doc: Release notes for 2.9.0-nRF54H20-1 #19715
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,87 @@ | ||
| .. _ug_nrf54h20_keys: | ||
|
|
||
| Provisioning keys on the nRF54H20 SoC | ||
| ##################################### | ||
|
|
||
| .. contents:: | ||
| :local: | ||
| :depth: 2 | ||
|
|
||
| The keys provisioning workflow for the nRF54H20 SoC consists of two main steps: | ||
|
|
||
| 1. Generating the required metadata using a script provided with the |NCS|. | ||
| #. Provisioning the keys to the nRF54H20 SoC. | ||
|
|
||
| .. note:: | ||
| The nRF54H20 SoC must be in RoT lifecycle state for key provisioning to work. | ||
| For more details on lifecycle states, see :ref:`ug_nrf54h20_architecture_lifecycle`. | ||
|
|
||
| Generating the keys | ||
| =================== | ||
|
|
||
| A script is used to generate the necessary cryptographic keys, BLOBs, and metadata required for provisioning. | ||
| The script follows the PSA Crypto standard to generate the required 28-byte key. | ||
| It is located in the :file:`nrf/scripts/generate_psa_key_attributes.py` file. | ||
|
|
||
| To generate the keys, follow these steps: | ||
|
|
||
| 1. Generate private keys using Ed25519:: | ||
|
|
||
| openssl genpkey -algorithm Ed25519 -out MANIFEST_APPLICATION_GEN1_priv.pem | ||
| openssl genpkey -algorithm Ed25519 -out MANIFEST_RADIOCORE_GEN1_priv.pem | ||
| openssl genpkey -algorithm Ed25519 -out MANIFEST_OEM_ROOT_GEN1_priv.pem | ||
|
|
||
| #. Extract public keys:: | ||
|
|
||
| openssl pkey -in MANIFEST_APPLICATION_GEN1_priv.pem -pubout -out MANIFEST_APPLICATION_GEN1_pub.pem | ||
| openssl pkey -in MANIFEST_RADIOCORE_GEN1_priv.pem -pubout -out MANIFEST_RADIOCORE_GEN1_pub.pem | ||
| openssl pkey -in MANIFEST_OEM_ROOT_GEN1_priv.pem -pubout -out MANIFEST_OEM_ROOT_GEN1_pub.pem | ||
|
|
||
| #. Check the required key IDs:: | ||
|
|
||
| MANIFEST_PUBKEY_APPLICATION_GEN1 = 0x40022100 | ||
| MANIFEST_PUBKEY_APPLICATION_GEN2 = 0x40022101 | ||
| MANIFEST_PUBKEY_APPLICATION_GEN3 = 0x40022102 | ||
| MANIFEST_PUBKEY_OEM_ROOT_GEN1 = 0x4000AA00 | ||
| MANIFEST_PUBKEY_OEM_ROOT_GEN2 = 0x4000AA01 | ||
| MANIFEST_PUBKEY_OEM_ROOT_GEN3 = 0x4000AA02 | ||
| MANIFEST_PUBKEY_RADIOCORE_GEN1 = 0x40032100 | ||
| MANIFEST_PUBKEY_RADIOCORE_GEN2 = 0x40032101 | ||
| MANIFEST_PUBKEY_RADIOCORE_GEN3 = 0x40032102 | ||
|
|
||
| #. Create a JSON input file with the ``generate_psa_key_attributes.py`` script: | ||
|
|
||
| * For the application core:: | ||
|
|
||
| python generate_psa_key_attributes.py --usage VERIFY_MESSAGE_EXPORT --id 0x40022100 --type ECC_TWISTED_EDWARDS --size 255 --algorithm EDDSA_PURE --location PERSISTENT_CRACEN --key-from-file MANIFEST_APPLICATION_GEN1_pub.pem --file all_keys.json --cracen_usage RAW | ||
|
|
||
| * For the radio core:: | ||
|
|
||
| python generate_psa_key_attributes_new.py --usage VERIFY_MESSAGE_EXPORT --id 0x40032100 --type ECC_TWISTED_EDWARDS --size 255 --algorithm EDDSA_PURE --location PERSISTENT_CRACEN --key-from-file MANIFEST_RADIOCORE_GEN1_pub.pem --file all_keys.json --cracen_usage RAW | ||
|
|
||
| * For the main root manifest:: | ||
|
|
||
| python generate_psa_key_attributes_new.py --usage VERIFY_MESSAGE_EXPORT --id 0x4000AA00 --type ECC_TWISTED_EDWARDS --size 255 --algorithm EDDSA_PURE --location PERSISTENT_CRACEN --key-from-file MANIFEST_OEM_ROOT_GEN1_pub.pem --file all_keys.json --cracen_usage RAW | ||
|
|
||
|
|
||
| The generated key data is stored in a JSON file, which serves as an input for the next step. | ||
|
There was a problem hiding this comment. Currently there is no script that actually generate this json file, I have made a version, but that script is not publicly available (yet). There was a problem hiding this comment. @evenl Isn't this script in scope of RC2? The documentation assumes the script is there There was a problem hiding this comment. There was a problem hiding this comment. PR with the script is here. I've prepared the steps required to provision the keys assuming that the script will be available for the RC2 tag. @shanthanordic, @evenl, please confirm. There was a problem hiding this comment. Can we provide an example of the JSON output file, given so many different steps that could go wrong? Basically, can move and update the example from nRF Util docs? That example should be here and not owned by the documentation of the transport layer. |
||
|
|
||
| Provisioning the keys | ||
| ===================== | ||
|
|
||
| nRF Util is used to provision the generated keys into the target device. | ||
| It takes the JSON file as input and injects it without validating its contents. | ||
| In this scenario, nRF Util functions as a transport layer, transferring the key data to the correct location in the device. | ||
|
|
||
| The Secure Domain Firmware on the device handles the actual key provisioning using PSA Crypto's ``psa_import_key`` function. | ||
| Provisioning a key calls the function to import the key: | ||
|
|
||
| * The ``metadata`` field from the JSON file is used for the function's attributes argument | ||
| * The ``value`` field is passed to the function's data argument | ||
| * The function's ``data_length`` is set to the length of the value field. | ||
|
|
||
| To provision the keys from ``all_keys.json`` onto the KMU of the nRF54H20 SoC, use nRF Util as follows:: | ||
|
|
||
| nrfutil device x-provision-nrf54h-keys --serial-number <snr> --key-file all_keys.json | ||
|
|
||
| For more information on how to provision keys, see the `Provisioning keys for hardware KMU`_ page in the nRF Util documentation. | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@robertstypa Please review
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@evenl FYI