Can ELE Retain Keys in Host-Inaccessible Non-Volatile Storage?

[t_hosomi]

Hi,

I would like to ask about persistent key storage for use with the EdgeLock Secure Enclave (ELE).
Based on my understanding of the KW47 Security Reference Manual, keys used by ELE for cryptographic operations can be stored persistently using the Key Storage Services. My understanding of the typical flow is as follows:

1. Create a Key Blob for the target key and export it to the host.
2. Store the exported Key Blob in non-volatile memory such as Flash.
3. When the key is needed for a cryptographic operation, import the Key Blob and use the key through ELE.

In this approach, the Key Blob is generated by ELE, so the host cannot read the actual key material. However, since the Key Blob itself is stored by the host in Flash, it appears that the host could still delete or overwrite the Key Blob.
My question is:
Is there a way to store a key (or its Key Blob) in a non-volatile storage area that is accessible by ELE but not accessible by the host, allowing cryptographic operations to be performed by ELE without the key material or Key Blob ever being exposed to the host at any point?
In other words, is it possible for ELE to own and manage persistent key storage entirely within a secure region, such that the host never handles the key or Key Blob directly?
Thank you in advance for your guidance.

[RomanVR · Accepted solution]

Hi @t_hosomi, hope you are doing well.

Your understanding of the key generation and storage in NVM flow is correct.

However, since the ELE does not have a non-volatile memory (as stated in section 10.3.1 of the SRM), the only supported path is to store the exported key blob in host's NVM.

Please let me know if this information is helpful.

[t_hosomi]

Hi RomanVR,

Thank you for your response.
I understand that ELE itself does not provide non-volatile storage and that persistent key data must therefore be stored in the host's non-volatile memory.
Thank you for clarifying this point.