Hardware unique key

This sample shows how to use a hardware unique key (HUK) to derive an encryption key through psa_crypto APIs.

Requirements

The sample supports the following development kits:

Hardware platforms

PCA

Board name

Build target

nRF9160 DK

PCA10090

nrf9160dk_nrf9160

nrf9160dk_nrf9160_ns nrf9160dk_nrf9160

nRF5340 DK

PCA10095

nrf5340dk_nrf5340

nrf5340dk_nrf5340_cpuapp_ns nrf5340dk_nrf5340_cpuapp

nRF52840 DK

PCA10056

nrf52840dk_nrf52840

nrf52840dk_nrf52840

nRF21540 DK

PCA10112

nrf21540dk_nrf52840

nrf21540dk_nrf52840

When built for an _ns build target, the sample is configured to compile and run as a non-secure application. Therefore, it automatically includes Trusted Firmware-M that prepares the required peripherals and secure services to be available for the application.

Overview

The sample goes through the following steps to derive a key and use it to encrypt a string:

  1. Initializes the hardware, if applicable.

    When TF-M is enabled, the hardware is initialized automatically when booting.

  2. Generates HUKs, if applicable.

    The sample generates a random HUK and writes it to the Key Management Unit (KMU) or flash. When no KMU is present, the device reboots to allow the immutable bootloader to feed the key into CryptoCell. When TF-M is enabled, the HUKs are generated automatically when booting TF-M, and no action is needed in the sample.

  3. Generates a random initialization vector (IV).

  4. Derives a key used for encryption.

    When TF-M is enabled, the key is derived using the psa_crypto APIs. Otherwise, the native nrf_cc3xx_platform APIs are used, and the key is imported into psa_crypto.

  5. Encrypts a sample string using the key_id received from the psa_crypto.

Configuration

See Configuring your application for information about how to permanently or temporarily change the configuration.

FEM support

You can add support for the nRF21540 front-end module to this sample by using one of the following options, depending on your hardware:

  • Build the sample for one board that contains the nRF21540 FEM, such as nrf21540dk_nrf52840.

  • Manually create a devicetree overlay file that describes how FEM is connected to the nRF5 SoC in your device. See Set devicetree overlays for different ways of adding the overlay file.

  • Provide nRF21540 FEM capabilities by using a shield, for example the nRF21540 EK shield that is available in the nRF Connect SDK. In this case, build the project for a board connected to the shield you are using with an appropriate variable included in the build command. This variable instructs the build system to append the appropriate devicetree overlay file. For example, to build the sample from the command line for an nRF52833 DK with the nRF21540 EK attached, use the following command within the sample directory:

    west build -b nrf52833dk_nrf52833 -- -DSHIELD=nrf21540_ek

    This command builds the application firmware. See Programming nRF21540 EK for information about how to program when you are using a board with a network core, for example nRF5340 DK.

Each of these options adds the description of the nRF21540 FEM to the devicetree. See Working with RF front-end modules for more information about FEM in the nRF Connect SDK.

To add support for other front-end modules, add the respective devicetree file entries to the board devicetree file or the devicetree overlay file.

Building and running

This sample can be found under samples/keys/hw_unique_key in the nRF Connect SDK folder structure.

When built as a non-secure firmware image for the _ns build target, the sample automatically includes the Trusted Firmware-M (TF-M).

See Building and programming an application for information about how to build and program the application and Testing and debugging an application for general information about testing and debugging in the nRF Connect SDK.

Testing

After programming the sample to your development kit, complete the following steps to test it:

  1. Connect to the kit that runs this sample with a terminal emulator (for example, PuTTY). See How to connect with PuTTY for the required settings.

  2. Reset the kit.

  3. If not using TF-M, observe the following output:

    Writing random keys to KMU
Success!

  4. Observe the following output (the values for IV, key, and ciphertext will vary randomly):

    Generating random IV
IV:
ab8e7c595d6de7d297a00b6c

Deriving key
Key:
8d6e8ad32f5dffc10df1de38a2556ba0e01cf4ed56ac1294b9c57965cddc519a
Key ID: 0x7fffffe0

Encrypting
Plaintext:
"Lorem ipsum dolor sit amet. This will be encrypted."
4c6f72656d20697073756d20646f6c6f722073697420616d65742e2054686973
2077696c6c20626520656e637279707465642e
Ciphertext (with authentication tag):
ea696bf71e106f7c74adfc3296556f4f25ac2c999e453e28c52fb41085ef7b89
3cbadee1a505cf3ce1901f4bc2fcca4fb86ec68e4b5f1344bb66ef5ce733f47a
33788a

    If an error occurs, the sample prints a message and raises a kernel panic.

Dependencies

This sample uses the following libraries: