduino-compatible development kit is the designated evaluation platform for SE051W2HQ1/Z019TZ. It provides standardized headers, onboard level-shifting, and preconfigured I²C routing - enabling direct connection to FRDM-K64F, MIMXRT1060-EVK, and Raspberry Pi (via OM-SE05xRPI adapter). No custom PCB is needed for initial bring-up.