KMU Data Integrity

RE: KMU Data Integrity

dejans — Thu, 06 Jul 2023 17:40:34 GMT

Hi,

We do not have mechanisms for checking the integrity of stored keys on nrf5340. You could try to implement yourself some kind of checksum-like software on top of KMU for integrity checking. You could use identity key (IK) in some cypher where you would compare current (from potentially changed IK) output with the output obtained from known pre-stored IK value. If 2 results are the same, you could then still trust your identity key.

[quote user="bjohnsonpt"]

In addition to cosmic radiation, read disturbance in NAND flash is another potential concern for identity key integrity, where repeated reads of surrounding areas of memory could potentially cause a nearby bit to flip.

Is there an available metric for expected read endurance, similar to the NVMC electrical characteristics table for writes and erases?
Mean time between failure?

[/quote]

I am not aware of the existence of the metrics which you describe that are available in the documentation, but you could try to contact your regional sales manager who could potentially provide more information.

Best regards,
Dejan

RE: KMU Data Integrity

bjohnsonpt — Wed, 05 Jul 2023 20:29:17 GMT

Hello Dejan,

To confirm, there is no form of error correction (e.g., hardware or software ECC) that covers data stored in the KMU. Is that right?

With the KMU being a subset of the UICR, we assume that the underlying storage medium is NAND flash. Is that correct?

Is there an available metric for expected read endurance, similar to the NVMC electrical characteristics table for writes and erases?
Mean time between failure?

What would be the recommended way to recover from a bit flip in the identity key? Is there a way that does not require physical access to the device?

RE: KMU Data Integrity

dejans — Fri, 30 Jun 2023 15:08:51 GMT

Hi,

It does not seem to be the way of ensuring that the keys stay unaffected (i.e. intact) after they have been exposed to radiation or cosmic rays.

Best regards,
Dejan

RE: KMU Data Integrity

bjohnsonpt — Thu, 29 Jun 2023 19:17:18 GMT

Hello Dejan,

Thanks for looking into that for me. Let me know if you need any more info

RE: KMU Data Integrity

dejans — Thu, 29 Jun 2023 18:10:53 GMT

Hi,

[quote user=""]We are wondering if there are any processes or checks in place to ensure integrity of the stored identity key? We are not terribly concerned with malicious tampering via physical means, but rather we are concerned about bit flips due to cosmic rays or other radiation exposure and corruption due to flash degradation over time, even if only reads are performed on the key. [/quote]

I have asked internally. I will get back to you when I get more information regarding your concerns, probably tomorrow or during next week.

Best regards,
Dejan