Bluetooth OOB public key and PSA

[SamuelAustin]

I am creating a bluetooth mesh using nrf54L15 and would like to make use of public key OOB as a means of whitelisting devices (so only my devices can join the mesh). The idea is that each device will be provisioned during manufacturing and in this process it will generate an ECDH key pair in PSA and its public key and UUID will be stored in a database somewhere. When a device tries to get provisioned into the bluetooth mesh, the provisioner will be able to retrieve the public key based on the UUID of the device and use that public key as part of the public key OOB process.

One detail I run into now is specifying the private and public key in the bt_mesh_prov struct.

static const struct bt_mesh_prov prov = {
	.uuid = dev_uuid,
	.unprovisioned_beacon = unprovisioned_beacon,
	.node_added = node_added,
    .complete = prov_complete,
    .reset = prov_reset,
    .public_key_be = dev_pub_key,
    .private_key_be = dev_priv_key,
};

The way this struct is defined seems to force me to export the private key from PSA and hold it somewhere in RAM. Preferably, I would leave the private key in PSA and only make use of the key handle. Is there a way to make use of keys stored in PSA for the purpose of public key OOB without exporting them?

On the other hand, maybe this is not such a big security concern and I'm just being a bit pedantic, if that is the case, please let me know

[Einar Thorsrud]

Hi,

During provisioning the keys are provided via the bt_mesh_prov as raw keys, and that is the only supported way. However, after provisioning the key is protected. The keys are stored in the internal trusted storage, and referred to by an identifier, and not directly accessible from the non-secure application. See Security toolbox from the Bluetooth Mesh documentation for details.

[SamuelAustin]

Hi Einar,

Does this mean that I don't need to keep the keys in memory after I have called bt_mesh_init because it creates a copy?

Currently I do this and keep the keys in memory:

exportPrivateKey(dev_priv_key);
exportPublicKey(dev_pub_key);

err = bt_mesh_init(&provisioner_prov, &provisioner_comp);

And then the same question for the whole bt_mesh_prov struct, can I create it on the fly and then let it go out of scope after bt_mesh_init?

[Einar Thorsrud]

Hi,

You need to keep the bt_mesh_prov struct in memory the whole time. Moreover, I am sorry to say I read your question too quickly. Most aspects of Mesh security is handled using PSA crypto as described in the link from my previous post (you can also see he implementation in crypto_psa.c), but for OOB the implementation continue to use the raw key from the bt_mesh_prov instance that must remain in memory. This follows from how it is currently implemented in the Zephyr Bluetooth host.

[SamuelAustin]

Hi Einar,

Thanks for the confirmation. At least the keys are not just sitting in the firmware but are only retrieved during runtime.