Identity key usage

This sample shows how to use a previously written identity key with the PSA crypto APIs.

Requirements

The following development kits are supported:

Hardware platforms

PCA

Board name

Build target

nRF9160 DK

PCA10090

nrf9160dk_nrf9160

nrf9160dk_nrf9160

nRF5340 DK

PCA10095

nrf5340dk_nrf5340

nrf5340dk_nrf5340_cpuapp

The Hardware unique key library is required to generate the prerequisite Master Key Encryption Key (MKEK). The Identity key library is required to provision the identity key in KMU. Both these operations can be done by running the Identity key generation sample.

Note

Once the required identity key is provisioned on the device, only the code pages should be erased as ERASEALL removes the identity key from the system.

Overview

The identity key is an asymmetric key of type secp256r1 which can be used for attestation services. This sample shows how to load the identity key into the PSA crypto keystore for usage.

The sample performs the following operations:

  1. The Platform Security Architecture (PSA) API is initialized.

  2. The identity key is verified to be in the KMU.

  3. The identity key is read from the KMU.

  4. The identity key is imported to the PSA crypto keystore.

  5. The public key is exported from the identity key.

Configuration

See Configuring and building an application for information about how to permanently or temporarily change the configuration.

Building and running

This sample can be found under samples/keys/identity_key_usage in the nRF Connect SDK folder structure.

To build the sample with Visual Studio Code, follow the steps listed on the How to build an application page in the nRF Connect for VS Code extension documentation. See Configuring and building an application for other building scenarios, Programming an application for programming steps, and Testing and optimization for general information about testing and debugging in the nRF Connect SDK.

Testing

After programming the sample to your development kit, complete the following steps to test it:

  1. Connect to the kit that runs this sample with a terminal emulator (for example, nRF Connect Serial Terminal). See Testing and optimization for the required settings and steps.

  2. Reset the kit.

  3. Observe the following output:

    Initializing PSA crypto.
Reading the identity key.
Importing the identity key into PSA crypto.
Exporting the public key corresponding to the identity key.
Success!

    If an error occurs, the sample prints a message and raises a kernel panic.

Dependencies

This sample uses the following libraries: