nRF54L Series Express

Feedback
Feedback

If you are having issues with the exercises, please create a ticket on DevZone: devzone.nordicsemi.com
Drag & Drop Files, Choose Files to Upload You can upload up to 2 files.
Register

Basic concepts of information security

In this lesson, we will cover how the nRF54L Series deals with the security aspects. The main security features available in the nRF54L Series will be covered more in-depth in this lesson to give a better perspective on what kind of protection each component offers. Main features include:

  • Secure Boot
  • Secure Attestation
  • Secure Key Storage
  • Hardware isolation with Arm® TrustZone
  • Cryptographic Accelerator Engine (CRACEN) with Isolated Key Generation (IKG)
  • Tamper Detection

The full list of security features available in nRF54L Series devices is found in the whitepaper Nordic Platform Security.

Security features on the nRF54L Series

To better understand the security features in nRF54L, we will next cover some basics about embedded device security. If you feel that you are already comfortable with the basics of security, you can continue to the next section directly.

Root-of-Trust

The Root of Trust (RoT) is a fundamental component of device security, providing the basis for verifying the boot process. It establishes the initial trustworthiness of a device by validating firmware and critical configurations. If compromised, the security of the device is at risk. Nordic Semiconductor devices typically include the following RoT components:

  • Platform Root of Trust (PRoT) – This is the overall framework that includes hardware and software components responsible for establishing trust within the device. PRoT encompasses various trust anchors, including cryptographic keys and secure hardware features.
  • Immutable Root of Trust (IRoT) – This refers to a secure and unchangeable component of the PRoT that is responsible for validating the integrity of the initial firmware at boot time. It ensures that the boot code cannot be altered or tampered with, providing a strong foundation for device security.
  • Updatable Root of Trust (URoT) – This allows for firmware updates while maintaining a secure environment. URoT provides the ability to securely update parts of the RoT, ensuring ongoing protection against emerging threats while allowing flexibility in firmware management.

Chain of Trust

The chain of trust is established when the RoT verifies the integrity of each component in the boot process, creating a sequence that ensures each stage is authentic and has not been tampered with. This process begins with the immutable bootloader and optionally extends all the way to the application, where a chain of verified components all safeguard against unauthorized modifications.

Public-key cryptography

In public-key cryptography, also known as asymmetric cryptography, two keys are made for encryption and decryption, as well as signing and verification: a private key and its public key counterpart. The public key can be used for data encryption or verification of authenticity, whereas only the private key can be used for decryption and signing. The public key can be, as the name implies, publicly accessible (non-secret), while the private key should only be known to the device it belongs to.

For example, in secure boot a private key is generated by the developer, and its public key counterpart is embedded into the bootloader. The application firmware is signed with the private key, and the bootloader must verify that the signature matches with the public key – if not, the firmware will be rejected, and the application will not run.

Application verification process

Make sure to Log in or Register to save your progress

Back
Next

Switch language?

Progress is tracked separately for each language. Switching will continue from your progress in that language or start fresh if you haven't begun.

Your current progress is saved, and you can switch back anytime.

Register an account
Already have an account? Log in
(All fields are required unless specified optional)

  • 8 or more characters
  • Upper and lower case letters
  • At least one number or special character

Forgot your password?
Enter the email associated with your account, and we will send you a link to reset your password.