Are BLE SoftDevices security audited?

[schneider42]

Hi,

we are thinking about using the NRF52 with the BLE SoftDevice in a security relevant application. As the SoftDevice is not available as source code, no reasonable security audit can be performed.

Is Nordic performing such audits or making any claim regarding the security of SoftDevices?

[run_ar]

Nordic’s SoftDevice has been independently audited in cooperation with lead customers in the medical product field. In these cases, Nordic SoftDevices, and our development and quality processes, have been approved to their standards. We cannot release the reports from these audits publically.

Nordic claims our SoftDevices are qualified Bluetooth Low Energy implementations adhering to, and tested against, all requirements with regard to security. In addition, Nordic tests SoftDevices for valid and invalid application and peer behavior towards the API and wireless interfaces.

If you would like to identify yourself to one of our Regional Sales Managers, we would be prepared to answer any further specific questions.

[mh]

Ok, will contact our Regional Sales Manager. But is it correct to assume then that the ARM MPU is not consumed by the SoftDevice?