Skip to content

doc: security: update for v3.2.0 #25849

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

doc: security: update for v3.2.0 #25849

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 10 additions & 9 deletions doc/_zoomin/ncs.tags.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -272,21 +272,22 @@ mapping_topics:
- nrf/security/*.html: ["kconfig"]
- nrf/security/crypto/*.html: ["nrf91-series", "nrf54-series", "nrf53-series",
"nrf52-series", "nrf9160", "nrf9161", "nrf9151", "nrf9131",
"nrf54h20", "nrf54l15", "nrf54l10", "nrf54lm20a", "nrf54l05",
"nrf5340", "nrf52840", "nrf52833", "nrf52832", "kconfig"]
"nrf54h20", "nrf54l15", "nrf54l10", "nrf54lm20a", "nrf54lv10a",
"nrf54l05", "nrf5340", "nrf52840", "nrf52833", "nrf52832",
"kconfig"]
- nrf/security/tfm/*.html: ["nrf91-series", "nrf70-series", "nrf54-series", "nrf53-series",
"nrf9160", "nrf9161", "nrf9151", "nrf9131", "nrf7002",
"nrf54l15", "nrf54l10", "nrf54lm20a", "nrf5340", "thingy91",
"thingy91x", "thingy53", "kconfig"]
"nrf54l15", "nrf54l10", "nrf54lm20a", "nrf54lv10a", "nrf5340",
"thingy91", "thingy91x", "thingy53", "kconfig"]
- nrf/security/ap_protect.html: ["nrf91-series", "nrf54-series", "nrf53-series",
"nrf52-series", "nrf9160", "nrf9161", "nrf9151", "nrf9131",
"nrf54h20", "nrf54l15", "nrf5340", "nrf52840", "nrf52833",
"nrf52832", "nrf52820", "nrf52811", "nrf52810", "nrf52805",
"kconfig"]
"nrf54h20", "nrf54l15", "nrf54lm20a", "nrf54lv10a", "nrf5340",
"nrf52840", "nrf52833", "nrf52832", "nrf52820", "nrf52811",
"nrf52810", "nrf52805", "kconfig"]
- nrf/security/secure_storage.html: ["nrf91-series", "nrf54-series", "nrf53-series",
"nrf52-series", "nrf9160", "nrf9161", "nrf9151", "nrf9131",
"nrf54l15", "nrf54l10", "nrf54lm20a", "nrf5340", "nrf52840",
"nrf52833", "nrf52832", "kconfig"]
"nrf54l15", "nrf54l10", "nrf54lm20a", "nrf54lv10a",
"nrf5340", "nrf52840", "nrf52833", "nrf52832", "kconfig"]
- nrf/protocols/*.html: ["protocols"]
- nrf/protocols.html: ["sidewalk", "ble", "blemesh", "esb", "gazell", "matter", "multiprotocol",
"nfc", "thread", "zigbee", "wifi", "dect-nr+", "protocols"]
Expand Down
3 changes: 1 addition & 2 deletions doc/nrf/app_dev/device_guides/nrf54l/cryptography.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -287,7 +287,7 @@ For each key type, the table lists the supported algorithms and indicates which
- No
- Yes
- Yes
* - ECC secp256r1 key pair (ECDSA and ECDH usage) [4]_
* - ECC secp256r1 key pair (ECDSA and ECDH usage)
- | ``key_type``: ``PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1)``
|
| ``key_bits``: 256
Expand Down Expand Up @@ -346,7 +346,6 @@ For each key type, the table lists the supported algorithms and indicates which
.. [1] Store each key with only one algorithm to follow PSA Crypto best practices.
.. [2] Keys with the Encrypted usage scheme (``CRACEN_KMU_KEY_USAGE_SCHEME_ENCRYPTED``) will require two additional KMU slots to store the nonce and the authentication tag.
.. [3] 192-bit key size is not supported on nRF54LM20A.
.. [4] ECDH not supported for key derivation.

.. _ug_nrf54l_crypto_kmu_storing_keys:

Expand Down
7 changes: 4 additions & 3 deletions doc/nrf/links.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -275,12 +275,11 @@
.. _`Key identifiers`: https://arm-software.github.io/psa-api/crypto/1.1/api/keys/ids.html#key-identifiers
.. _`Key management functions`: https://arm-software.github.io/psa-api/crypto/1.1/api/keys/management.html
.. _`Keystore interface`: https://arm-software.github.io/psa-api/crypto/1.1/overview/goals.html#a-keystore-interface
.. _`PSA Cryptography API 1.0.1`: https://armmbed.github.io/mbed-crypto/1.0.1/html/index.html
.. _`PSA Certified Crypto API 1.0.0`: https://arm-software.github.io/psa-api/crypto/1.0/IHI0086-PSA_Cryptography_API-1.0.0.pdf
.. _`PSA Certified Crypto API 1.3.1`: https://arm-software.github.io/psa-api/crypto/1.3/
.. _`PSA functions for key management`: https://arm-software.github.io/psa-api/crypto/1.1/api/keys/management.html
.. _`PSA_KEY_USAGE_EXPORT policy`: https://arm-software.github.io/psa-api/crypto/1.3/api/keys/policy.html#c.PSA_KEY_USAGE_EXPORT

.. _`PSA Certified Crypto API 1.3.1`: https://arm-software.github.io/psa-api/crypto/1.3/

.. _`PSA Certified Secure Storage API`: https://arm-software.github.io/psa-api/storage/
.. _`PSA Certified Secure Storage API 1.0`: https://arm-software.github.io/psa-api/storage/1.0/

Expand Down Expand Up @@ -954,6 +953,8 @@
.. _`AP-Protect for nRF9151`: https://docs.nordicsemi.com/bundle/ps_nrf9151/page/dif.html#ariaid-title3
.. _`AP-Protect for nRF9161`: https://docs.nordicsemi.com/bundle/ps_nrf9161/page/dif.html#ariaid-title3
.. _`Debugger access protection for nRF9160`: https://docs.nordicsemi.com/bundle/ps_nrf9160/page/dif.html#ariaid-title2
.. _`AP-Protect for nRF54LV10A`: https://docs.nordicsemi.com/bundle/ps_nrf54LV10A/page/ctrl-ap.html
.. _`AP-Protect for nRF54LM20A`: https://docs.nordicsemi.com/bundle/ps_nrf54LM20A/page/ctrl-ap.html
.. _`AP-Protect for nRF54L15`: https://docs.nordicsemi.com/bundle/ps_nrf54L15/page/ctrl-ap.html
.. _`AP-Protect for nRF5340`: https://docs.nordicsemi.com/bundle/ps_nrf5340/page/debugandtrace.html#ariaid-title9
.. _`AP-Protect for nRF52840`:
Expand Down
10 changes: 7 additions & 3 deletions doc/nrf/security.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,9 @@ The |NCS| |release| allows you to develop applications with the following versio
- IronSide Secure Element version
- Mbed TLS version
* - |release|
- v2.1.2
- v2.2.0
- v23.0.2+17
- 3.6.4
- 3.6.5

.. security_components_ver_table_end

Expand All @@ -49,7 +49,11 @@ Expand the following section to see the table listing versions of different secu
* - Upcoming release (currently on the ``main`` branch of `sdk-nrf`_)
- v2.2.0
- v23.0.2+17
- 3.6.4
- 3.6.5
* - v3.2.0
- v2.2.0
- v23.0.2+17
- 3.6.5
* - v3.1.0, v3.1.1
- v2.1.2
- v20.0.0+1
Expand Down
10 changes: 10 additions & 0 deletions doc/nrf/security/ap_protect.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,16 @@ See the related hardware documentation for more information about which implemen
- n/a
- n/a
- See :ref:`UICR.APPROTECT <ug_nrf54h20_ironside_se_uicr_approtect>`.
* - nRF54LV10A
- n/a
- ✔
- `AP-Protect for nRF54LV10A`_
- Also :ref:`supports Secure AP-Protect <secure_approtect_support>`
* - nRF54LM20A
- n/a
- ✔
- `AP-Protect for nRF54LM20A`_
- Also :ref:`supports Secure AP-Protect <secure_approtect_support>`
* - nRF54L15
- n/a
- ✔
Expand Down
7 changes: 3 additions & 4 deletions doc/nrf/security/psa_certified_api_overview.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,8 +62,7 @@ The following table provides an overview of the PSA Certified APIs support statu
* - `PSA Certified Crypto API`_
- Supported
- | `PSA Certified Crypto API 1.3.1`_ for IronSide Secure Element firmware for nRF54H20
| `PSA Certified Crypto API 1.3.1`_ for :ref:`nRF54L cryptography <ug_nrf54l_cryptography>` and PSA Crypto API builds without TF-M
| `PSA Certified Crypto API 1.0.0`_ for builds with TF-M
| `PSA Certified Crypto API 1.3.1`_ for :ref:`nRF54L cryptography <ug_nrf54l_cryptography>` and PSA Crypto API builds with and without TF-M
* - `PSA Certified Attestation API`_
- Supported
- `PSA Certified Attestation API 1.0`_ (not supported for IronSide Secure Element firmware for nRF54H20)
Expand Down Expand Up @@ -116,7 +115,7 @@ The PSA Crypto API has the following implementations in the |NCS|:
* :ref:`TF-M Crypto Service <ug_crypto_architecture_implementation_standards_tfm>`- which provides PSA Crypto API access through TF-M for applications that require enhanced security.
* :ref:`IronSide Secure Element <ug_crypto_architecture_implementation_standards_ironside>` - which provides PSA Crypto API interface for the :ref:`Secure Domain of nRF54H20 <ug_nrf54h20_secure_domain>`.

Depending on the implementation you are using, the |NCS| build system uses different versions of the PSA Crypto API.
Depending on the implementation you are using, the |NCS| build system can use different versions of the PSA Crypto API.

.. psa_crypto_support_tfm_build_start

Expand All @@ -129,7 +128,7 @@ Depending on the implementation you are using, the |NCS| build system uses diffe
* - :ref:`Oberon PSA Crypto <ug_crypto_architecture_implementation_standards_oberon>`
- `v1.3.1 <PSA Certified Crypto API 1.3.1_>`_
* - :ref:`TF-M Crypto Service <ug_crypto_architecture_implementation_standards_tfm>`
- `v1.0.0 <PSA Certified Crypto API 1.0.0_>`_
- `v1.3.1 <PSA Certified Crypto API 1.3.1_>`_
* - :ref:`IronSide Secure Element <ug_crypto_architecture_implementation_standards_ironside>`
- `v1.3.1 <PSA Certified Crypto API 1.3.1_>`_

Expand Down
Loading