Secure storage
This page describes secure storage for persistent Sidewalk keys in Sidewalk products based on nRF Connect SDK. The Sidewalk Platform Abstraction Layer (PAL) uses PSA trusted storage to protect device identity and protocol keys.
Trusted storage is enabled by default with the CONFIG_SIDEWALK_CRYPTO_PSA_KEY_STORAGE Kconfig option.
If you are migrating existing products, refer to the Migration guides before changing key storage settings.
Persistent Sidewalk keys
The Sidewalk stack uses two classes of persistent keys:
Device identity private keys provisioned through the Sidewalk manufacturing page or generated by the on-device certification flow. These keys correspond to the manufacturing store
SID_PAL_MFG_STORE_DEVICE_PRIV_ED25519andSID_PAL_MFG_STORE_DEVICE_PRIV_P256R1values.Runtime Sidewalk protocol master keys written by the Sidewalk stack through the PAL key-value storage interface. These symmetric keys derive traffic keys for the network, application, and device-to-device (D2D) layers using the CMAC algorithm.
The following table lists the persistent Sidewalk keys and their usage:
PSA key ID |
Key type |
Use |
KMU slot usage |
|---|---|---|---|
|
ED25519 private key |
Device identity key: proof of possession of the Ed25519 device certificate during registration and certification. Used to sign messages with EdDSA. |
Two slots, starting at offset 0. |
|
secp256r1 private key |
Device identity key: proof of possession of the P-256 device certificate during registration and certification. Used to sign messages with ECDSA. |
Two slots, starting at offset 2. |
|
AES-128 key |
Network Primary Key, used to derive network-layer keys for TXID obfuscation, network payload encryption, time synchronization authentication, and join response protection. The key derivation is based on the CMAC algorithm. |
One slot at offset 4. |
|
AES-128 key |
Application Primary Key, used to derive application-layer keys for Endpoint-to-Application Server payload encryption and application registration. The key derivation is based on the CMAC algorithm. |
One slot at offset 5. |
|
AES-128 key |
D2D Primary Key, used to derive D2D keys for encrypted communication between the Amazon Sidewalk Mobile SDK and the Endpoint. The key derivation is based on the CMAC algorithm. |
One slot at offset 6. |
Storage backends
You can configure trusted storage to store keys in one of the following locations:
Key Management Unit (KMU) - Enabled by default on supported nRF54L Series platforms with the
CONFIG_SIDEWALK_CRYPTO_PSA_KEY_STORAGE_KMUKconfig option.Settings partition - Used when the KMU option is disabled, for example on platforms without KMU support or when migrating field devices.
Recommended configuration
For new products, use PSA trusted storage to store Sidewalk keys.
This is enabled by default with the CONFIG_SIDEWALK_CRYPTO_PSA_KEY_STORAGE Kconfig option.
On the supported nRF54L Series platforms, use the KMU as the storage backend.
This is enabled by default with the CONFIG_SIDEWALK_CRYPTO_PSA_KEY_STORAGE_KMU Kconfig option.
If you use the KMU for other purposes and the default Sidewalk KMU slot range overlaps with other product keys, including MCUboot verification keys, configure the start slot with the CONFIG_SIDEWALK_CRYPTO_PSA_KEY_STORAGE_KMU_SLOT_START Kconfig option to avoid conflicts.
See Bootloader configuration for MCUboot key slot requirements.
Note
On already-deployed products, do not update your firmware to versions that change the key storage configuration. Changing the key storage configuration (for example, enabling or disabling the KMU option) changes where the keys are saved and which PSA key IDs are used, so existing keys might not be found. Refer to the Migration guides for more details.
Note
Once the identity keys have been moved from the manufacturing (MFG) storage partition to trusted storage, you cannot read them back in plaintext and restore the manufacturing storage partition to its original state.