Shared Secret Key provisioning on the nRF5340, Options

[neo_here]

Hey All, 

We are working on a product based on the nRF5340. We will be using symmetric key authentication(HMAC) and was wondering the best way to go about provisioning the secret key. 

I've seen that there's a psa_set_key_lifetime api to set the key as persistent. I also saw the TF-M example where the KMU is used and the secret key is provisioned to one of the slots in the KMU. 

We are building the project as a _ns application. Was looking for some advice on my options for this. 

[neo_here]

To add on to the original post, this secret key provisioning is going to happen as a post manufacturing step. 

[Hieu]

Hi neo_here,

My colleague wrote a blog, with a section discussing different storage of keys. Please give it a read:
https://devzone.nordicsemi.com/nordic/nordic-blog/b/blog/posts/persistent-storage-of-keys-and-data-using-the-nrf-connect-sdk#Storage-alternatives-for-keys

Hieu

[neo_here]

Hi Hieu,

Thanks for the blog, I went through it and seems like PSA Crypto API are the way to go and I would like to avoid using the KMU directly.

But since we are going to import a key once and not generate it, Is using the secure storage API to store the Key handle the way to go ?

1) Use the PSA Crypto Import key API and import the key as persistent key

2) Store the Key handle in persistent storage with Secure Storage

3) Load the keyhandle from persistent storage subsequently throughout the lifecycle of the device or until it is reprovisioned

[Hieu]

Hi neo_here,

Yes, you can import the key and use it later with PSA Crypto API. It is certainly one good way to go.