Elliptic Curve public key validation in nrf_crypto backends

Security Threat in Bluetooth® LESC Pairing

There are two nrf_crypto APIs that may handle elliptic curve public key validation.

  • nrf_crypto_ecc_public_key_from_raw - Converts the public key from RAW form ([X,Y] without encoding) to the format required by the enabled nrf_crypto backend.
  • nrf_crypto_ecdh_compute - Calculates the ECDH shared secret (also known as DHKey).

The following table shows which of the two APIs in the nrf_crypto is used for elliptic curve public key validation:

Table 1. nrf_crypto APIs that verify public keys
Library Verified in raw key conversion Verified in ECDH calculate Verification method
nrf_cc310 No Yes SEC1 3.2.2 (full check)
nrf_oberon No Yes SEC1 3.2.3 (partial check)
µECC Yes No SEC1 3.2.3 (partial check)
mbed TLS No Yes SEC1 3.2.3 (partial check)