How does nRF5340's network core access Crypto Cell?

[jli157@intel]

Hi Sir/Madam, 

Our application needs to be running on both cores and the network core needs to use some crypto algorithms provided by the crypto cell. From the data sheet, it seems the crypto cell is also reachable by the network core though it is owned by the application core, right? Can you give an example about how nrf5340 is configured so that the network core can use the crypto cell by using the mbedTLS? 

Thank you! 

Jun @ Intel, CA USA

[Einar Thorsrud]

Hi Jun,

The CryptoCell peripheral is not accessible from the network core, so that is not possible. You either need to do the crypto operations from the application core or do it in FW on the network core.

[jli157@intel]

Hi Einar, 

Can you help to double check? 

On OPS v6.1, Ch7 "Peripherals", Page 140, it says:

"The application core peripherals are accessible from the network core, but the network core peripherals are not accessible from the application core."

Also on Page 129, $6.3, it says:

"The network core can access application core resources (flash, RAM, and peripherals) when granted permission through the application's DCNF and SPU settings."

What reason is Crypto Cell, as one of peripherals, not accessible by the network core? 

Thanks, 

Jun 

[Einar Thorsrud]

Hi Jun,

Some peripherals are hardwired in HW to only be secure. The CryptoCell peripheral is one of those, which makes it only accessible from secure domain on the application core (network core does not have secure domain at all).

Einar

[jli157@intel]

Hi Einar, 

Thanks for the further explanation! 

Is it because the secure mapping of Crypto Cell is marked as "S" (on Page 103) which means only the secure mode on the application core can access it? 

Then how is the application core running at non-secure mode still able to use Crypto Cell? 

Also, does the network core need to encrypt/decrypt secured bluetooth traffic? If so, how does it do that? 

Thank you! 

Jun

[Einar Thorsrud]

Hi Jun,

jli157@intel said:

Is it because the secure mapping of Crypto Cell is marked as "S" (on Page 103) which means only the secure mode on the application core can access it? 

Yes.

jli157@intel said:

Then how is the application core running at non-secure mode still able to use Crypto Cell? 

It is not accessible from non-secure on the application core either. However, this is solved by running code in secure mode that provides secure services to non-secure code. Specifically this is done by the PSA TF-M implementation. See Running applications with Trusted Firmware-M.

jli157@intel said:

Also, does the network core need to encrypt/decrypt secured bluetooth traffic? If so, how does it do that? 

That is handled on the network core, but not using CryptoCell. All nRF5 devices has an AES CCM peripheral specifically designed for use with Bluetooth.

[jli157@intel]

Hi Einar, 

Thanks very much for your patience! I have better understanding now on the relationship between the crypto cell and the network core. 

One more question about crypto cell usage on the application core: our current application on the application core side actually doesn't enable the TrustZone mode, but can still use the the crypto cell through mbedTLS. Is enabling the trust zone necessary to access crypto cell and how is the mbedTLS on non-secure mode only app core still able to use crypto cell? 

By the way, the AES CCM peripheral on the network core side is NOT dedicated to Bluetooth, right? If we don't enable bluetooth on the network core, can we still use AES CCM for other purpose? 

Thank you!

Jun

[Einar Thorsrud]

Hi Jun,

jli157@intel said:

Is enabling the trust zone necessary to access crypto cell and how is the mbedTLS on non-secure mode only app core still able to use crypto cell? 

You cannot use CryptoCell in any way from the non-secure domain, so no CryptoCell via mbedTLS either. You need to do it from secure mode. It is not a requirement to use TF-M though, but this is what we support going forward. You could also make something of your own, which is more minimal and only support what you need. But in any case, the code interfacing with CryptoCell must be in secure domain. If you look at the simpler SPM for inspiration. This demonstrates among other things how to use CryptoCell to get random numbers, and provide those to non-secure code via non-secure callable functions. You could do something similar.

jli157@intel said:

By the way, the AES CCM peripheral on the network core side is NOT dedicated to Bluetooth, right?

You can use it for what you want, so it is not dedicated to Bluetooth. But the feature set is for the most part limited to what you need for Bluetooth.

Einar