PSA protected storage, encryption keys and FOTA

[Tom01]

Dear Nordic team,

we are developing an application for a nRF9151 which will perform some HTTPS requests. For that purpose we want to encrypt and store an API key (string of max. 32 characters). We are working with the non-secure board target and SDK v3.3.0. Our application was initially based on the "https_client" sample which uses the minimal TF-M profile for the nRF9151 DK board. We are aware that PSA protected storage is only available for the non-minimal TF-M profile. Additionally, we are planning to implement a FOTA procedure using the available libraries. To plan ahead, we have some questions regarding the persistence of the protected storage, generated encryption keys and dependencies of the FOTA libraries. 

1. Are PSA protected storage's key-value pairs persistent across firmware updates (e.g. FOTA) as long as the TF-M layout and its profile remain unmodified? 
2. Are encryption keys (like the one generated in the "persistent_key" sample) persistent across firmware updates (e.g. FOTA) as long as the TF-M layout and its profile remain unmodified?
3. Is the PSA protected storage a valid place to store information like API keys? 
4. Does FOTA support directly rely on using the non-minimal TF-M profile or could we stick with the minimal profile?

Best regards,

Tom

[Nissanth]

Hi Tom, 

Q1 and Q2: Yes, just keep the flash addresses fixed with pm_static.yml and your keys survive firmware updates.
Q3: Yes, PSA protected storage is designed to store these kind of data.
Q4: No, FOTA does not require non-minimal profile, but protected storage does require it, so you need it anyway.

Regards,

Nissanth Karunanithy