The host uses this command to generate a key pair to be used for a certificate signing request (CSR). The key pair generated will be 256 bit elliptic-curve (EC) keys. The key pair generated will be saved to non-volatile memory in the device and will overwrite any existing CSR key pair. The key pair will persist in non-volatile memory associated with a CSR until it is either overwritten or until a leaf certificate is loaded into the device with Start Send File to Device (Secured) - Command 0xD811 that contains a public key that matches the key pair at which point the key pair will be associated with that certificate instead of a CSR.
The sequence of events is as follows:
1
Host sends command request
The host constructs the command request in the format below and sends it to the device.
2
The device sends a response in the format below to the host to indicate that key pair generation has been started.
3
Once the device finishes generating the key pair, it will send Device Information Update - Notification 0x1001 with the category set to key management and the reason set to CSR keys generated to indicate that the key pair generation process has completed.
The device typically takes around a second or two to generate a 256 bit EC key pair. If this command is extended in the future to support 2048 bit RSA keys, then it will take an average of 30 seconds and sometimes much longer to generate the RSA keys. That is why a notification is used to indicate that the key pair has been generated instead of a command response that indicates that it is complete.
4
The host will typically send Generate CSR (WLAN Only) - Command 0xEF03 as the next step. See that command for more detail and more potential steps.
Tag
Len
Value / Description
Typ
Req
Default
Tag
Len
Value / Description
Typ
Req
Default
Example (Hex):
Beginning of any wrappers, at minimum including Request Message
Beginning of any wrappers, at minimum including Response Message
Example (hex)
AA00 81 04 0155EF02 84 02 EF02
AA00 81 04 8205EF02 82 04 01000000 84 02 EF02
Device sends immediate response
Device sends notification when generation completes
Host typically requests CSR next
Generate CSR keys (WLAN Only) - Request Data for Command 0xEF02
Response Data for Generate CSR keys (WLAN Only) - Command 0xEF02