[nrf toup][nrfconnect] Fail boot if DAC is in ITS with KMU enabled

Add CONFIG_CHIP_CRYPTO_PSA_DAC_PRIV_KEY_FATAL_IF_IN_ITS to detect
a DAC private key still stored in PSA ITS when factory data is
configured for CRACEN KMU.

Signed-off-by: Arkadiusz Balys <arkadiusz.balys@nordicsemi.no>

Author: ArekBalysNordic

config/nrfconnect/chip-module/Kconfig

@@ -331,7 +331,7 @@ if CHIP_CRYPTO_PSA_MIGRATE_DAC_PRIV_KEY
 
 choice CHIP_CRYPTO_PSA_DAC_PRIV_KEY_MIGRATION_DEST
 	prompt "Destination for DAC private key migration"
-	default CHIP_CRYPTO_PSA_DAC_PRIV_KEY_KMU if CRACEN_LIB_KMU
+	default CHIP_CRYPTO_PSA_DAC_PRIV_KEY_KMU if CRACEN_KMU
 	default CHIP_CRYPTO_PSA_DAC_PRIV_KEY_ITS
 
 config CHIP_CRYPTO_PSA_DAC_PRIV_KEY_ITS
@@ -344,7 +344,7 @@ config CHIP_CRYPTO_PSA_DAC_PRIV_KEY_ITS
 
 config CHIP_CRYPTO_PSA_DAC_PRIV_KEY_KMU
 	bool "Migrate DAC private key from factory data to CRACEN KMU"
-	depends on CRACEN_LIB_KMU
+	depends on CRACEN_KMU
 	help
 	  Move DAC private key from the factory data set to the CRACEN Key Management Unit (KMU) secure
 	  storage and remove it. After the first boot of the device the DAC private key will be
@@ -371,7 +371,7 @@ endif # CHIP_CRYPTO_PSA_MIGRATE_DAC_PRIV_KEY
 
 config CHIP_STORE_KEYS_IN_KMU
 	bool "Use KMU to store crypto keys"
-	depends on CRACEN_LIB_KMU
+	depends on CRACEN_KMU
 	select EXPERIMENTAL
 	help
 	  Stores cryptographic materials like keys in the KMU if available on the device.

src/platform/nrfconnect/FactoryDataProvider.cpp

@@ -85,6 +85,9 @@ CHIP_ERROR FactoryDataProvider<FlashFactoryData>::Init()
     }
 
 #ifdef CONFIG_CHIP_CRYPTO_PSA
+#ifdef CHIP_CRYPTO_PSA_DAC_PRIV_KEY_KMU
+    VerifyOrDie(FatalIfDACPrivateKeyInITS() == CHIP_NO_ERROR);
+#endif
     VerifyOrDie(MoveDACPrivateKeyToSecureStorage(factoryData, factoryDataSize) == CHIP_NO_ERROR);
 #endif
 
@@ -220,6 +223,27 @@ CHIP_ERROR FactoryDataProvider<FlashFactoryData>::MoveDACPrivateKeyToSecureStora
 
     return CHIP_NO_ERROR;
 }
+
+#ifdef CHIP_CRYPTO_PSA_DAC_PRIV_KEY_KMU
+template <class FlashFactoryData>
+CHIP_ERROR FactoryDataProvider<FlashFactoryData>::FatalIfDACPrivateKeyInITS()
+{
+    const psa_key_id_t itsDacKeyId = to_underlying(chip::Crypto::KeyIdBase::DACPrivKey);
+
+    psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
+    if (psa_get_key_attributes(itsDacKeyId, &attributes) == PSA_SUCCESS)
+    {
+        psa_reset_key_attributes(&attributes);
+        ChipLogError(DeviceLayer,
+                     "DAC private key found in PSA ITS while CRACEN KMU storage is configured. "
+                     "Automatic migration from ITS to KMU is not supported. "
+                     "Re-provision the device.");
+        return CHIP_ERROR_INTERNAL;
+    }
+
+    return CHIP_NO_ERROR;
+}
+#endif // CHIP_CRYPTO_PSA_DAC_PRIV_KEY_KMU
 #endif // CONFIG_CHIP_CRYPTO_PSA
 
 template <class FlashFactoryData>

src/platform/nrfconnect/FactoryDataProvider.h

@@ -153,6 +153,10 @@ class FactoryDataProvider : public FactoryDataProviderBase
     CHIP_ERROR MoveDACPrivateKeyToSecureStorage(uint8_t * factoryDataPartition, size_t factoryDataSize);
 #endif
 
+#ifdef CHIP_CRYPTO_PSA_DAC_PRIV_KEY_KMU
+    CHIP_ERROR FatalIfDACPrivateKeyInITS();
+#endif // CHIP_CRYPTO_PSA_DAC_PRIV_KEY_KMU
+
     // ===== Members functions that implement the DeviceAttestationCredentialsProvider
     CHIP_ERROR GetCertificationDeclaration(MutableByteSpan & outBuffer) override;
     CHIP_ERROR GetFirmwareInformation(MutableByteSpan & out_firmware_info_buffer) override;