Hardware unique key

This sample shows how to use a hardware unique key (HUK) to derive an encryption key through psa_crypto APIs.


The sample supports the following development kits:

Hardware platforms


Board name

Build target

nRF9160 DK



nrf9160dk_nrf9160_ns nrf9160dk_nrf9160

nRF5340 DK



nrf5340dk_nrf5340_cpuapp_ns nrf5340dk_nrf5340_cpuapp

nRF52840 DK




nRF21540 DK




When built for an _ns build target, the sample is configured to compile and run as a non-secure application with Cortex-M Security Extensions enabled. Therefore, it automatically includes Trusted Firmware-M that prepares the required peripherals and secure services to be available for the application.


The sample goes through the following steps to derive a key and use it to encrypt a string:

  1. Initializes the hardware, if applicable.

    When TF-M is enabled, the hardware is initialized automatically when booting.

  2. Generates HUKs, if applicable.

    The sample generates a random HUK and writes it to the Key Management Unit (KMU) or flash. When no KMU is present, the device reboots to allow the immutable bootloader to feed the key into CryptoCell. When TF-M is enabled, the HUKs are generated automatically when booting TF-M, and no action is needed in the sample.

  3. Generates a random initialization vector (IV).

  4. Derives a key used for encryption.

    When TF-M is enabled, the key is derived using the psa_crypto APIs. Otherwise, the native nrf_cc3xx_platform APIs are used, and the key is imported into psa_crypto.

  5. Encrypts a sample string using the key_id received from the psa_crypto.


See Configuring your application for information about how to permanently or temporarily change the configuration.

FEM support

You can add support for the nRF21540 front-end module to this sample by using one of the following options, depending on your hardware:

  • Build the sample for one board that contains the nRF21540 FEM, such as nrf21540dk_nrf52840.

  • Manually create a devicetree overlay file that describes how FEM is connected to the nRF5 SoC in your device. See Set devicetree overlays for different ways of adding the overlay file.

  • Provide nRF21540 FEM capabilities by using a shield, for example the nRF21540 EK shield that is available in the nRF Connect SDK. In this case, build the project for a board connected to the shield you are using with an appropriate variable included in the build command, for example SHIELD=nrf21540ek. This variable instructs the build system to append the appropriate devicetree overlay file.

    To build the sample in the nRF Connect for VS Code IDE for an nRF52840 DK with the nRF21540 EK attached, add the shield variable in the build configuration’s Extra CMake arguments and rebuild the build configuration. For example: -DSHIELD=nrf21540ek.

    See nRF Connect for VS Code extension pack documentation for more information.

    See Programming nRF21540 EK for information about how to program when you are using a board with a network core, for example nRF5340 DK.

Each of these options adds the description of the nRF21540 FEM to the devicetree. See Working with RF front-end modules for more information about FEM in the nRF Connect SDK.

To add support for other front-end modules, add the respective devicetree file entries to the board devicetree file or the devicetree overlay file.

Building and running

This sample can be found under samples/keys/hw_unique_key in the nRF Connect SDK folder structure.

When built as firmware image for the _ns build target, the sample has Cortex-M Security Extensions (CMSE) enabled and separates the firmware between Non-Secure Processing Environment (NSPE) and Secure Processing Environment (SPE). Because of this, it automatically includes the Trusted Firmware-M (TF-M). To read more about CMSE, see Processing environments.

To build the sample with Visual Studio Code, follow the steps listed on the How to build an application page in the nRF Connect for VS Code extension documentation. See Building and programming an application for other building and programming scenarios and Testing and debugging an application for general information about testing and debugging in the nRF Connect SDK.


After programming the sample to your development kit, complete the following steps to test it:

  1. Connect to the kit that runs this sample with a terminal emulator (for example, PuTTY). See How to connect with PuTTY for the required settings.

  2. Reset the kit.

  3. If not using TF-M, observe the following output:

    Writing random keys to KMU
  4. Observe the following output (the values for IV, key, and ciphertext will vary randomly):

    Generating random IV
    Deriving key
    Key ID: 0x7fffffe0
    "Lorem ipsum dolor sit amet. This will be encrypted."
    Ciphertext (with authentication tag):

    If an error occurs, the sample prints a message and raises a kernel panic.


This sample uses the following libraries: