Nordic devices with secure storage supported by Zephry

[Nikos Karamolegkos]

Hello, I am interested on nordic devices that support:
1) 802.15.4 (eg. Openthread)
2) secure storage for storing keys (e.g LWM2M credentials)
3) zephyr - rtos

I have seen the 1)nrf9160dk which has not 802.15.4 radio but according this SPU is supported, 2) nrf9160 dk - nrf52840 with 802.15.4. radio but there is nothing about SPU. Does SPU applies to secure storage too? Any other options?

Thank you

[Einar Thorsrud]

Hi,

The only Nordic device that has both a 80215.4 radio and a key management unit is the nRF5340. This also has a SPU (as part of the Arm TrustZone support).

The nRF52840 has some security features, but no KMU nor an SPU. However, it does have a volatile secure key storage inside the CC310 peripheral, and ability to protect flash using ACL, so it may be good enough depending on your requirements.

[Nikos Karamolegkos]

Really fast reply. Thanks. As I can see in zephyr rtos documentation there are two types nrf5340dk_nrf5340_cpuapp and nrf5340dk_nrf5340_cpunet. The first mention about SPU but nothing about Radio and the second mention Radio but nothing about SPU. What are the differences? I don't think that these two are different devices.

[Einar Thorsrud]

Hi,

These are all in the same device. The nRF5340 is dual core, so nrf5340dk_nrf5340_cpuapp is the application core (more powerful, more peripherals), and nrf5340dk_nrf5340_cpunet is the network core (more power efficient, less peripherals but it has the radio). You can see more in Working with nRF53 Series.

[Nikos Karamolegkos]

So I could just use the KMU to store in a secure way my keys without, let's say, tricks like in nrf52840? Also, does this device have any unique identifier?

[Einar Thorsrud]

Nikos Karamolegkos said:

So I could just use the KMU to store in a secure way my keys without, let's say, tricks like in nrf52840?

Yes, you can. Note that the nRF53 does not have secure flash though, so it would probably be possible to extract the key by decapping and probing directly on the die. You can read more about the KMU features in the KMU chapter in the PS. If that is part of your thread model, then the only option is to use a secure element, but in most products that would be overkill.

Nikos Karamolegkos said:

Also, does this device have any unique identifier?

Yes. The DEVICEID in FICR is a 64 bit random number generated in production. Given the size of the numbers they are unique for all practical purposes.

[Nikos Karamolegkos]

Oh nice. The FICR is really useful. I will check how can read this information by my code. As I can see nr52840 supports this too..

[Einar Thorsrud]

Yes, all nRF5 devices has a 64 bit DEVICEID in FICR.