Is it possible to use the KMU (or other secure area??) in the nRF9160 to store encryption keys?

RE: Is it possible to use the KMU (or other secure area??) in the nRF9160 to store encryption keys?

Spi — Mon, 02 Mar 2026 21:32:34 GMT

Thanks for your answer. I looked at the SDK V2.6 version of persistent_key_usage sample and I didn't understand it. What is the use of a random encryption key? To me it makes decryption very difficult when you don't know what the original encryption key was. Either way, we gave up on this very complicated way of doing things and found a much simpler solution that we understand and control and most importantly, know the encryption key so that we can also decrypt the encrypted data.

RE: Is it possible to use the KMU (or other secure area??) in the nRF9160 to store encryption keys?

Michal — Mon, 02 Mar 2026 16:41:55 GMT

[quote user="Spi"]I looked at the persistent_key_usage sample and it appears that it might only work for 128-bit keys because the psa_set_key_id() call can only specify a single KMU slot. And the hw_unique_key API doesn't appear to support the ability to read keys. I[/quote]

This sample shouldn't use KMU, but Internal Trusted Storage though?

https://docs.nordicsemi.com/bundle/ncs-3.2.2/page/nrf/samples/crypto/persistent_key_usage/README.html

Are you sure that you are looking at the correct thing?

Best regards,

Michal

RE: Is it possible to use the KMU (or other secure area??) in the nRF9160 to store encryption keys?

Michal — Fri, 20 Feb 2026 16:24:47 GMT

Thank you for the information.

I will look more into the issue after the weekend.

Best regards,

Michal

RE: Is it possible to use the KMU (or other secure area??) in the nRF9160 to store encryption keys?

Spi — Wed, 18 Feb 2026 20:54:59 GMT

Thanks. I looked at the persistent_key_usage sample and it appears that it might only work for 128-bit keys because the psa_set_key_id() call can only specify a single KMU slot. And the hw_unique_key API doesn't appear to support the ability to read keys. I will take a closer look at manually driving the KMU registers.

RE: Is it possible to use the KMU (or other secure area??) in the nRF9160 to store encryption keys?

Spi — Wed, 18 Feb 2026 16:29:36 GMT

Thanks. I think I might have seen that link before, but I'll take another look.

RE: Is it possible to use the KMU (or other secure area??) in the nRF9160 to store encryption keys?

Spi — Wed, 18 Feb 2026 16:28:04 GMT

For use-case, our application has to encrypt using AES-GCM with 256-bit keys. We have the prototype functionality working using a key stored in I2C EEPROM that we read into RAM and then call psa_import_key(). We would prefer to store the keys in a more secure manner.

RE: Is it possible to use the KMU (or other secure area??) in the nRF9160 to store encryption keys?

Michal — Wed, 18 Feb 2026 16:17:14 GMT

Hello again,

If using TF-M with ITS is an option, then we can recommend using it instead.

Here is a sample that showcases it: https://docs.nordicsemi.com/bundle/ncs-3.2.2/page/nrf/samples/crypto/persistent_key_usage/README.html

Best regards,

Michal

RE: Is it possible to use the KMU (or other secure area??) in the nRF9160 to store encryption keys?

Michal — Wed, 18 Feb 2026 15:26:53 GMT

Sorry, I just saw that yes, you should be able to combine the KMU keys, as said on top here:

https://docs.nordicsemi.com/bundle/ps_nrf9160/page/kmu.html

To my knowledge you can use ARM CryptoCell 310 included in the nRF9160, so please take a look at its capabilities here:

https://docs.nordicsemi.com/bundle/ps_nrf9160/page/cryptocell.html

The catch is that you may possibly have to implement drivers for whatever you need specifically on your own.

I'll double check that and get back to you.

Could you also tell me more about your use case?

Best regards,

Michal

RE: Is it possible to use the KMU (or other secure area??) in the nRF9160 to store encryption keys?

Spi — Tue, 17 Feb 2026 17:37:40 GMT

Thank you for your response. How many KMU keys are there? I can combine two 16-byte keys to make one 32-byte key. What are the API functions to read/write the KMU keys?

RE: Is it possible to use the KMU (or other secure area??) in the nRF9160 to store encryption keys?

Michal — Fri, 13 Feb 2026 11:45:52 GMT

Hello,

So in general, KMU has only support for 128-bit keys, which is 16-byte.

Also, you should be able to reopen that ticket and continue there I think?

Best regards,

Michal