7. Security Levels and Factory Reset

7.1 Supported security level configurations

The security level is defined by three settings that must all agree: the SDK variant, the firmware macro and the tool configuration. Choose one column and use it consistently.

	`security-level-low`	`security-level-high` (default)
SDK variant	Lite (single link)	Full (multi-link)
Firmware macro (Section 6.2)	`SID_SDK_CONFIG_SECURITY_LEVEL_LOW`	`SID_SDK_CONFIG_SECURITY_LEVEL_HIGH`
Tool `security_level` key (Chapter 4)	`low`	`high`
`register commit_keys`	Sent: credentials are copied from the KV store to the manufacturing page	Skipped: credentials are stored in the KV store only
Registration credentials are stored in	The KV store and the manufacturing page	The KV store only
KV store erased	Restored at the next boot from the manufacturing page. Safe only before the device operates on the network	Registration is lost. Never erase the KV store (Section 7.2)
Factory reset (`sid_set_factory_reset()` or cloud-initiated)	The device stays registered. The live network key and time synchronization counters are saved before the wipe and re-applied after the manufacturing page restore, so the authentication material does not change	The device becomes unregistered by design, and re-registers over the air (mobile application, FFN or Sidewalk gateway)

security-level-low is required for lite variants. They have no over-the-air registration stack, so without the manufacturing page copy any loss of the KV store permanently de-registers the device. Other combinations of security level and SDK variant are not supported.
Registration over the LoRa link is not supported. A full-variant device (security-level-high) that can only reach the network over LoRa cannot re-register after a factory reset.
A factory reset notifies the application through the on_factory_reset callback. If the credentials cannot be saved before the wipe, the factory reset is refused rather than risking stale credentials.

7.2 Factory reset

To clear the Sidewalk state of a device, use sid_set_factory_reset(). Do not erase the KV store directly.

At security-level-high, never delete or erase the KV store after factory registration. The KV store holds the only copy of the registration keys (the manufacturing page carries none), so deleting it permanently de-registers the device.

A direct KV store erase is safe only in the following cases:

Between provisioning and registration, in any configuration.
At security-level-low, in the production firmware reflash immediately after registration.

Once the device has operated on the network:

At security-level-high, a direct erase permanently removes the registration, and the device must be registered again. Use sid_set_factory_reset() when clearing is intended.
At security-level-low, a direct erase is not supported. The manufacturing page copy is fixed at registration time, so a boot-time restore would bring back an outdated network key and older time synchronization counters, which the network may no longer accept. Only sid_set_factory_reset() carries the live values across the wipe.

7.3 Key material

The DAK private key never leaves the YubiHSM. On the line PC, the DAK PIN is stored only in secrets.toml (file mode 0600).
The other credentials in use are the LWA tokens (one per scope, cached and refreshed automatically) and the named AWS CLI profile.
Handle all private cryptographic key material in accordance with the Amazon Sidewalk Program Security Requirements.