nrf52833 RNG and OTP flash

RE: nrf52833 RNG and OTP flash

daviddedwin — Sat, 01 Aug 2020 06:41:26 GMT

Apologies for commenting here on an oldish thread.
I only commenting on the randomness parts here.

The random numbers accessed through the softdevice interface shall to be compliant to FIPS SP800-22 as stated in the Bluetooth specification Vol 3, Part H, section 2 (This section is referred in both BR/EDR and LE only contollers).

FIPS SP800-22 for pseudo random numbers should suffice, as NIST SP800-90A is only the recommended mechanisms for to generating deterministic i.e. pseudo random numbers and the SP800-90B is the spec to ensure adequate entropy for the random number generation.

I would state that compliance to FIPS SP800-22 is sufficient as that is the statistical test suite that shows fulfillment of NIST SP800-90A and NIST SP800-9B requirements.

I would then state that the soft device interface for the nRF52833 should deliver random numbers that are of the same or better quality for the NIST and FIPS specifications to be satisfied.

RE: nrf52833 RNG and OTP flash

run_ar — Thu, 28 May 2020 09:46:28 GMT

1. The nRF52840 has the cryptocell hardware which has the compliant RNG. While the nRF52833 does not have this. See CRYPTOCELL — ARM TrustZone CryptoCell 310. The RNG in the nRF52833 is not considered compliant.

2. Yes, UICR+approtect. But application flash could also be used and might be more convenient to maintain. Approtect would enable read back protection for all flash.

RE: nrf52833 RNG and OTP flash

Turbo J — Wed, 27 May 2020 14:21:01 GMT

You can use the CUSTOMER fields in UICR together with APROTECT.

Not a "rea"l OTP but this way you cannot read anything over SWD before completely erasing the chip.