1. Purpose and scope
A chip passes through many hands before it reaches a customer: the foundry and mask shop, wafer test, assembly, final test and distribution. Each site handles design data, test programs and, for a secure product, the keys and identities that make each device trustworthy. A weakness anywhere in this chain can undo the security designed into the silicon, for example by leaking keys, allowing extra parts to be made, or letting counterfeit parts enter the market.
This stage designs and qualifies the controls for that chain. The central piece is secure provisioning: generating keys under control, injecting them or certifying keys the chip generates itself, checking that each device attests correctly, issuing its certificate and locking test and debug before it leaves the test floor. Around it sit data protection, site security requirements, traceability and quantity reconciliation.
In scope: the provisioning flow specification, the key injection qualification report, the supply chain security assessment, the device certificate infrastructure and the test mode lock procedure. Out of scope: the key hierarchy and lifecycle states themselves, which are designed in Security Architecture.
14 more sections for registered members.