DS28E25Q+U - 1-Wire SHA-256 Secure Authenticator | Analog Devices
MPN: DS28E25Q+U ✓ Active| Qty | Unit Price | Extended |
|---|---|---|
| 1 | $1.95 | $1.95 |
| 10 | $1.78 | $17.80 |
| 100 | $1.67 | $167.00 |
| 500 | $1.55 | $775.00 |
| 1,000 | $1.42 | $1,420.00 |
DS28E25Q+U Overview
What is a secure authenticator? A secure authenticator is a specialized IC that proves the authenticity of a peripheral, accessory, consumable, or sensor to a host processor using a hardware-stored cryptographic key that is never exposed on the bus. Authenticators sit beneath cryptographic coprocessors, secure elements, and Trusted Platform Modules in the security-IC hierarchy; they are typically the lowest-cost and smallest-footprint option for hardware-based anti-counterfeiting in resource-constrained nodes such as printer cartridges, medical sensors, and IoT accessories.
Key features of the DS28E25Q+U include SHA-256 challenge-and-response authentication, 4 Kb (512 bytes) of user EEPROM organized as sixteen 32-byte pages, an increment-only counter for monotonic anti-rollback usage tracking, a programmable GPIO with optional authentication-gated control, and on-chip 1-Wire parasitic-power support that allows the device to draw operating current from the data line when an external supply is not present. Each device ships with a factory-programmed 64-bit registration number that is guaranteed unique and is used as the address on the 1-Wire bus.
The DS28E25Q+U leverages Analog Devices' DeepCover physical-security techniques, including active die shielding, cryptographic key generation on-chip, and storage of the master secret in non-readable memory that resists both invasive and non-invasive attack vectors. A 1-Wire front-end reduces the host-side pin count to a single data line plus ground, simplifying board layout in dense systems where GPIO is scarce.
Typical applications include printer cartridge authentication and refill detection, IoT sensor/peripheral pairing and anti-counterfeiting, medical device accessory identification and calibration data storage, secure feature setting for configurable systems, license management, and intellectual property protection. Designers pair the DS28E25Q+U with a host MCU or SoC running Maxim's DS2465 or DS2480B 1-Wire bridge.
When designing with the DS28E25Q+U, place a low-ESR decoupling capacitor close to the VCC pin when parasitic power is not used, and observe Maxim's 1-Wire timing guidelines to maintain bus integrity across cable lengths up to 100 m. Designers should also evaluate the optional GPIO mode early - using authentication to gate a power rail or enable signal removes the need for a separate secure load switch.
This page synthesizes distributor pricing, drop-in alternatives, and practical design notes not found in the manufacturer datasheet.
Drop-in alternatives for DS28E25Q+U — same package, pin-to-pin compatible. Different-package parts requiring PCB rework are excluded.
Variants in this series
Same-series models that are drop-in compatible with DS28E25Q+U (same form factor and footprint) — differing in Mounting Type, Package, Product Type, Security Features, User EEPROM.
Quick Comparison Tool — Select alternative parts for side-by-side comparison:
DS28E25Q+T
✅ Drop-In📋 Reference alternative (not in catalog)
DS28E25+
✅ Drop-In✓ In Stock
$2.1 / Unit
View Datasheet →DS28E07Q+T
✅ Drop-In📋 Reference alternative (not in catalog)
DS28E25Q+U Maximum Ratings & Electrical Characteristics
| Product Type | DeepCover Secure Authenticator (SHA-256) |
| Authentication Algorithm | SHA-256 (FIPS 180-3 compliant) / HMAC-SHA256 |
| User EEPROM | 4 Kbit (512 bytes, 16 pages of 32 bytes) |
| Bus Interface | Maxim 1-Wire (single data line, optional parasitic power) |
| Operating Voltage | 2.97 V to 3.63 V |
| Unique ROM ID | 64-bit factory-programmed |
| Package | 6-TDFN (3x3 mm) |
| Pin Count | 6 |
| Mounting Type | Surface Mount |
| GPIO / Control Pin | Yes, programmable, authentication-gated |
| Increment-Only Counter | Yes (for monotonic usage tracking) |
| Operating Temperature Range | -40 C to +85 C (industrial) |
| Parasitic Power Support | Yes (1-Wire) |
| Security Features | DeepCover active die shield, on-chip key generation, non-readable secret storage |
| Compatible Host Bridge | DS2465, DS2480B, DS2482S/DS2483 |
| RoHS Status | Compliant |
| MSL Level | 1 (per JEDEC J-STD-020) |
DS28E25Q+U Pin Configuration
| Pin 1 | IO — 1-Wire data line (open-drain, requires external pull-up) |
| Pin 2 | GND — Ground reference |
| Pin 3 | NC — Not connected (per datasheet) |
| Pin 4 | NC — Not connected (per datasheet) |
| Pin 5 | GPIO — Programmable general-purpose I/O, authentication-gated |
| Pin 6 | VCC — External power supply input, 2.97 V to 3.63 V |
Typical Applications
DS28E25Q+U is suitable for 6 applications: Printer Cartridge Authentication & Anti-Counterfeiting, Medical Sensor & Accessory Authentication, IoT Peripheral Pairing & Anti-Cloning, License Management & Feature Setting, Secure Feature Setting for Configurable Systems, Intellectual Property Protection.
Printer Cartridge Authentication & Anti-Counterfeiting
The DS28E25Q+U is a strong fit for printer ink and toner cartridge authentication because its SHA-256 challenge-and-response authentication, 64-bit unique ROM ID, and 4 Kbit user EEPROM can store both the secret authentication key and per-cartridge lot/serial data. Mounted on the cartridge PCB, the device communicates with the printer's mainboard over a single 1-Wire line and draws power parasitically, eliminating any external wiring. The authentication-gated GPIO can also be used to enable the print head only after a successful SHA-256 verification, raising the cost barrier for cloning operations.
Recommended
Medical Sensor & Accessory Authentication
In disposable medical sensors (glucose strips, pulse-oximeter probes, infusion sets), the DS28E25Q+U authenticates the accessory and stores calibration coefficients in its 4 Kbit user EEPROM. Its 1-Wire single-pin interface minimizes the connector pin count, critical for low-cost disposables, and the SHA-256 engine prevents counterfeit consumables from reporting false readings. Per the datasheet, the device operates from -40 C to +85 C, covering clinical and home-use environments. Designers should still validate the full authentication flow under their applicable IEC 62304 / FDA software classification.
Recommended
IoT Peripheral Pairing & Anti-Cloning
The DS28E25Q+U lets an IoT sensor or accessory prove its authenticity to a gateway over a single GPIO pin, freeing the host MCU's UART or I2C pins for other uses. The device's HMAC-SHA256 implementation resists replay and key-extraction attacks, and the 4 Kbit user EEPROM holds per-device certificates. For battery-powered nodes, parasitic-power operation removes the need for a separate regulator on the accessory side. Pairing can be completed in factory provisioning without exposing the master secret to the host MCU.
Recommended
License Management & Feature Setting
OEMs use the DS28E25Q+U to license features on configurable systems such as industrial controllers, test equipment, and motor drives. The 4 Kbit EEPROM stores entitlement bits and unlock codes, while the SHA-256 engine signs each license check so the host cannot bypass authentication by replaying a previous response. Per the DS28E25 datasheet, the increment-only counter is ideal for usage-based licensing models. The 6-TDFN package fits on small daughtercards and inside sealed enclosures.
Recommended
Secure Feature Setting for Configurable Systems
Field upgrades and configuration changes can be locked behind DS28E25Q+U authentication, ensuring only authorized service tools can enable premium features. The authentication-gated GPIO can drive a hardware enable line to an FPGA bitstream loader or a motor-drive enable pin, providing physical rather than software-only gating. Per Analog Devices' DeepCover family documentation, this combination of cryptographic challenge-response and physical pin control closes the gap left by software-only security models.
Recommended
Intellectual Property Protection
Designers embed the DS28E25Q+U on their own PCBs to prevent unauthorized clones from interoperating with upstream systems. Because each device has a unique 64-bit ROM ID and a per-device secret, cloning requires physically extracting the key from the silicon - which the DeepCover active die shield is designed to prevent. The 4 Kbit user EEPROM also stores proprietary calibration or algorithm constants that cannot be read without first passing the SHA-256 challenge. This makes the DS28E25Q+U a cost-effective IP-protection anchor in industrial and consumer products.
Recommended
Recommended Products Summary
Engineering reference data for DS28E25Q+U — comparison, design guidance, and compliance information.
Selection Guide
Comparison with Alternatives
| Parameter | This Product | DS28E25Q+T | DS28E25+ | DS28E07Q+T |
|---|---|---|---|---|
| Brand | Analog Devices | Analog Devices | Analog Devices | Analog Devices |
| Package | 6-TDFN (3x3 mm) | 6-TDFN (3x3 mm) - same | 6-TDFN (3x3 mm) - same | 6-TDFN (3x3 mm) - same |
| Authentication Algorithm | SHA-256 (FIPS 180-3) | SHA-256 - same | SHA-256 - same | SHA-1 (weaker) |
| User EEPROM | 4 Kbit (512 bytes) | 4 Kbit - same | 4 Kbit - same | 1 Kbit (-75%) |
| Bus Interface | 1-Wire | 1-Wire - same | 1-Wire - same | 1-Wire - same |
| GPIO / Control Pin | Yes, authentication-gated | Yes - same | No (GPIO disabled) | Yes - same |
| Operating Voltage | 2.97 V to 3.63 V | 2.97 V to 3.63 V - same | 2.97 V to 3.63 V - same | 2.97 V to 3.63 V - same |
| Operating Temperature | -40 C to +85 C | -40 C to +85 C - same | -40 C to +85 C - same | -40 C to +85 C - same |
| 1 ku List Price (USD, as of 2026-10-07) | $1.67 | $1.67 (similar) | $1.67 (similar) | ~$1.20 (lower) |
Key Differentiators
- SHA-256 authentication strength (vs DS28E07Q+T)
- 4x larger user EEPROM (vs DS28E07Q+T)
- Drop-in same-package alternatives available within family (vs DS28E25Q+T)
Design Notes
The DS28E25Q+U requires a 4.7 kohm pull-up resistor on the IO line for standard 1-Wire speed and a 2.2 kohm pull-up for overdrive speed; using the wrong value causes intermittent read errors at long cable lengths. Decouple VCC with a 100 nF X7R ceramic capacitor placed within 3 mm of the VCC pin, even when parasitic power is the primary supply. Routers should never share the 1-Wire IO line with an I2C bus without proper isolation, because the two protocols are not directly compatible.
Keep the 1-Wire trace short (under 30 cm on standard speed, up to 100 m with proper cable and pull-up). Place the pull-up resistor close to the host's 1-Wire master pin. When designing for parasitic power, ensure the IO line high time is sufficient to charge the internal reservoir cap before the device returns a presence pulse. For noisy environments, add a TVS diode (such as SMAJ3.3CA) on the IO line to clamp ESD transients.
Match the rise time of the 1-Wire IO line to Maxim's specification (typically 5 us to 15 us at standard speed). Adding too much capacitance (above 1 nF on the IO line) slows the rise time and can cause read/write failures. When multiple DS28E25Q+U devices share a single 1-Wire bus, address discovery must use the 64-bit ROM ID search algorithm; random guessing is impossible because the address space is 2^64 wide.
Estimated: at 3.3 V VCC, the DS28E25Q+U active read current is approximately 1 mA and write current is up to 5 mA per the datasheet. For battery-powered peripherals that use parasitic power, the host must provide strong pull-up to VCC during long operations to keep the device's internal reservoir charged. Power dissipation is negligible (under 20 mW) so no thermal analysis is required.
Compliance Information
RoHS and REACH compliant per Analog Devices product page. Industrial temperature grade (-40 C to +85 C); no AEC-Q100 automotive variant offered. Halogen-free per JEDEC JS709B. Not subject to ITAR.
