Loading seed to IKG

nRF54L15 | nRF54L10 | nRF54L05 Datasheet

The seed used by the IKG to generate keys must be pushed by the KMU to the SEED register and marked as valid before the keys can be generated.

To create and derive a seed the following sequence of operations are needed.
  1. Create device unique seed:
    1. Create 3 x 128 bit random number using CRACEN RNG
    2. Provision random number to KMU slots, e.g. 0, 1, and 2 (128 bits in each slot)
      1. SRC.DEST = CRACEN.SEED[n], where n=0, 4, and 8.
      2. SRC.VALUE = random[i], where i=0,1, and 2 (i.e. random number results from CRACEN.RND operation above)
  2. Load seed from KMU to CRACEN:
    1. Push the KMU slots where the SEED is stored, e.g. KMU slots 0, 1, and 2
    2. Write CRACEN.SEEDVALID  register to mark the seed as valid for the IKG
    3. To prevent any subsequent changes to the SEED, write CRACEN.SEEDLOCK  register.
Note: Any IKG key generations without valid seed (CRACEN.SEEDVALID) will fail.