samples: crypto: Added KMU usage sample for nRF54L

AntonZma · greg-fer · nordicjm · commit 52f75197fbf9 · 2025-10-06T10:39:20.000+01:00
Contains KMU usage template for the nRF54L devices.
The sample is based on "persistent_key_usage".

Ref: NCSDK-25126

Signed-off-by: Anton Zyma &lt;anton.zyma@nordicsemi.no&gt;
Co-authored-by: Grzegorz Ferenc &lt;grzegorz.ferenc@nordicsemi.no&gt;
diff --git a/doc/nrf/links.txt b/doc/nrf/links.txt
@@ -471,14 +471,16 @@
 
 .. _`HCI Events`: https://docs.nordicsemi.com/bundle/ncs-latest/page/nrfxlib/softdevice_controller/doc/api.html#hci_events
 
+.. _`nRF socket options`: https://docs.nordicsemi.com/bundle/ncs-latest/page/nrfxlib/nrf_modem/doc/sockets.html
+
+.. _`Managing keys`: https://docs.nordicsemi.com/bundle/ncs-latest/page/mcuboot/imgtool.html#managing_keys
+
 .. _`nPM2100 Datasheet`: https://docs.nordicsemi.com/bundle/ps_npm2100/page/keyfeatures_html5.html
 .. _`nPM2100 EK product page`: https://docs.nordicsemi.com/bundle/ug_npm2100_ek/page/UG/nPM2100_EK/intro/intro.html
 .. _`nPM2100 EK User Guide`: https://docs.nordicsemi.com/bundle/ug_npm2100_ek/page/UG/nPM2100_EK/intro/intro.html
 .. _`Connect and use the nPM2100 EK`: https://docs.nordicsemi.com/bundle/ug_npm2100_ek/page/UG/nPM2100_EK/connect_ek/connect_ek.html
 .. _`Using the nPM2100 Fuel Gauge`: https://docs.nordicsemi.com/bundle/nan_048/page/APP/nan_048/intro.html
 
-.. _`nRF socket options`: https://docs.nordicsemi.com/bundle/ncs-latest/page/nrfxlib/nrf_modem/doc/sockets.html
-
 .. _`Zigbee R22`: https://docs.nordicsemi.com/bundle/addon-zigbee-r22-latest/page/index.html
 .. _`Zigbee R23`: https://docs.nordicsemi.com/bundle/addon-zigbee-r23-latest/page/index.html
 
diff --git a/doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst b/doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst
@@ -415,6 +415,7 @@ Cellular samples
 Cryptography samples
 --------------------
 
+* Added the :ref:`crypto_kmu_usage_nrf54l` sample.
 
 * :ref:`crypto_aes_ctr` sample:
 
diff --git a/doc/nrf/security/crypto/crypto_supported_features.rst b/doc/nrf/security/crypto/crypto_supported_features.rst
@@ -48,6 +48,7 @@ The Kconfig options follow the ``CONFIG_PSA_WANT_*`` + ``CONFIG_PSA_USE_*`` conf
    On nRF54H Series devices, the ``CONFIG_PSA_WANT_*`` and ``CONFIG_PSA_USE_*`` feature selection scheme is not implemented and enabling any feature with these options will silently have no effect.
    The |ISE| implements a fixed set of features and algorithms that cannot be changed by the user.
 
+.. _ug_crypto_supported_features_key_types:
 
 Key types and key management
 ============================
@@ -8997,6 +8998,8 @@ The options are grouped by Series and drivers available for the device Series, a
                  - Supported
                  - Supported
 
+.. _ug_crypto_supported_features_ecc_key_pair:
+
 ECC key pair operations
 -----------------------
 
diff --git a/samples/crypto/kmu_usage_nrf54l/CMakeLists.txt b/samples/crypto/kmu_usage_nrf54l/CMakeLists.txt
@@ -0,0 +1,16 @@
+#
+# Copyright (c) 2025 Nordic Semiconductor ASA
+#
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+#
+
+cmake_minimum_required(VERSION 3.20.0)
+
+find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE})
+
+project(kmu_usage)
+
+target_sources(app PRIVATE
+  src/main.c
+  src/key_operations.c
+)
diff --git a/samples/crypto/kmu_usage_nrf54l/README.rst b/samples/crypto/kmu_usage_nrf54l/README.rst
diff --git a/samples/crypto/kmu_usage_nrf54l/boards/nrf54l15dk_nrf54l05_cpuapp.conf b/samples/crypto/kmu_usage_nrf54l/boards/nrf54l15dk_nrf54l05_cpuapp.conf
@@ -0,0 +1,7 @@
+#
+# Copyright (c) 2025 Nordic Semiconductor ASA
+#
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+
+CONFIG_MBEDTLS_ENABLE_HEAP=y
+CONFIG_MBEDTLS_HEAP_SIZE=8192
diff --git a/samples/crypto/kmu_usage_nrf54l/boards/nrf54l15dk_nrf54l10_cpuapp.conf b/samples/crypto/kmu_usage_nrf54l/boards/nrf54l15dk_nrf54l10_cpuapp.conf
@@ -0,0 +1,7 @@
+#
+# Copyright (c) 2025 Nordic Semiconductor ASA
+#
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+
+CONFIG_MBEDTLS_ENABLE_HEAP=y
+CONFIG_MBEDTLS_HEAP_SIZE=8192
diff --git a/samples/crypto/kmu_usage_nrf54l/boards/nrf54l15dk_nrf54l15_cpuapp.conf b/samples/crypto/kmu_usage_nrf54l/boards/nrf54l15dk_nrf54l15_cpuapp.conf
@@ -0,0 +1,7 @@
+#
+# Copyright (c) 2025 Nordic Semiconductor ASA
+#
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+
+CONFIG_MBEDTLS_ENABLE_HEAP=y
+CONFIG_MBEDTLS_HEAP_SIZE=8192
diff --git a/samples/crypto/kmu_usage_nrf54l/boards/nrf54lm20dk_nrf54lm20a_cpuapp.conf b/samples/crypto/kmu_usage_nrf54l/boards/nrf54lm20dk_nrf54lm20a_cpuapp.conf
@@ -0,0 +1,7 @@
+#
+# Copyright (c) 2025 Nordic Semiconductor ASA
+#
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+
+CONFIG_MBEDTLS_ENABLE_HEAP=y
+CONFIG_MBEDTLS_HEAP_SIZE=8192
diff --git a/samples/crypto/kmu_usage_nrf54l/boards/nrf54lv10dk_nrf54lv10a_cpuapp.conf b/samples/crypto/kmu_usage_nrf54l/boards/nrf54lv10dk_nrf54lv10a_cpuapp.conf
@@ -0,0 +1,7 @@
+#
+# Copyright (c) 2025 Nordic Semiconductor ASA
+#
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+
+CONFIG_MBEDTLS_ENABLE_HEAP=y
+CONFIG_MBEDTLS_HEAP_SIZE=8192
diff --git a/samples/crypto/kmu_usage_nrf54l/keys/keys.json b/samples/crypto/kmu_usage_nrf54l/keys/keys.json
@@ -0,0 +1,13 @@
+{
+    "version": 0,
+    "keyslots": [
+        {
+            "metadata": "0x00248000014B4E80000300000010C004000000000100FF7F00000000",
+            "value": "0x44daa497a188ad60c7962cba7c5c7d8f"
+        },
+        {
+            "metadata": "0x4271FF00014B4E800014000000080006000000000230FF7F00000000",
+            "value": "0xf6abfa713fa892bc4e8f4f457745b0a8751eb3c7119db32c13e72a02ed8433ff"
+        }
+    ]
+}
diff --git a/samples/crypto/kmu_usage_nrf54l/keys/sources/aes_128_key.txt b/samples/crypto/kmu_usage_nrf54l/keys/sources/aes_128_key.txt
@@ -0,0 +1 @@
+0x44daa497a188ad60c7962cba7c5c7d8f
diff --git a/samples/crypto/kmu_usage_nrf54l/keys/sources/my_ed25519_priv_key.pem b/samples/crypto/kmu_usage_nrf54l/keys/sources/my_ed25519_priv_key.pem
@@ -0,0 +1,3 @@
+-----BEGIN PRIVATE KEY-----
+MC4CAQAwBQYDK2VwBCIEIMt0jtW811QPIEkmIROU2tCYCfnosNZ+pJ6je9FyObJr
+-----END PRIVATE KEY-----
diff --git a/samples/crypto/kmu_usage_nrf54l/prj.conf b/samples/crypto/kmu_usage_nrf54l/prj.conf
@@ -0,0 +1,54 @@
+#
+# Copyright (c) 2025 Nordic Semiconductor ASA
+#
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+#
+# The Zephyr CMSIS emulation assumes that ticks are ms, currently
+CONFIG_SYS_CLOCK_TICKS_PER_SEC=1000
+
+CONFIG_MAIN_STACK_SIZE=4096
+CONFIG_HEAP_MEM_POOL_SIZE=4096
+CONFIG_REBOOT=y
+
+# Enable logging
+CONFIG_CONSOLE=y
+CONFIG_LOG=y
+CONFIG_LOG_BUFFER_SIZE=4096
+
+# Enable nordic security backend and PSA APIs
+CONFIG_NRF_SECURITY=y
+CONFIG_MBEDTLS_PSA_CRYPTO_C=y
+
+# Using hardware crypto accelerator
+CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
+CONFIG_PSA_CRYPTO_DRIVER_CRACEN=y
+
+CONFIG_CRACEN_IKG=y
+
+CONFIG_HW_UNIQUE_KEY=y
+# Required to automatically generate and store SEED value during the first boot
+CONFIG_HW_UNIQUE_KEY_WRITE_ON_CRYPTO_INIT=y
+
+CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE=y
+CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT=y
+CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT=y
+
+CONFIG_PSA_WANT_ECC_TWISTED_EDWARDS_255=y
+CONFIG_PSA_WANT_ECC_SECP_R1_256=y
+
+CONFIG_PSA_WANT_ALG_SHA_256=y
+CONFIG_PSA_WANT_ALG_SHA_512=y
+CONFIG_PSA_WANT_ALG_ECDSA=y
+CONFIG_PSA_WANT_ALG_PURE_EDDSA=y
+CONFIG_PSA_WANT_ALG_CTR=y
+
+# For key generation
+CONFIG_PSA_WANT_GENERATE_RANDOM=y
+
+# Required to enable support for Encrypted key usage scheme
+CONFIG_PSA_WANT_KEY_TYPE_AES=y
+CONFIG_PSA_WANT_AES_KEY_SIZE_256=y
+CONFIG_PSA_WANT_ALG_ECB_NO_PADDING=y
+CONFIG_PSA_WANT_ALG_CMAC=y
+CONFIG_PSA_WANT_ALG_SP800_108_COUNTER_CMAC=y
+CONFIG_PSA_WANT_ALG_GCM=y
diff --git a/samples/crypto/kmu_usage_nrf54l/sample.yaml b/samples/crypto/kmu_usage_nrf54l/sample.yaml
@@ -0,0 +1,38 @@
+sample:
+  description: |
+    This sample provides an example of using key provisioning and the KMU
+    (Key Management Unit) with the PSA Crypto API.
+    Different types of keys are generated and stored to the KMU.
+  name: KMU usage for nRF54L
+
+common:
+  sysbuild: true
+  tags:
+    - introduction
+    - kmu
+    - sysbuild
+    - ci_samples_crypto
+  harness: console
+  harness_config:
+    type: multi_line
+    regex:
+      - ".*Example finished successfully!.*"
+
+tests:
+  sample.kmu_usage_nrf54l:
+    sysbuild: true
+    platform_allow:
+      - nrf54l15dk/nrf54l15/cpuapp
+      - nrf54l15dk/nrf54l15/cpuapp/ns
+      - nrf54lm20dk/nrf54lm20a/cpuapp
+      - nrf54lv10dk/nrf54lv10a/cpuapp
+      - nrf54lv10dk/nrf54lv10a/cpuapp/ns
+      - nrf54l15dk/nrf54l10/cpuapp
+      - nrf54l15dk/nrf54l10/cpuapp/ns
+      - nrf54l15dk/nrf54l05/cpuapp
+    integration_platforms:
+      - nrf54l15dk/nrf54l15/cpuapp
+      - nrf54l15dk/nrf54l15/cpuapp/ns
+      - nrf54lm20dk/nrf54lm20a/cpuapp
+      - nrf54lv10dk/nrf54lv10a/cpuapp
+      - nrf54lv10dk/nrf54lv10a/cpuapp/ns
diff --git a/samples/crypto/kmu_usage_nrf54l/src/key_operations.c b/samples/crypto/kmu_usage_nrf54l/src/key_operations.c
diff --git a/samples/crypto/kmu_usage_nrf54l/src/key_operations.h b/samples/crypto/kmu_usage_nrf54l/src/key_operations.h
diff --git a/samples/crypto/kmu_usage_nrf54l/src/main.c b/samples/crypto/kmu_usage_nrf54l/src/main.c
diff --git a/samples/crypto/kmu_usage_nrf54l/src/main.h b/samples/crypto/kmu_usage_nrf54l/src/main.h
diff --git a/scripts/generate_psa_key_attributes/generate_psa_key_attributes.rst b/scripts/generate_psa_key_attributes/generate_psa_key_attributes.rst
