Ecc
ECC provisioning status returned by Miura command EE 00 (P1=0, P2=0).
The response is a single status byte interpreted as a bitmask:
Bit 0 (0x01): EC terminal certificate installed (
terminal-ecc-cert.json, installed via EE 02)Bit 1 (0x02): EC key-signing certificate installed (
ec-keysign-main-user.crt, installed via EE 03)
Normal provisioning sequence
NOT_CONFIGURED (0x00) — factory state, no ECC certificates present.
Install
ec-keysign-main-user.crtvia EE 03 → KEY_SIGNING_CERTIFICATE_INSTALLED (0x02). This is a prerequisite for CSR generation.Generate and export the ECC terminal CSR via EE 01; upload
terminal-ecc-csr.jsonto the signing authority (Miura). Device remains at 0x02 during this step.Receive signed response
terminal-ecc-cert.json; install via EE 02. On success the device restarts automatically.After restart → READY_FOR_EC_RKI (0x03). The device is now ready for EC-based remote key injection.
Notes
TERMINAL_CERTIFICATE_INSTALLED (0x01, bit 0 only) is anomalous: it would mean the terminal cert is present but the key-signing cert has somehow been removed. This is not expected in normal operation and has not been observed in practice, since the device restarts after EE 02 and comes up with both bits set (0x03).
UNKNOWN is a local sentinel (not a device-reported value) used when the device does not support ECC (e.g. older MPI/OS) or the status query failed. The ECC POI component is omitted from the StatusReport entirely in this case.
Entries
Neither certificate installed. Factory/unconfigured state.
EC terminal certificate installed (bit 0), but key-signing certificate absent (bit 1 clear). Anomalous — not expected in normal operation. See class KDoc for details.
EC key-signing certificate installed (bit 1), terminal certificate not yet installed (bit 0 clear). This is the normal intermediate state: the device is ready to generate a CSR and provide it to the TMS for signing. Reported as WAITING_ACTIVATION in the StatusReport.
Both certificates installed (bits 0 and 1 set). The device is fully provisioned and ready for EC-based remote key injection (EC RKI). Reported as IN_OPERATION in the StatusReport.