The nRF52840 device provides hardware accelerated cryptographic functionality through the Arm® TrustZone CryptoCell 310 core.
To use the hardware-accelerated cryptographic functionality in an implementation, a runtime library called nrf_cc310 that is bundled with the specific version of the nRF5 SDK must be used.
The elliptic curve public key is validated for all versions of the nrf_cc310 runtime library.
There are three APIs that convert a key from raw format to the format usable by the runtime library:
- CRYS_ECPKI_BuildPublKey
- CRYS_ECPKI_BuildPublKeyPartlyCheck
- CRYS_ECPKI_BuildPublKeyFullCheck
In nRF5 SDK v15.0.0, CRYS_ECPKI_BuildPublKeyFullCheck is used when converting public keys from raw format to a type usable in nrf_cc310 runtime library APIs. The API that converts the key performs a key validation according to the SEC1 standard described in Chapter 3.2.2, Validation of Elliptic Curve Public Keys, in SEC 1: Elliptic Curve Cryptography v2.0.
In the nRF5 SDKs prior to v15.0.0, the APIs were using CRYS_ECPKI_BuildPublKey. This API performs a partial key validation according to the SEC1 standard described in Chapter 3.2.3, Partial Validation of Elliptic Curve Public Key, in SEC 1: Elliptic Curve Cryptography v2.0 when converting a public key from RAW format to a type usable in nrf_cc310 runtime library APIs.