nRF54L15 protected-key crypto execution model and throughput

RE: nRF54L15 protected-key crypto execution model and throughput

Sigurd Hellesvik — Thu, 22 Oct 2026 15:05:10 GMT

Our Secure Storage system uses the Hardware Unique Key(HUK) library for encryption, where the Master Key Encryption Key (MKEK) is used for deriving keys to encrypt data at rest. The MKEK lives in the CRACEN, and is generated each boot from the IKG, which lives in the Key Management Unit (KMU) on the nRF54L15. The KMU is a hardware crypto module. The KMU can share data with the CRACEN directly, which the CPU can not access.

To translate:
1. A key is stored in a secure hardware peripheral. (IKG in KMU)
2. This key is used to generate another key on boot. (MKEK in CRACEN)
3. This other key is (indirectly) used to encrypt/decrypt data using the hardware crypto module. (CRACEN)

[quote user="Jimmy012"]For operations that can remain within the protected module, what throughput is supported, and where is that documented?[/quote]

Our CRACEN specs does not have any throughput numbers.
What is your use-case for asking?

Maybe you can just try to test a sample with the CRACEN and mesaure if its fast enough for your use-case?

RE: nRF54L15 protected-key crypto execution model and throughput

Jimmy012 — Thu, 22 Oct 2026 11:22:51 GMT

Hi Sigurd,

I mean runtime data encryption and decryption, not encrypted application or firmware updates. Our device is disposable and will not receive field updates.

Can runtime data encryption and decryption be performed entirely within the nRF54L15 protected cryptographic hardware, with the keys remaining inside that boundary? Or does it primarily protect a wrapping key while payload encryption and decryption are performed outside the protected module?

For operations that can remain within the protected module, what throughput is supported, and where is that documented?

Thanks,
Jim

RE: nRF54L15 protected-key crypto execution model and throughput

Sigurd Hellesvik — Thu, 22 Oct 2026 08:47:42 GMT

Hi,

I want to make sure I understand correctly before I answer, so:

[quote user=""]application encryption and decryption[/quote]

You mean encrypted application updates, right?

Regards,
Sigurd Hellesvik