Secure storage in the nRF Connect SDK

The nRF Connect SDK implements secure storage through the PSA Certified Secure Storage API. The implementation is designed to securely store and manage sensitive data, such as cryptographic keys, device credentials, and configuration data.

The following implementations of the PSA Secure Storage API are available:

• TF-M’s Internal Trusted Storage service and Protected Storage service services - This option can only be used when building with TF-M and if the ARM TrustZone technology and hardware-accelerated firmware isolation are supported by the hardware platform in use. Using this option, the Internal Trusted Storage and the Protected Storage are working with security by separation.

• The Secure Storage subsystem - This option enables you to provide confidentiality, integrity and authenticity of the stored data when building without TF-M. Using this option, you can use the PSA Secure Storage API without TF-M.

• The Trusted storage library - This option is the predecessor of Secure Storage and is deprecated. Use Secure Storage instead.

Note

In the nRF Connect SDK, the PSA Protected Storage is one of the available data storage options. It does not currently support storing data to external flash.

The table below gives an overview of the secure storage support for the products and their features.

Secure storage product support

Product	Backend	Confidentiality	Integrity	Authenticity	Isolation
nRF91 Series with TF-M	TF-M’s Internal Trusted Storage service and Protected Storage service	Yes	Yes	Yes	Yes
nRF91 Series without TF-M	Secure Storage subsystem	Yes	Yes	Yes	No [1]
nRF54L Series with TF-M	TF-M’s Internal Trusted Storage service and Protected Storage service	Yes	Yes	Yes	Yes
nRF54L Series without TF-M	Secure Storage subsystem	Yes	Yes	Yes	No [1]
nRF5340 with TF-M	TF-M’s Internal Trusted Storage service and Protected Storage service	Yes	Yes	Yes	Yes
nRF5340 without TF-M	Secure Storage subsystem	Yes	Yes	Yes	No [1]
nRF52840	Secure Storage subsystem	Yes	Yes	Yes	No [1]
nRF52833	Secure Storage subsystem	No [2]	Yes	No	No [1]
nRF52832	Secure Storage subsystem	No [2]	Yes	No	No [1]

Notes for confidentiality partial support

[1] (1,2,3,4,5,6)

On SoCs without the isolation feature, the confidentiality is limited to protection of data at rest in a non-volatile internal or external memory. This confidentiality is based on a CPU-inaccessible master key used for data encryption. When the data is decrypted for usage, there is no mechanism providing access control and protecting its visibility. Using a TrustZone-enabled SoC and building with TF-M provides stronger protection, and is recommended if available.

[2] (1,2)

The use of Hardware Unique Key (HUK) to provide the AEAD key is not available on nRF52833 and nRF52832 devices. For those devices, the Secure Storage subsystem offers the use of SHA-256 over the device ID and/or the entry UID to generate the key, which does not guarantee security beyond the integrity check of the encrypted data.