Security of External Flash DA16200

HI There,

Thank you for posting your question online.
Let me try to answer your questions:

DonatoC said:

1.How can I protect the external flash memory from unauthorized read/write access?

There are answers to DA16200 security questions.

1. DA16200 can encrypt Wi-Fi password data using Secure NVRAM over the UART AT command. See UM-WI-015 section 4.7.
2. DA16200 supports Secure NVARM. The contents in NVRAM can be encrypted with the runtime secure APIs for security using Huk, Kpicv, and Kcp in the OTP.
3. The DA16200 provides a secure boot function that allows trusted images signed with a key to match the registration information in the system during the boot process to ensure the system’s platform integrity. In the production step, it is necessary to register the key information for authentication in the OTP, which is protected by ARM CC312 security engine.

DonatoC said:

2.Are there hardware-level protections (e.g., secure boot, memory access control) to prevent firmware extraction or modification?

Please refer on UM-WI-015 DA16200 DA16600 Security Tool User Manual
Please also check on DA16200 Datasheet


And also check on UM-WI-046 DA16200 DA16600 FreeRTOS SDK Programmer Guide section 16 Crypto Examples.

Best Regards,
OV_Renesas

Hi,

thank for your support! 

I  am using security tool  to encrypt the secure asset such as  the AES key.

I tried to securely store data in flash using the Secure Asset .The first thing to do is the device provisioning that stores the provisioning keys (Kcp or Kpicv) in the OTP memory. I should use  provisioning key, used to encrypt assets that need to be decrypted securely on the device. Using secury tool to generate assets, I encountered the following error, that I believe is due to the fact that I skipped the provisioning phase. So, the error was:

I understood that Krtl is used to encrypt sensitive assets such as Chip Master Keys (Kcm)  and Device Master Keys (Kdm) . The Security Tool derives a key from Krtl to secure these provisioning assets. Should I request Krtl key to generate enc.kcp.bin ?

Hi There,

Thank you for the reply.
Let me check on this with the Wi-Fi Team and I will get back to you as soon as possible.

Best Regards,
OV_Renesas

Hi,

 thank for your support, see you soon.

Hi,

 thank for your support, see you soon.

Hi There,

Thank you for the reply and apologies for the delay.
1) Please do not raise the same questions here and directly on your local FAE. 
We have both created internal ticket for the same issue. That is not efficient.

2)You want to store the user data securely in SFLASH

Secure storage and NVRAM features support full services to encrypt raw data and decrypt secure data.
But Secure Asset only supports a one-way function used to decrypt assets.

Secure Storage and NVRAM can use two key types depending on applying the Secure boot process.

• Keys in Secure boot: Root key, Kcp, Kpicv in OTP
• Keys in None Secure boot: User key

The secure boot provides high security but each DA16200 device should apply the Secure boot process when the device mass production.
It will increase the mass production resources. The User key case doesn't need the Secure boot process but the customer should manage it in a specific way.

• UM-WI-015 Sections 4.7.2 and 4.7.3 describe Secure Storage and Secure NVRAM functions.

SDK v3.2.9.1 supports Secure NVRAM with User key case but v3.2.8.1 needs the patch as follow.
Security_DA16200.zip

Please let us know if you have any other questions or requests.

Best Regards,
OV_Renesas

Hi, 

thank you for your support! I apologize for the incovient due to the double ticket on your portals.              I'm working on a project where I have to store confidential information  in the external memory.  First I encrypted  the data and then I should written them into the Serial Flash. I used the sflash write command  , but the write command didn't work properly, as you seen in the image.

Hi there,

Thank you for the reply.
It will not work with the sflash write command.
Please follow the instructions and apply the patch on your project.
You will be able to write encrypted data via the NVRAM menu on UART0 or via the APIs on FreeRTOS SDK.

Best Regards,
OV_Renesas

Hi, 

thank you for your support! I have understood that applying the patch I could write and read nvram in a secure way. I could perform these operations directly in the code with SDK API;

1 ) I can't understand how to perform this operation via UART0 console.

These are  the commands I have found on UART0 menu.... How could perform write with one of NVRAM commands? Which NVRAM address is allowed to be written to?  Are there no WiFi configurations in this memory? How do I avoid corrupting them with our writes? Is the User Area encrypted like NVRAM?

2 ) Looking at the NVRAM API from the manual "REN_UM-WI-046-DA16200_DA16600_FreeRTOS_SDK_Programmer_Guide_Rev_2v4.pdf" I see that it accepts ‘ITEMs’ and not addresses as parameters..... should I write to NVRAM in terms of ITEMs and not addresses? Not clear....

Best Regards

Hi There,

Apologies for the delay.
I am checking on this internally and I will get back to you as soon as possible.

Best Regards,
OV_Renesas

Hi There,

Apologies for the delay.

1. How could perform write with one of the NVRAM commands?
NVRAM commands for writing and reading one item.

• setenv: write in NVRAM
• getenv: read in NVRAM

When Secure NVRAM is enabled, the 'setenv' writes the item value after encrypting, and the 'getenv' reads the value after decrypting.
Other NVRAM commands also write and read values with encryption/decryption.

2.  Are there no WiFi configurations in this memory?
Wi-Fi configuration profiles information also are stored in NVRAM.

3. How do I avoid corrupting them with our writings?
NVRAM backup supports avoid corrupting them. When NVRAM is corrupted, NVRAM data is restored from NVRAM #1 automatically.

UM-WI-056 C.1 SFlash Memory Map:

4. Is the User Area encrypted like NVRAM?
User area can be encrypted like NVRAM using Secure storage. Please refer to UM-WI-015 section 4.7.2.

5.  Should I write to NVRAM in terms of ITEMs and not addresses?
The DA16200/DA16600 SDK defines various parameters for Wi-Fi interface configuration, and they are saved as profiles in the NVRAM.
So, it should be written to NVRAM using ITEMs and not addresses. Please refer to UM-WI-046 chap. 9 in detail.

Please let us know if you have any other questions.

Best Regards,
OV_Renesas

Hi, 

thank you for your support! I have seen the documentation UM-WI-046 chap. 9 and as wrote in the previous reply I understand that the NVRAM writes is item oriented.                                                              

Now I have found in the code that there are two list of items (INT and STRING) defined as enums.

typedef enum {

     /// DA16200 MAC Address in NVRAM (set only)

     DA16X_CONF_STR_MAC_NVRAM,

     /// DA16200 MAC Spoofing (set only)

     DA16X_CONF_STR_MAC_SPOOFING,

     /// DA16200 MAC in OTP (set only)

    ................................                                                                                                                                              }

1) e.g. if I want to save my AES key, should I add an enum such as DA16X_CUSTOM_AES_UART_128BIT_KEY to the STRING list?

And then I use the setenv command :

nvram.setenv DA16X_CUSTOM_AES_UART_128BIT_KEY 01-02-03-04-05-06-07-08-09-AA-BB-CC-DD-EE-FF

2) Does the firmware automatically store my key at the right address so that I see the NVRAM as a black box?

3) For instance I want to to store a key of 128 bit , how I could know if there is enough space in the NVRAM?                                         

Best Regards

Hi There,

Thank you for the reply.
Please find below the answers to your questions:

1. If I want to save my AES key, should I add an enum such as DA16X_CUSTOM_AES_UART_128BIT_KEY to the STRING list?
And then I use the setenv command.

-> An tsetenv command can be used to store user data in NVRAM without adding Items.
      tsetenv : tsetenv [temporary var] [string]
      ex) tsetenv DA16X_CUSTOM_AES_UART_128BIT_KEY 01-02-03-04-05-06-07-08-09-AA-BB-CC-DD-EE-FF

2. Does the firmware automatically store my key at the right address so that I see the NVRAM as a black box?
   -> The user key can be stored encrypted in the NVRAM area after applying secure NVRAM.

3. For instance I want to to store a key of 128 bit , how I could know if there is enough space in the NVRAM?   

   -> Available max NVRAM space is 4KB and can check the current usage size through getenv command.

      
Best Regards,
OV_Renesas

Hi,

Thank you for your feedback.

I have followed this procedure:

1) As First step, in the firmware I  get my secret key with this API. 

- Secret_key = char *read_nvram_string(DA16X_CUSTOM_AES_UART_128BIT_KEY).  

I have added API function in user_main.c, as you can seen in the image below:

int user_main(char init_state)
{
    int	status = 0;
    char aes_key[70];
	char *p = aes_key;
	......................
	......................
	......................
    PRINTF("Loading AES Key from NVRAM...\n");
    
	p = read_nvram_string("DA16X_CUSTOM_AES_UART_128BIT_KEY");

	if (p == NULL) {
			PRINTF("ERROR: AES Key Read Failed! Using Default Key\n");
			memset(aes_key, 0, sizeof(aes_key));  // Clear memory
	} else {
		PRINTF("AES Key Read from NVRAM: ");
		for (int i = 0; i < 70; i++) {
		    PRINTF("%c ", aes_key[i]);
		}
		PRINTF("\n");

		PRINTF("AES Key Loaded Successfully!\n");
	}
    ..............
    ..............
    ..............
    return status;
}

2) Build project with with the changes made and Flashing images firmware using tera term console;

3) Open UART0 and From debug console send the command tsetenv :

4) reset, and reboot and AES Key Read from NVRAM is shown in the following capture :

The result is not expected output. how does this happen?

5) I have used the command getenv and I verify that effectivly i read the right string that temporary set with tsetenv command.

I have tried also using known ITEM in your project, but is the same error output after reading nvram  .

Furthermore I think there is an error in your UM-WI-046: in the description of char * read_nvram_string()

you mention “Read an integer” while I suppose the right sentence should be “Read a string”

Best regards

Hi There,

Thank you for the reply.

The user can read the key data in NVRAM using the read_nvram_string().

Thank you for checking the error in UM-WI-046 and we will fix it with "Read a string value".


Best Regards,
OV_Renesas