How does nRF5340's network core access Crypto Cell?

[jli157@intel]

Hi Sir/Madam, 

Our application needs to be running on both cores and the network core needs to use some crypto algorithms provided by the crypto cell. From the data sheet, it seems the crypto cell is also reachable by the network core though it is owned by the application core, right? Can you give an example about how nrf5340 is configured so that the network core can use the crypto cell by using the mbedTLS? 

Thank you! 

Jun @ Intel, CA USA

[Einar Thorsrud]

Hi Jun,

The CryptoCell peripheral is not accessible from the network core, so that is not possible. You either need to do the crypto operations from the application core or do it in FW on the network core.

[jli157@intel]

Hi Einar, 

Can you help to double check? 

On OPS v6.1, Ch7 "Peripherals", Page 140, it says:

"The application core peripherals are accessible from the network core, but the network core peripherals are not accessible from the application core."

Also on Page 129, $6.3, it says:

"The network core can access application core resources (flash, RAM, and peripherals) when granted permission through the application's DCNF and SPU settings."

What reason is Crypto Cell, as one of peripherals, not accessible by the network core? 

Thanks, 

Jun 

[Einar Thorsrud]

Hi Jun,

Some peripherals are hardwired in HW to only be secure. The CryptoCell peripheral is one of those, which makes it only accessible from secure domain on the application core (network core does not have secure domain at all).

Einar

[jli157@intel]

Hi Einar, 

Thanks for the further explanation! 

Is it because the secure mapping of Crypto Cell is marked as "S" (on Page 103) which means only the secure mode on the application core can access it? 

Then how is the application core running at non-secure mode still able to use Crypto Cell? 

Also, does the network core need to encrypt/decrypt secured bluetooth traffic? If so, how does it do that? 

Thank you! 

Jun

[Einar Thorsrud]

Hi Jun,

jli157@intel said:

Is it because the secure mapping of Crypto Cell is marked as "S" (on Page 103) which means only the secure mode on the application core can access it? 

Yes.

jli157@intel said:

Then how is the application core running at non-secure mode still able to use Crypto Cell? 

It is not accessible from non-secure on the application core either. However, this is solved by running code in secure mode that provides secure services to non-secure code. Specifically this is done by the PSA TF-M implementation. See Running applications with Trusted Firmware-M.

jli157@intel said:

Also, does the network core need to encrypt/decrypt secured bluetooth traffic? If so, how does it do that? 

That is handled on the network core, but not using CryptoCell. All nRF5 devices has an AES CCM peripheral specifically designed for use with Bluetooth.