NRF9160-SICA-R7 datasheet(142/400 Pages) NORDIC

142 / 400 page

Peripherals

device secrets can be installed and made available for use in cryptographic operations without revealing

the actual secret values.

Keys in this region will typically have a certain life span. The region is not designed to be used for per-

session derived keys where the non-secure side (i.e. application) is participating in the key exchange.

All key storage is done through the concept of multiple key slots, where each key slot instance consists

of one key header and an associated key value. Each key header supports the configuration of usage

permissions and an optional secure destination address.

The key header secure destination address option enables the KMU to push the associated key value

over a dedicated secure APB to a pre-configured secure location within the memory map. Such locations

typically include a write-only key register of the hardware cryptograhic accelerator, allowing the KMU to

distribute keys within the system without compromising the key values.

One key slot instance can store a key value of maximum 128 bits. If a key size exceeds this limit, the key

value itself must be split over multiple key slot instances.

The following usage and read permissions scheme is applicable for each key slot:

State

Push

Read

Write

Description

Active (1) Enabled

(1)

Enabled

(1)

Enabled

(1)

Default flash erase value. Key slot cannot be pushed, write is enabled.

Active (1) Enabled

(1)

Enabled

(1)

Disabled

(0)

Key slot is active, push is enabled. Key slot VALUE registers can be read, but write is disabled.

Active (1) Enabled

(1)

Disabled

(0)

Disabled

(0)

Key slot is active, push is enabled. Read and write to key slot VALUE registers are disabled.

Active (1) Disabled

(0)

Enabled

(1)

Disabled

(0)

Key slot is active, push is disabled. Key slot VALUE registers can be read, but write is disabled.

Revoked

(0)

Key slot is revoked. Cannot be read or pushed over secure APB regardless of the permission settings.

Table 51: Valid key slot permission schemes

6.8.4.2.1 Selecting a key slot

The KMU FSM is designed to process only one key slot at a time, effectively operating as a memory

protection unit for the key storage region. Whenever a key slot is selected, the KMU will allow access to

writing, reading, and/or pushing the associated key value according to the selected slot configuration.

A key slot must be selected prior to use, by writing the key slot ID into the KMU SELECTKEYSLOT register.

Because the reset value of this register is 0x00000000, there is no key slot associated with ID=0 and no slot

is selected by default. All key slots are addressed using IDs from 1 to 128.

SELECTED status is set when a key slot is selected, and a read or write acccess to that keyslot occurs.

BLOCKED status is set when any illegal access to key slot registers is detected.

When the use of the particular key slot is stopped, the key slot selection in SELECTKEYSLOT must be set

back to '0'.

By default, all KMU key slots will consist of a 128-bit key value of '1's, where the key headers have no

secure destination address, or any usage and read restrictions.

6.8.4.2.2 Writing to a key slot

Writing a key slot into UICR is a five-step process.

1. Select which key slot the KMU shall operate on by writing the desired key slot ID into KMU-

>SELECTKEYSLOT. The selected key slot must be empty in order to add a new entry to UICR.

2. If the key value shall be pushable over secure APB, the destination address of the recipient must be

configured in register KEYSLOT.CONFIG[ID-1].DEST.

4418_1315 v2.0

142

NRF9160-SICA-R7 Datasheet(PDF) 142 Page - Nordic Semiconductor

NRF9160-SICA-R7 Datasheet(HTML) 142 Page - Nordic Semiconductor

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 ...More

Datasheet Download

Link URL