SYMCRYPTO and Key Slot Unit (KSU) on Series 3#

Series 3 devices introduce two new hardware modules:

• SYMCRYPTO, a hardware accelerator for symmetric cryptographic operations

• Key Slot Unit (KSU), a secure volatile key storage module

Cryptographic operations performed with SYMCRYPTO are significantly faster than those performed by the Secure Engine (SE). For example, an AES-128 operation on a 256-byte data block takes approximately 40–50 μs with SYMCRYPTO, compared to 400–500 μs with the SE.

This section describes the SYMCRYPTO hardware accelerator and the KSU, explains how they work together, and discusses their security features and protections against physical attacks.

Background#

Hardware cryptographic accelerators improve performance while helping mitigate physical attacks such as side-channel attacks and fault attacks.

Side-channel attacks analyze physical characteristics, such as execution time or power consumption, to infer information about cryptographic keys.

Fault attacks intentionally inject errors into a cryptographic engine, typically through electromagnetic interference or voltage glitches, to reveal information about the internal state of the algorithm.

Differential power analysis (DPA)#

Differential power analysis (DPA) observes the power consumption of cryptographic operations, such as encryption and decryption. By analyzing power traces collected over many operations, an attacker may infer portions of a symmetric key.

The SE AES engine and the SYMCRYPTO engine implement DPA countermeasures that introduce randomized power consumption to reduce the correlation between power traces and cryptographic operations.

Differential fault attach#

Differential fault attack introduces faults during cryptographic operations and compares the resulting incorrect outputs with correct outputs to derive information about the internal state of the algorithm.

A common mitigation performs the same operation twice and compares the results. If the results differ, the operation is discarded.

The Series 3 SE AES engine includes DFA detection. The SYMCRYPTO AES engine does not.

SYMCRYPTO accelerator#

SYMCRYPTO provides hardware acceleration for AES and hashing operations. It works with the KSU so that symmetric keys are referenced by a key handle rather than exposed to the host CPU in plaintext.

The following algorithms are supported.

SYMCRYPTO and KSU data flow#

1. The application requests a cipher operation, such as CCM, and specifies the key by reference.

2. SYMCRYPTO requests the key from the KSU by using the specified slot number.

3. The KSU transfers the requested key directly to SYMCRYPTO.

4. SYMCRYPTO performs the cryptographic operation and returns the result to the application.

Cipher operations#

Cipher operations, including AEAD and MAC operations, use SYMCRYPTO when the key is stored in plaintext or when the key descriptor permits SYMCRYPTO acceleration.

* Plaintext keys are used directly and are not stored securely.

Advantages and limitations#

SYMCRYPTO performs cryptographic operations on small data blocks approximately ten times faster than the SE AES engine. This performance improvement benefits applications that require low-latency cryptographic operations.

The KSU provides 32 key slots. Depending on the application, some slots may be reserved by system software or wireless stacks.

Key Slot Unit (KSU)#

The KSU is a secure, volatile key storage module that stores symmetric keys in unwrapped form. Keys stored in the KSU are referenced by handle and transferred directly to the SYMCRYPTO hardware accelerator. The host CPU never accesses the plaintext key material.

The KSU is not part of the Cortex-M33 memory map. As a result, the host CPU cannot directly read or write its contents. Keys stored in the KSU are also lost when power is removed.

Import keys into the KSU#

Import keys into the KSU by using the psa_import_key() API.

During the import process:

1. The key is imported into the SE and unwrapped.

2. The plaintext key is transferred into a KSU slot.

The KSU also stores keys used by other hardware accelerators, such as LPWAES and the Bluetooth RPA accelerator. Therefore, not all key slots may be available to the application.

Note: These features require SE firmware v3.3.6 or later.

Use the vendor-defined key location SL_PSA_KEY_LOCATION_KSU_0 to indicate that a key should be stored in the KSU.

Typical KSU operations#

The following sections describe common KSU use cases.

Generate a key directly in the KSU#

When generating a new random key, you can store it directly in the KSU. Because KSU storage is volatile, this method is appropriate only for keys that do not need to persist across resets.

Configure the key attributes, then set the key lifetime as shown below. The PSA Crypto implementation automatically assigns a key slot.

// Store the key in the KSU.
psa_set_key_lifetime(
    &key_attr,
    PSA_KEY_LIFETIME_FROM_PERSISTENCE_AND_LOCATION(
        PSA_KEY_PERSISTENCE_VOLATILE,
        SL_PSA_KEY_LOCATION_KSU_0));

psa_generate_key(&key_attr, &key_id);// Store the key in the KSU.
psa_set_key_lifetime(
    &key_attr,
    PSA_KEY_LIFETIME_FROM_PERSISTENCE_AND_LOCATION(
        PSA_KEY_PERSISTENCE_VOLATILE,
        SL_PSA_KEY_LOCATION_KSU_0));

psa_generate_key(&key_attr, &key_id);

Import raw key material into the KSU#

When the plaintext key material is available, import it into the KSU by using psa_import_key().

// Store the key in the KSU.
psa_set_key_lifetime(
    &key_attr,
    PSA_KEY_LIFETIME_FROM_PERSISTENCE_AND_LOCATION(
        PSA_KEY_PERSISTENCE_VOLATILE,
        SL_PSA_KEY_LOCATION_KSU_0));

psa_import_key(&key_attr, key_buf, key_len, &key_id);// Store the key in the KSU.
psa_set_key_lifetime(
    &key_attr,
    PSA_KEY_LIFETIME_FROM_PERSISTENCE_AND_LOCATION(
        PSA_KEY_PERSISTENCE_VOLATILE,
        SL_PSA_KEY_LOCATION_KSU_0));

psa_import_key(&key_attr, key_buf, key_len, &key_id);

Copy an existing key into the KSU#

To copy an existing key into the KSU, the source key must be created with the PSA_KEY_USAGE_COPY usage flag.

psa_set_key_usage_flags(
    &key_attr,
    PSA_KEY_USAGE_ENCRYPT |
    PSA_KEY_USAGE_DECRYPT |
    PSA_KEY_USAGE_COPY);

psa_generate_key(&key_attr, &key_id);psa_set_key_usage_flags(
    &key_attr,
    PSA_KEY_USAGE_ENCRYPT |
    PSA_KEY_USAGE_DECRYPT |
    PSA_KEY_USAGE_COPY);

psa_generate_key(&key_attr, &key_id);

Retrieve the source key attributes, update the lifetime, and copy the key.

psa_key_id_t in, out;
psa_key_attributes_t attr;
psa_status_t status;

status = psa_get_key_attributes(in, &attr);

psa_set_key_lifetime(
    &attr,
    PSA_KEY_LIFETIME_FROM_PERSISTENCE_AND_LOCATION(
        PSA_KEY_PERSISTENCE_VOLATILE,
        SL_PSA_KEY_LOCATION_KSU_0));

status = psa_copy_key(in, &attr, &out);psa_key_id_t in, out;
psa_key_attributes_t attr;
psa_status_t status;

status = psa_get_key_attributes(in, &attr);

psa_set_key_lifetime(
    &attr,
    PSA_KEY_LIFETIME_FROM_PERSISTENCE_AND_LOCATION(
        PSA_KEY_PERSISTENCE_VOLATILE,
        SL_PSA_KEY_LOCATION_KSU_0));

status = psa_copy_key(in, &attr, &out);

Remove a key from the KSU#

Remove a key that is no longer needed to free its key slot.

psa_status_t status;

status = psa_destroy_key(key);psa_status_t status;

status = psa_destroy_key(key);

Disable the KSU#

If the application does not require the KSU, disable it as follows.

sl_se_command_context_t context;

sl_se_disable_ksu(&context);sl_se_command_context_t context;

sl_se_disable_ksu(&context);

Tamper detection and mitigation#

The KSU can generate tamper events to report memory integrity errors.

For more information, see Tamper Sources.