Relevant changes in nRF5 SDK v15.0.0

This chapter explains the changes applied to nRF5 SDK v15.0.0 that are relevant to the erratum document and the Vulnerability Note.

There are several security improvements to the cryptographic functionality in nRF5 SDK v15.0.0 that are related to handling public key validation:

• All cryptographic functionality is accessed through the nrf_crypto module, which provides extensive usage documentation. Examples have been updated to use the nrf_crypto API as the standard API for all cryptographic routines.
• Multiple third-party software-only cryptographic libraries were added. They are available as configurable backends to the nrf_crypto APIs. The available software-only cryptographic libraries are:
  • µECC (must be downloaded separately)
  • mbed TLS
  • nrf_oberon
  The default nrf_crypto backend in the SDK is nrf_oberon, which is a Nordic Semiconductor proprietary cryptographic library written by Oberon Microsystems.
• Examples using Bluetooth® LE Secure Connections pairing procedures now utilize a module called ble_lesc. If an invalid public key is detected, this module generates a random string of data as the ECDH shared secret/DHKey and reports this key back to the SoftDevice, so that the pairing procedure fails.
• The hardware-accelerated nrf_crypto backend nrf_cc310 utilizes the API CRYS_ECPKI_BuildPublKeyFullCheck instead of CRYS_ECPKI_BuildPublKey, which validates public keys according to the SEC1 standard described in Chapter 3.2.2, Validation of Elliptic Curve Public Keys, in SEC 1: Elliptic Curve Cryptography v2.0.