RE: nrf5340 key mangement unit

Sigurd Hellesvik — Fri, 13 Aug 2021 12:42:49 GMT

Hi Rookie

It is only possible to write to a keyslot if it is empty. This is decided by hardware, se the nRF5340 Product Specification:

"The selected key slot must be empty in order to add a new entry to UICR"

In other words, you can not overwrite KMU keys from firmware.

There is another, a bit less secure way to save keys, as mentioned in Hardware unique key documentation:

"In devices without a KMU, like nRF52840, the bootloader writes the key to the Arm CryptoCell and locks the flash memory page where the key is stored. In this case, only one key is supported."

However, it is not possible to unlock hardware flash write protection before a reset, so you can not overwrite keys with this method either.

This answer describes some alternatives for securing when not using secure flash(KMU), which may be what you are looking for.

Did this answer your question?

Regards,
Sigurd Hellesvik