Writing a key slot into UICR is a five-step process.
- Select which key slot the KMU shall operate on by writing the desired key slot ID into the KMU SELECTKEYSLOT register. The selected key slot must be empty in order to add a new entry to UICR.
- If the key value shall be pushable over secure APB, the destination address of the recipient must be configured in register KEYSLOT.CONFIG[ID-1].DEST.
- Write the 128-bit key value into KEYSLOT.KEY[ID-1].VALUE[0-3].
- Write the desired key slot permissions into KEYSLOT.CONFIG[ID-1].PERM, including any applicable usage restrictions.
- Select key slot 0.
In case the total key size is greater than 128 bits, the key value itself must be split into 128-bit segments and written to multiple key slot instances. Steps 1 through 5 above must be repeated for the entire key size.
Note: If a key slot is configured as readable, and KEYSLOT.CONFIG[ID-1].DEST is not to be
used, it is recommended to disable the push bit in KEYSLOT.CONFIG[ID-1].PERM when
configuring key slot permissions.
Note: A key value distributed over multiple key slots should use the same key slot
configuration in its key headers, but the secure destination address for each key slot
instance must be incremented by 4 words (128 bits) for each key slot instance
spanned.
Note: Write to flash must be enabled in NVMC->CONFIG prior to writing keys to flash, and
subsequently disabled once writing is complete.
Steps 1 through 5 above will be blocked if any of the following violations are detected:
- No key slot selected
- Non-empty key slot selected
- NVM destination address not empty
- AHB write to KEYSLOT.KEY[ID-1].VALUE[0-3] registers not belonging to selected key slot