Skip to content

secure_storage: add backward compatibility and plug in HUK library #22491

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rlubos merged 8 commits into from
Jun 4, 2025
Merged

secure_storage: add backward compatibility and plug in HUK library #22491

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
3358b46
trusted_storage: add missing PSA_WANT select
tomi-font May 22, 2025
5f27b01
trusted_storage: remove unnecessary includes
tomi-font May 22, 2025
d257334
trusted_storage: force using ZMS on all 54L Series products
tomi-font Jun 2, 2025
cb1d334
manifest: sdk-zephyr: cherry pick secure_storage adaptations
tomi-font May 23, 2025
e9296cb
secure_storage: introduce compatibility with trusted_storage
tomi-font May 23, 2025
eb25347
secure_storage: add HUK library-based AEAD key provider
tomi-font May 23, 2025
c2f97ed
tests: zephyr: extend secure_storage test coverage
tomi-font May 28, 2025
886dab1
samples: crypto: persistent_key_usage: support secure storage subsystem
tomi-font Jun 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion CODEOWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -824,6 +824,7 @@
/subsys/partition_manager/ @nordicjm @tejlmand
/subsys/pcd/ @nrfconnect/ncs-pluto
/subsys/sdfw_services/ @nrfconnect/ncs-aurora
/subsys/secure_storage/ @nrfconnect/ncs-aegir
/subsys/settings/ @nrfconnect/ncs-pluto @rghaddab
/subsys/sdfw_services/services/extmem/ @nrfconnect/ncs-charon
/subsys/sdfw_services/services/suit_service/ @nrfconnect/ncs-charon
Expand Down Expand Up @@ -945,6 +946,7 @@
/tests/subsys/pcd/ @nrfconnect/ncs-pluto
/tests/subsys/sdfw_services/ @nrfconnect/ncs-aurora
/tests/subsys/suit/ @nrfconnect/ncs-charon
/tests/subsys/usb/negotiated_speed/ @nrfconnect/ncs-low-level-test
/tests/tfm/ @nrfconnect/ncs-aegir @magnev
/tests/unity/ @nordic-krch
/tests/zephyr/boards/nrf/ @nrfconnect/ncs-low-level-test
Expand All @@ -968,7 +970,7 @@
/tests/zephyr/drivers/uart/ @nrfconnect/ncs-low-level-test
/tests/zephyr/drivers/watchdog/ @nrfconnect/ncs-low-level-test
/tests/zephyr/kernel/timer/timer_behavior/ @nrfconnect/ncs-low-level-test
/tests/subsys/usb/negotiated_speed/ @nrfconnect/ncs-low-level-test
/tests/zephyr/subsys/secure_storage/ @nrfconnect/ncs-aegir
/tests/zephyr/subsys/settings/performance/ @nrfconnect/ncs-pluto @rghaddab

/tests/benchmarks/multicore/idle/*.rst @nrfconnect/ncs-si-bluebagel-doc
Expand Down
9 changes: 3 additions & 6 deletions samples/crypto/persistent_key_usage/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,6 @@ find_package(Zephyr REQUIRED HINTS $ENV{ZEPHYR_BASE})
project(persistent_key)

target_sources(app PRIVATE
src/main.c
)

target_sources_ifdef(CONFIG_TRUSTED_STORAGE app PRIVATE
src/trusted_storage_init.c
)
src/main.c
src/init.c
)
13 changes: 9 additions & 4 deletions samples/crypto/persistent_key_usage/README.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,19 @@
.. _crypto_persistent_key:

Crypto: Persistent key storage
##############################
Crypto: Persistent key usage
############################

.. contents::
:local:
:depth: 2

Copy link
Contributor

@greg-fer greg-fer Jun 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Update line 3 to:

Crypto: Persistent key usage

The persistent key sample shows how to generate a persistent key using the Platform Security Architecture (PSA) APIs.
Persistent keys are stored in the Internal Trusted Storage (ITS) of the device and retain their value between resets.
The ITS backend is either provided by TF-M, or the :ref:`trusted_storage_readme` library when building applications without TF-M.
The implementation of the PSA ITS API is provided in one of the following ways, depending on your configuration:

* Through TF-M using Internal Trusted Storage and Protected Storage services.
* When building without TF-M: using either Zephyr's :ref:`secure_storage` subsystem or the :ref:`trusted_storage_readme` library.

A persistent key becomes unusable when the ``psa_destroy_key`` function is called.

Requirements
Expand Down Expand Up @@ -72,6 +76,7 @@ Dependencies

* :file:`psa/crypto.h`

* Builds without TF-M use the :ref:`trusted_storage_readme` library
* Builds without TF-M use the :ref:`secure_storage` subsystem as the PSA Secure Storage API
provider.

* The :ref:`lib_hw_unique_key` is used to encrypt the key before storing it.
8 changes: 4 additions & 4 deletions samples/crypto/persistent_key_usage/boards/nrf52840dk_nrf52840.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,19 +2,19 @@
# Copyright (c) 2024 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#

# Using hardware crypto accelerator
CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y

# When TF-M is not in use, the Secure storage subsystem provides the PSA Secure Storage API.
CONFIG_SECURE_STORAGE=y

CONFIG_FLASH=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_FLASH_MAP=y
CONFIG_NVS=y
CONFIG_SETTINGS=y
CONFIG_SETTINGS_NVS=y
CONFIG_TRUSTED_STORAGE=y

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
8 changes: 4 additions & 4 deletions samples/crypto/persistent_key_usage/boards/nrf5340dk_nrf5340_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,19 +2,19 @@
# Copyright (c) 2024 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#

# Using hardware crypto accelerator
CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y

# When TF-M is not in use, the Secure storage subsystem provides the PSA Secure Storage API.
CONFIG_SECURE_STORAGE=y

CONFIG_FLASH=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_FLASH_MAP=y
CONFIG_NVS=y
CONFIG_SETTINGS=y
CONFIG_SETTINGS_NVS=y
CONFIG_TRUSTED_STORAGE=y

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
7 changes: 3 additions & 4 deletions samples/crypto/persistent_key_usage/boards/nrf54l15dk_nrf54l05_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,20 +2,19 @@
# Copyright (c) 2024 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#

# Using hardware crypto accelerator
CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_CRYPTO_DRIVER_CRACEN=y

# Use TRUSTED_STORAGE because this is a non-TF-M board target.
CONFIG_TRUSTED_STORAGE=y
# When TF-M is not in use, the Secure storage subsystem provides the PSA Secure Storage API.
CONFIG_SECURE_STORAGE=y

CONFIG_FLASH=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_FLASH_MAP=y
CONFIG_ZMS=y
CONFIG_SETTINGS=y

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
7 changes: 3 additions & 4 deletions samples/crypto/persistent_key_usage/boards/nrf54l15dk_nrf54l10_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,20 +2,19 @@
# Copyright (c) 2024 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#

# Using hardware crypto accelerator
CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_CRYPTO_DRIVER_CRACEN=y

# Use TRUSTED_STORAGE because this is a non-TF-M board target.
CONFIG_TRUSTED_STORAGE=y
# When TF-M is not in use, the Secure storage subsystem provides the PSA Secure Storage API.
CONFIG_SECURE_STORAGE=y

CONFIG_FLASH=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_FLASH_MAP=y
CONFIG_ZMS=y
CONFIG_SETTINGS=y

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
7 changes: 3 additions & 4 deletions samples/crypto/persistent_key_usage/boards/nrf54l15dk_nrf54l15_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,20 +2,19 @@
# Copyright (c) 2024 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#

# Using hardware crypto accelerator
CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_CRYPTO_DRIVER_CRACEN=y

# Use TRUSTED_STORAGE because this is a non-TF-M board target.
CONFIG_TRUSTED_STORAGE=y
# When TF-M is not in use, the Secure storage subsystem provides the PSA Secure Storage API.
CONFIG_SECURE_STORAGE=y

CONFIG_FLASH=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_FLASH_MAP=y
CONFIG_ZMS=y
CONFIG_SETTINGS=y

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
5 changes: 3 additions & 2 deletions samples/crypto/persistent_key_usage/boards/nrf54lm20pdk_nrf54lm20a_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,12 @@
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause

# Using hardware crypto accelerator
CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_CRYPTO_DRIVER_CRACEN=y

# Use TRUSTED_STORAGE because this is a non-TF-M board target.
CONFIG_TRUSTED_STORAGE=y
# When TF-M is not in use, the Secure storage subsystem provides the PSA Secure Storage API.
CONFIG_SECURE_STORAGE=y

CONFIG_FLASH=y
CONFIG_FLASH_PAGE_LAYOUT=y
Expand Down
7 changes: 3 additions & 4 deletions samples/crypto/persistent_key_usage/boards/nrf54lv10dk_nrf5454lv10a_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,20 +2,19 @@
# Copyright (c) 2024 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#

# Using hardware crypto accelerator
CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_CRYPTO_DRIVER_CRACEN=y

# Use TRUSTED_STORAGE because this is a non-TF-M board target.
CONFIG_TRUSTED_STORAGE=y
# When TF-M is not in use, the Secure storage subsystem provides the PSA Secure Storage API.
CONFIG_SECURE_STORAGE=y

CONFIG_FLASH=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_FLASH_MAP=y
CONFIG_ZMS=y
CONFIG_SETTINGS=y

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
8 changes: 4 additions & 4 deletions samples/crypto/persistent_key_usage/boards/nrf9151dk_nrf9151.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,19 +2,19 @@
# Copyright (c) 2024 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#

# Using hardware crypto accelerator
CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y

# When TF-M is not in use, the Secure storage subsystem provides the PSA Secure Storage API.
CONFIG_SECURE_STORAGE=y

CONFIG_FLASH=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_FLASH_MAP=y
CONFIG_NVS=y
CONFIG_SETTINGS=y
CONFIG_SETTINGS_NVS=y
CONFIG_TRUSTED_STORAGE=y

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
8 changes: 4 additions & 4 deletions samples/crypto/persistent_key_usage/boards/nrf9160dk_nrf9160.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,19 +2,19 @@
# Copyright (c) 2024 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#

# Using hardware crypto accelerator
CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y

# When TF-M is not in use, the Secure storage subsystem provides the PSA Secure Storage API.
CONFIG_SECURE_STORAGE=y

CONFIG_FLASH=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_FLASH_MAP=y
CONFIG_NVS=y
CONFIG_SETTINGS=y
CONFIG_SETTINGS_NVS=y
CONFIG_TRUSTED_STORAGE=y

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
8 changes: 4 additions & 4 deletions samples/crypto/persistent_key_usage/boards/nrf9161dk_nrf9161.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,19 +2,19 @@
# Copyright (c) 2024 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#

# Using hardware crypto accelerator
CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_CRYPTO_DRIVER_CC3XX=y

# When TF-M is not in use, the Secure storage subsystem provides the PSA Secure Storage API.
CONFIG_SECURE_STORAGE=y

CONFIG_FLASH=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_FLASH_MAP=y
CONFIG_NVS=y
CONFIG_SETTINGS=y
CONFIG_SETTINGS_NVS=y
CONFIG_TRUSTED_STORAGE=y

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
Loading
Loading