Key slots that are configured as non-readable cannot be read by the CPU regardless of the mode the system is in, and must be pushed over secure APB in order to use the key value for cryptographic operations.
The secure APB destination address is set in the key slot configuration DEST register. Such destination addresses are typically write-only key registers in a hardware cryptographic accelerators memory map. The secure APB allows key slots to be utilized by the software side, without exposing the key value itself.
Pushing a key slot over secure APB is a four-step process:
- Select the key slot on which the KMU shall operate by writing the desired key slot ID into KMU->SELECTKEYSLOT.
- Start TASKS_PUSH_KEYSLOT to initiate a secure APB transaction, writing the 128-bit key value associated with the selected key slot into address defined in KEYSLOT.CONFIG[ID-1].DEST.
- After completing the secure APB transaction, the 128-bit key value is ready for use by the peripheral and EVENTS_KEYSLOT_PUSHED is triggered.
- Select key slot 0.
Note: If a key value is distributed over multiple key slots due to its key size, exceeding the
maximum 128-bit key value limitation, then each distributed key slot must be pushed
individually in order to transfer the entire key value over secure APB.
Step 3 will trigger other events than EVENTS_KEYSLOT_PUSHED if the following violations
are detected:
- EVENTS_KEYSLOT_ERROR:
- If no key slot is selected
- If a key slot has no destination address configured
- If when pushing a key slot, flash or peripheral returns an error
- If pushing a key slot when push permissions are disabled
- If attempting to push a key slot with default permissions
- EVENTS_KEYSLOT_REVOKED if a key slot is marked as revoked in its key header configuration