can NRF52840 CryptoCell IP act as secure element?

RE: can NRF52840 CryptoCell IP act as secure element?

Nikos Karamolegkos — Fri, 06 Nov 2020 14:14:49 GMT

Thank you. For folks that may need future help check here

RE: can NRF52840 CryptoCell IP act as secure element?

haakonsh — Fri, 06 Nov 2020 13:58:34 GMT

[quote user="Nikos Karamolegkos"]Let's say that I would like to store a private key. I can create a flash section where I will store the private key and then using a secure bootloader to read that key and block the read in this section. In this way, I can jump to application (without rebooting/reset) and then again only on reset the bootloader can read the key. Am I correct?[/quote]

Yes, that's the intended use-case.

[quote user="Nikos Karamolegkos"]Also, what exactly means secure bootloader? [/quote]

It means the use of signed FW images where the bootloader will verify any image it is asked to load, based on f.ex a stored key that only the bootloader has access to.

From Secure boot and firmware updates:
"Secure boot does a signature verification procedure on installed firmware before booting into it. This is to ensure that the firmware is authorized by the owner of the private key used to create the signature."

RE: can NRF52840 CryptoCell IP act as secure element?

Nikos Karamolegkos — Thu, 05 Nov 2020 12:57:46 GMT

Let's say that I would like to store a private key. I can create a flash section where I will store the private key and then using a secure bootloader to read that key and block the read in this section. In this way, I can jump to application (without rebooting/reset) and then again only on reset the bootloader can read the key. Am I correct? Also, what exactly means secure bootloader?

RE: can NRF52840 CryptoCell IP act as secure element?

haakonsh — Tue, 03 Nov 2020 12:58:27 GMT

Depends on your definition of "secure".

[quote user="haakonsh"]And the ACL — Access control lists can block read and/or write access to a region of flash. [/quote]

Though do note IN133 Informational Notice v1.0. Talk to our Regional Sales Manager about device ordering and production programming for nRF52840's with a fix for this issue.

RE: can NRF52840 CryptoCell IP act as secure element?

Nikos Karamolegkos — Mon, 02 Nov 2020 08:11:48 GMT

I can not understand, before anything, Is secure to store the key in flash?

RE: can NRF52840 CryptoCell IP act as secure element?

haakonsh — Tue, 21 May 2019 07:30:06 GMT

Yes, given that you follow the instructions given in my previous answer.

RE: can NRF52840 CryptoCell IP act as secure element?

alireza sadeghpour — Mon, 20 May 2019 07:49:56 GMT

So this region of memory can be used for storing symmetric/asymmetric encryption keys?

RE: can NRF52840 CryptoCell IP act as secure element?

haakonsh — Wed, 24 Oct 2018 15:12:30 GMT

The CryptoCell can store a Device root key in its internal SRAM. And the ACL — Access control lists can block read and/or write access to a region of flash.

The common use case is to use a secure bootloader to read a key from flash and store it in the cryptocell, then use ACL to block read access to the flash region where the key is stored.