Are BLE SoftDevices security audited?

[schneider42]

Hi,

we are thinking about using the NRF52 with the BLE SoftDevice in a security relevant application. As the SoftDevice is not available as source code, no reasonable security audit can be performed.

Is Nordic performing such audits or making any claim regarding the security of SoftDevices?

[run_ar]

Nordic’s SoftDevice has been independently audited in cooperation with lead customers in the medical product field. In these cases, Nordic SoftDevices, and our development and quality processes, have been approved to their standards. We cannot release the reports from these audits publically.

Nordic claims our SoftDevices are qualified Bluetooth Low Energy implementations adhering to, and tested against, all requirements with regard to security. In addition, Nordic tests SoftDevices for valid and invalid application and peer behavior towards the API and wireless interfaces.

If you would like to identify yourself to one of our Regional Sales Managers, we would be prepared to answer any further specific questions.

[mh]

Thank you. Could the ARM Cortex-M4 MPU or the nRF52 MWU be used to ensure that the SoftDevice cannot access the application space (code, data) and defined output pins of the nRF52, so that audited security could be added in the application space with guaranteed separation, even if a code execution exploit did exist in the SoftDevice?

[run_ar]

Can you please contact our Regional sales manager for your region with your usecase?

The MWU is consumeed by the Softdevice. But it would only notify you after the memory access anyway, so I'm not sure how much that would help.

The MPU is a standard ARM implementation, you can find the details in ARMv7-M Architecture Reference Manual. There is some brief information openly available in Cortex-M4 Technical Reference Manual, and some more in the Cortex-M3 Technical Reference Manual.

[mh]

Ok, will contact our Regional Sales Manager. But is it correct to assume then that the ARM MPU is not consumed by the SoftDevice?