Reference Security

Reference: security

commander.security — SecurityCommand. Secure Engine commands. All methods return a dict. See Command-Reference for shared conventions.

Many of these operations change device lifecycle/security state, some permanently (OTP writes, disabling device erase). Several accept prompt — set prompt=False to emit --noprompt and skip the interactive confirmation, and most accept dryrun=True (--dryrun) to preview without applying. Most accept reset=True (reset=False → --noreset).

For task-oriented wrappers, prefer Target-Class (getSecurityStatus, lockDebugAccess, unlockDebugAccess, write*Key, region config, SE firmware, …).

attestation(reset=True, **kwargs)

Run Secure Engine attestation.

closeregion(index, reset=True, codeversion=None, **kwargs)

Close a code region by index. Series 3 only. codeversion sets the code version.

disabledeviceerase(reset=True, dryrun=False, prompt=True, **kwargs)

Disable the device-erase capability. ⚠️ Permanent.

disabletamper(reset=True, store=True, cert=None, cert_privkey=None, command_key=None, cert_signature=None, command_signature=None, authorization=None, cert_pubkey=None, disable_param=None, **kwargs)

Disable tamper detection, supplying the relevant certificate/signature/authorization material. store=False → --nostore.

erasedevice(reset=True, dryrun=False, **kwargs)

Erase the device via the Secure Engine.

fwupgrade(filename="", reset=True, address=None, prompt=True, **kwargs)

Upgrade the Secure Engine firmware from filename, optionally at address.

fwupgradecheck(reset=True, **kwargs)

Check whether an SE firmware upgrade is available.

genauth(outfile=None, store=True, deviceserialno=None, reset=True, **kwargs)

Generate authorization data (to outfile and/or stored on device).

gencert(outfile=None, store=True, deviceserialno=None, reset=True, cert_pubkey=None, authorization=None, command_key=None, extsign=False, **kwargs)

Generate a Secure Engine certificate. extsign=True outputs an unsigned form for external signing.

gencommand(outfile=None, store=True, reset=True, action=None, disable_param=None, unlock_param=None, **kwargs)

Generate a Secure Engine command (e.g. disable/unlock actions).

genconfig(outfile=None, store=True, deviceserialno=None, reset=True, **kwargs)

Generate a Secure Engine configuration.

genkey(type, outfile=None, privkey=None, pubkey=None, **kwargs)

Generate a Secure Engine key. type selects the algorithm; outfile/privkey/pubkey choose outputs.

getpath(reset=True, deviceserialno=None, **kwargs)

Get the Secure Engine / certificate path.

lock(reset=True, dryrun=False, trustzone=None, **kwargs)

Lock the Secure Engine / device. trustzone supplies a TrustZone configuration.

lockconfig(reset=True, secure_debug_unlock=None, dryrun=False, prompt=True, **kwargs)

Lock the Secure Engine configuration. secure_debug_unlock enables/disables secure debug unlock.

otprollbackcount(reset=True, **kwargs)

Read the OTP rollback count.

provision(reset=True, sefw=None, **kwargs)

Provision the Secure Engine. sefw is the SE firmware file.

readcert(cert_type, outfile=None, reset=True, **kwargs)

Read a Secure Engine certificate of cert_type (optionally to outfile).

readconfig(reset=True, **kwargs)

Read the Secure Engine configuration.

readkey(sign=False, command=False, outfile=None, reset=True, store=True, **kwargs)

Read a Secure Engine key. Choose sign and/or command.

readregionconfig(outfile=None, reset=True, **kwargs)

Read the code-region configuration. Series 3 only.

rollchallenge(reset=True, store=True, **kwargs)

Roll the challenge value (store=False → --nostore).

status(reset=True, trustzone=False, verbose=False, **kwargs)

Read the Secure Engine status. trustzone=True includes TrustZone info; verbose=True adds detail.

transitiontodevelopment(reset=True, dryrun=False, prompt=True, **kwargs)

Transition the device to development (unlock for debug).

unlock(reset=True, store=True, cert=None, cert_privkey=None, command_key=None, cert_signature=None, command_signature=None, authorization=None, cert_pubkey=None, unlock_param=None, **kwargs)

Unlock the Secure Engine, supplying certificate/signature/authorization material.

writeconfig(store=True, reset=True, dryrun=False, prompt=True, configfile=None, **kwargs)

Write a Secure Engine configuration to the device.

writekey(sign_keyfile=None, command_keyfile=None, decrypt_keyfile=None, reset=True, store=True, prompt=True, dryrun=False, **kwargs)

Write Secure Engine key(s) to the device — sign (--sign), command (--command), and/or decrypt (--decrypt). ⚠️ OTP writes are permanent.

writeregionconfig(file, reset=True, **kwargs)

Write a code-region configuration from file. Series 3 only.