nRF Security

The nRF Security subsystem (nrf_security) integrates cryptographic services for SoCs from Nordic Semiconductor.

Overview

The nRF Security subsystem provides:

  • The PSA Crypto API through Oberon PSA Crypto.

  • TLS, DTLS, and X.509 support through Mbed TLS.

  • Hardware acceleration through dedicated cryptographic libraries on selected SoCs (nrf_cc3xx, CRACEN), with binary versions of the libraries listed in Cryptographic libraries.

  • Software fallbacks when hardware acceleration is unavailable (nrf_oberon).

  • A PSA driver abstraction layer that enables simultaneous use of hardware and software implementations.

  • Compatibility with the specific Mbed TLS version included in the nRF Connect SDK through sdk-mbedtls.

  • Integration logic for the Oberon PSA Crypto core (sdk-oberon-psa-crypto).

  • Source code for the CRACEN driver.

  • Integration with the nRF Connect SDK build system.

The nRF Security subsystem can interface with the nrf_cc3xx_mbedcrypto library. This library conforms to the specific revision of Mbed TLS that is supplied through the nRF Connect SDK.

Configuration

To enable nRF Security, enable the CONFIG_PSA_CRYPTO Kconfig option. On Nordic Semiconductor’s Arm cores, this automatically enables the nRF Security subsystem (CONFIG_NRF_SECURITY).

PSA Crypto

Cryptographic operations are enabled with the CONFIG_PSA_CRYPTO Kconfig option.

The PSA Crypto API in the nRF Connect SDK provides secure crypto operations for Nordic Semiconductor’s Arm cores through standardized Platform Security Architecture. Using one of the available implementations of the PSA Crypto API, the SDK implements the cryptographic features in software or using hardware accelerators, or both.

For more information, see Configuring PSA Crypto API. For the list of supported crypto features, see Supported cryptographic operations in the nRF Connect SDK.

Depending on the implementation you are using, the nRF Connect SDK builds nRF Security using different versions of the PSA Crypto API.

PSA Crypto API versions by implementation

Implementation

PSA Crypto API version

Oberon PSA Crypto

v1.4.1

TF-M Crypto Service

v1.4.1

IronSide Secure Enclave

v1.4.1

Mbed TLS (TLS and X.509)

Enable Mbed TLS only when your application needs TLS, DTLS, or X.509 certificate handling. To enable TLS and X.509 support, set the CONFIG_MBEDTLS Kconfig option.

Note

For all other cryptographic operations, use the PSA Crypto API by enabling CONFIG_PSA_CRYPTO. nRF Security uses the Mbed TLS integration from Zephyr, but replaces the TF-PSA-Crypto repository used in Zephyr with Oberon PSA Crypto.

Some TF-PSA-Crypto Kconfig options still use the MBEDTLS_ prefix even when CONFIG_MBEDTLS is disabled. These options configure the crypto stack, not Mbed TLS.

For the Mbed TLS version included in the nRF Connect SDK, see Security.

Configuring the PSA Crypto/Mbed TLS heap

When using either PSA Crypto or Mbed TLS, you can enable the heap for both with the CONFIG_MBEDTLS_ENABLE_HEAP Kconfig option and adjust the heap size for your workload using the CONFIG_MBEDTLS_HEAP_SIZE Kconfig option.

Dependencies

The nRF Security subsystem uses the following nRF Connect SDK modules:

  • sdk-oberon-psa-crypto - Oberon PSA Crypto (PSA Crypto Core and TF-PSA-Crypto implementation; replaces Zephyr’s TF-PSA-Crypto when nRF Security is enabled)

  • sdk-nrfxlib - Prebuilt cryptographic libraries (CryptoCell, Oberon software libraries)

  • sdk-mbedtls - TLS, DTLS, and X.509 support (only when CONFIG_MBEDTLS is enabled)

  • sdk-trusted-firmware-m - Security by separation with ARM TrustZone and TF-M Crypto Service (only when TF-M is enabled by building for an */ns board target)

The subsystem uses cryptographic drivers based on Kconfig options such as CONFIG_PSA_CRYPTO_DRIVER_CC3XX, CONFIG_PSA_CRYPTO_DRIVER_CRACEN, and CONFIG_PSA_CRYPTO_DRIVER_OBERON. For driver details and selection rules, see Cryptographic drivers.

API documentation

For Doxygen API reference for nRF Security driver structures and the CRACEN driver, see API documentation.