Shared Secret Key provisioning on the nRF5340, Options

RE: Shared Secret Key provisioning on the nRF5340, Options

kartsiv — Thu, 19 Sep 2024 17:08:38 GMT

Hi Hieu,

Is there any technical limitation in storing a HMAC key in the KMU and pushing it over the secure APB interface to the CryptoCell?

Arguably, this offers better security guarantees than using TF-M ITS Encrypted storage, because with KMU + secure APB, the key is never exposed to the CPU.

References:

https://github.com/nrfconnect/sdk-nrfxlib/blob/main/crypto/nrf_cc312_platform/include/nrf_cc3xx_platform_kmu.h#L80

https://github.com/nrfconnect/sdk-trusted-firmware-m/blob/main/platform/ext/target/nordic_nrf/common/core/tfm_hal_its_encryption.c#L252

Thanks!

RE: Shared Secret Key provisioning on the nRF5340, Options

Hieu — Tue, 09 Jul 2024 09:46:16 GMT

Hi neo_here,

Yes, you can import the key and use it later with PSA Crypto API. It is certainly one good way to go.

RE: Shared Secret Key provisioning on the nRF5340, Options

neo_here — Tue, 09 Jul 2024 02:35:12 GMT

Hi Hieu,

Thanks for the blog, I went through it and seems like PSA Crypto API are the way to go and I would like to avoid using the KMU directly.

But since we are going to import a key once and not generate it, Is using the secure storage API to store the Key handle the way to go ?

1) Use the PSA Crypto Import key API and import the key as persistent key

2) Store the Key handle in persistent storage with Secure Storage

3) Load the keyhandle from persistent storage subsequently throughout the lifecycle of the device or until it is reprovisioned

RE: Shared Secret Key provisioning on the nRF5340, Options

Hieu — Fri, 05 Jul 2024 14:27:27 GMT

Hi neo_here,

My colleague wrote a blog, with a section discussing different storage of keys. Please give it a read:
https://devzone.nordicsemi.com/nordic/nordic-blog/b/blog/posts/persistent-storage-of-keys-and-data-using-the-nrf-connect-sdk#Storage-alternatives-for-keys

Hieu

RE: Best way to go about Symmetric Key Auth Provisioning

neo_here — Wed, 03 Jul 2024 22:50:02 GMT

To add on to the original post, this secret key provisioning is going to happen as a post manufacturing step.