Provisioning keys for the nRF54H Series

nRF Util
tags
nRF Util

For the nRF54H Series devices, the keys are stored in the Secure Domain (SecDom). The Secure Domain is a dedicated domain which executes a pre-compiled and Nordic Semiconductor-signed firmware component.

The nRF54H Series device must be in Root of Trust (RoT) lifecycle state for key provisioning to work. The Secure Domain Firmware on the device handles the actual key provisioning using PSA Crypto's psa_import_key function. Provisioning a key will call the function to import the key. The metadata field from the JSON file is used for the function's attributes argument, the value field is passed to the function's data argument, and the function's data_length will be set to the length of the value field.

For detailed procedure, see the Provisioning keys on the nRF54H20 SoC page.

For example, the following command provisions the keys from key_file.json onto an nRF54H20 device with the serial number 1234567890: 

nrfutil device x-provision-keys --serial-number 1234567890 --key-file key_file.json

The command outputs a boolean value, for example:

  • Success -- all the keys were written to the device: 

    ✔  Provisioned keys 1234567890

  • Failure -- one or all of provisioning tasks failed: 

    ❌ Failed to provision keys on 1234567890, [Probe] Device error: Failed to import 3/3 key(s)
    The failure reasons may vary, and may include an error in the transfer process or some hardware-related issue. For example, in the following example, the key attributes for the keyslot are too short: 
    ❌ Failed to provision keys on 1234567890, [Probe] Device error: Key attributes for keyslot 0 are too short, expected 28 bytes, got 27
Error: One or more key provisioning tasks failed:
 * 1234567890: [Probe] Device error: Key attributes for keyslot 0 are too short, expected 28 bytes, got 27 (Generic)
    In the following example, the keys are already present in the SecDom: 
    ❌ Failed to provision keys on 1234567890, [Probe] Device error: Failed to import 3/3 key(s)
Error: One or more key provisioning tasks failed:
 * 1051176176: [Probe] Device error: Failed to import 3/3 key(s):
    * Key 0 with attributes '4241ff0001004e800108000000080006000000000021024000000000' failed with message: The Crypto API returned error code PSA_ERROR_ALREADY_EXISTS (-139)
    * Key 1 with attributes '4241ff0001004e800108000000080006000000000021034000000000' failed with message: The Crypto API returned error code PSA_ERROR_ALREADY_EXISTS (-139)
    * Key 2 with attributes '4241ff0001004e8001080000000800060000000000aa004000000000' failed with message: The Crypto API returned error code PSA_ERROR_ALREADY_EXISTS (-139) (Generic)