Do nRF5 Chips have Secure Boot and a secure storage for encryption keys?

[ThEMiKeZ]

Hello everybody.

I am currently evaluating some BLE Tags, if they can be used as an BLE doorkey.

The chips I am talking about are the following:
nRF51802
nRF51822
nRF52832
nRF52811

Now we have some requirements, that need to be fullfilled:
We need some way of a secure boot
And we need a secure storage for private keys for our encryption method (using AES)

Can these chips deliver these function or not?

I just want to find out if this is somehow possible to achieve with those chips or if we need to rethink our approach.

Thanks in advance to all of you.

Cheers,
Michael

[Sigurd Hellesvik]

Hi Themikez

Secure Storage:

It can be unclear what Secure Storage means. If it refers to the secure storage mentioned in TrustZone, only nRF5340 and nRF9160 support TrustZone.
Or maybe you are looking for Hardware unique key management. This is supported for nRF5340, nRF9160 and nRF52840.

If you specify what you mean by Secure Storage, I might be able point you to functionality for the chips you mention.

Secure Boot:

For the nRF Connect SDK, have a look at Secure bootloader chain and nRF Secure Immutable Bootloader.

For the nRF5 SDK 17.0.2, have a look at the Secure boot and firmware updates documentation.

We do not recommend nRF51 for new designs.
However, if you must use nRF51, you might be able to use parts of the BLE Secure DFU Bootloader.

In general, Infineon OPTIGA Trust X could be relevant for you see this blog post for more information.

Regards,
Sigurd Hellesvik

[ThEMiKeZ]

Hi.

Thanks for the quick reply.

Regarding the secure storage:
We would need a part of the Flash, which can´t be accessed after production through a debugger.
So that a third party "theft" can´t open a Tag, read out the private keys and then has access to all doors.
This part in the flash should therefore be able to get locked down from reading it via debugger.

But what I can read from your Text is, that this isn´t possible with the chips i stated...

But  thanks for your help!

Cheers,
Michael

[Sigurd Hellesvik]

Hi Michael

If you want to prevent reading from the flash, APPROTECT and ACL might do what you need.
Have a look at this post and see if that is what you are looking for.

I am happy to help, please let me know if you have any more questions on the subject.

Regards,
Sigurd Hellesvik