Where is QSPI Encryption function and registers ((ENC.KEY, ENC.NONCE. ENC.ENABLE, and etc)) in nrf5340

[Jaewook]

Dear, 

Based on the material (https://infocenter.nordicsemi.com/index.jsp?topic=%2Fps_nrf5340%2Fqspi.html), Encryption should be enabled independently for XIP and EasyDMA, with separate keys and nonce like as shown in Figure 3. Steam Cipher. 

However, I couldn't find any related function or registers (like ENC.KEY, ENC.NONCE, ENC.ENABLE in Figure 3.) for this Encryption feature.

Where are they?    How can I use the Encryption feature indepentaly?

Also, in the hal/nordic/nrfx/hal/nrf_qspi.h, I could find only XIP and EasyDMA functions only as shown blow:

#if NRF_QSPI_HAS_XIP_ENC

NRF_STATIC_INLINE void nrf_qspi_xip_encryption_configure(NRF_QSPI_Type * p_reg,

nrf_qspi_encryption_t const * p_cfg)

{

p_reg->XIP_ENC.KEY0 = p_cfg->key[0];

p_reg->XIP_ENC.KEY1 = p_cfg->key[1];

p_reg->XIP_ENC.KEY2 = p_cfg->key[2];

p_reg->XIP_ENC.KEY3 = p_cfg->key[3];

p_reg->XIP_ENC.NONCE0 = p_cfg->nonce[0];

p_reg->XIP_ENC.NONCE1 = p_cfg->nonce[1];

p_reg->XIP_ENC.NONCE2 = p_cfg->nonce[2];

}

NRF_STATIC_INLINE void nrf_qspi_xip_encryption_set(NRF_QSPI_Type * p_reg, bool enable)

{

p_reg->XIP_ENC.ENABLE =

(enable ? QSPI_XIP_ENC_ENABLE_ENABLE_Enabled << QSPI_XIP_ENC_ENABLE_ENABLE_Pos

: QSPI_XIP_ENC_ENABLE_ENABLE_Disabled << QSPI_XIP_ENC_ENABLE_ENABLE_Pos);

}

#endif

#if NRF_QSPI_HAS_DMA_ENC

NRF_STATIC_INLINE void nrf_qspi_dma_encryption_configure(NRF_QSPI_Type * p_reg,

nrf_qspi_encryption_t const * p_cfg)

{

p_reg->DMA_ENC.KEY0 = p_cfg->key[0];

p_reg->DMA_ENC.KEY1 = p_cfg->key[1];

p_reg->DMA_ENC.KEY2 = p_cfg->key[2];

p_reg->DMA_ENC.KEY3 = p_cfg->key[3];

p_reg->DMA_ENC.NONCE0 = p_cfg->nonce[0];

p_reg->DMA_ENC.NONCE1 = p_cfg->nonce[1];

p_reg->DMA_ENC.NONCE2 = p_cfg->nonce[2];

}

NRF_STATIC_INLINE void nrf_qspi_dma_encryption_set(NRF_QSPI_Type * p_reg, bool enable)

{

p_reg->DMA_ENC.ENABLE =

(enable ? QSPI_DMA_ENC_ENABLE_ENABLE_Enabled << QSPI_DMA_ENC_ENABLE_ENABLE_Pos

: QSPI_DMA_ENC_ENABLE_ENABLE_Disabled << QSPI_DMA_ENC_ENABLE_ENABLE_Pos);

}

#endif

Regards,

Jae

[Simonr]

Hi Jae

What exactly are you missing in terms of explanation of the XIP_ENC and DMA_ENC modules? I'm not sure what you're expecting that is not mentioned in the Encryption paragraph of the PS and the QSPI HAL regarding the functions. Let me know what it is that needs further explanation and I'll forward it to our documentation team. 

Regarding your security concerns. AES is an encryption scheme, while KMU is a HW peripheral to store the keys somewhere the CPU can't access them. I don't see any reason you shouldn't be able to use KMU to store the AES key in. As long as readback protection is enabled on the nRF5340, and the external flash is encrypted, I don't see how "everyone" should easily hack the source code. HUK is the library to use the KMU, if there's any confusion there.

Best regards,

Simon

[Jaewook]

First of all, at the beginning, I was confused with three modules such as ENC, XIP_ENC and DMA_ENC as read the spec. Now, I just figured out there are two module like XIP_ENC and DMA_ENC only while ENC should be a general concept over them.    Now, it should be fine to me.

However, still, I am not sure how XIP_ENC and DMA_ENC can use KMU for the AES key.  Do you have any example on this application?   Since CPU can't access the keys stored at KMU, how firmware can assign the keys stored at KMU to XIP_ENC and DMA_ENC module?