NXP Matter Documentation
Source (.md/.rst) Page PDF (.pdf)

Matter PSA Key ID Reservations

Matter PSA Key ID Reservations#

This page documents the reserved PSA (Platform Security Architecture) key ID ranges used in the context of Matter on NXP MCU platforms. These ranges must be respected to avoid conflicts between different subsystems that share the same PSA keystore (Matter stack, OpenThread stack, and EdgeLock 2GO provisioning).

PSA Key ID Ranges#

Subsystem

Range start

Range end

Description

OpenThread (OT) General

0x20000

0x2FFFF

PSA key IDs reserved for OpenThread general usage.

Matter General

0x30000

0x3FFFF

PSA key IDs reserved for Matter general usage (For example, operational keys, NOC, ICAC).

EL2GO (EdgeLock 2GO)

0x40000

0x4FFFF

PSA key IDs reserved for EL2GO-provisioned keys (e.g. DAC private key, DAC certificate).

Non-EL2GO Applications#

For non-EL2GO applications (i.e. when the DAC private key is imported into the PSA keystore by the application itself rather than being provisioned via EdgeLock 2GO), the DAC private key is stored under PSA key ID 0x40000.

This is the same key ID reserved for the EL2GO DAC private key, so applications only rely on a single well-known key ID regardless of whether the key material comes from EL2GO provisioning or from local import (for example, from factory data in flash).

Notes#

  • When configuring EL2GO key IDs on the EL2GO server, the key IDs must fall within the 0x40000 – 0x4FFFF range.

  • The EL2GO range is enforced at runtime via CHIP_CONFIG_CRYPTO_PSA_KEY_ID_EL2GO_BASE and CHIP_CONFIG_CRYPTO_PSA_KEY_ID_EL2GO_END, defined in CHIPNXPPlatformDefaultConfig.h.

  • System-reserved EL2GO blobs (OEM, RKTH, OTP, BATCH_FLOW keys) are automatically skipped during import and do not consume IDs from these ranges.

  • For EL2GO factory data generation, use --EL2GO_DAC_KEY_ID 0x40000 and --EL2GO_DAC_CERT_ID 0x40001 as reference values.

Typical EL2GO key ID Assignment#

Object

Key ID

DAC private key

0x40000

DAC certificate

0x40001