RE: CRACEN vs. Oberon

Amanda Hsieh — Mon, 09 Feb 2026 17:28:51 GMT

Hi David,

[quote user=""]SHA1-ECDSA: Is ECDSA signing/verification using SHA-1 as the hash engine supported in hardware?[/quote]

Yes, but we don't recommend using SHA-1.

[quote user=""]RSA-SHA256-PKCS1-PSS: Is RSA-PSS (with SHA-256) supported by the CRACEN RSA engine?[/quote]

Yes.

You can call the relevant PSA api: example. These calls decide which hash algorithm will be used. So, for ECDSA, you can see here: https://arm-software.github.io/psa-api/crypto/1.2/api/ops/sign.html#c.PSA_ALG_ECDSA you select ECDSA and whichever hash you want. You can see which hash we support in hardware here: https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/security/crypto/crypto_supported_features.ht… You can also take a look at the crypto samples for ECDSA, RSA and ECDH to see how to use it.

[quote user=""]ECDH-256: Is Elliptic Curve Diffie-Hellman fully supported in hardware?[/quote]

If you want secp256r1 ("P-256r1" - PSA_ECC_SECP_R1_256 ), which, yes, we support.

[quote user=""]is there a comprehensive comparison document or matrix available that details which cryptographic commands/algorithms are implemented in CRACEN versus those that fall back to Oberon?[/quote]

See https://docs.nordicsemi.com/bundle/ncs-3.2.1/page/nrf/security/crypto/crypto_supported_features.html

Regards,
Amanda H.