How to use AES128 ECB for decryption

[Jun Yang]

Hi,

I am using nRF51822, and try to use the ECB block AES128 to do some data decryption. From the SDK I found 2 API functions:

1. uint32_t sd_ecb_block_encrypt ( nrf_ecb_hal_data_t * p_ecb_data ) Seems this one is only usable for encrypt, can you provide or have a similar one for decrypt?

2. bool nrf_ecb_crypt ( uint8_t * dst, const uint8_t * src ) This one seems can be used for both encrypt and decrypt, but I am not sure how to specify whether I need to decrypt or encrypt and also how to specify the key correctly, if you have any code snippets or examples that will be really helpful.

Another question is about the data block size, seems it is fixed at 16 bytes now, can I specify a different size or need to cut into 16 byte block in my applicaiton code?

Thanks,

Jun

[JW de Wit]

I was looking for the same, seems like the hardware only has enryption and no decryption. In ble connections this is sufficient while the counter mode is used. In countermode messages are both enrcypted and decripted using AES (ECB)encryption of a counter value, so ECB decription not needed for bluetooth and it seems Nordic made the hardware to fit BLE security and just BLE security .

[Guilherme de Paula]

The key in .key, and the input data in .cleartext, then call the function, then the output data will be in .ciphertext 

You call the same function sd_ecb_block_encrypt whether you want to encrypt or decrypt.  The operation is symmetrical.

[WrightLin.Avnet]

Hi

I think it is not quite right that you could get the decrypt message just by change the location of cleartext and ciphertext.

It was discussed in this thread: 
 https://devzone.nordicsemi.com/f/nordic-q-a/6308/how-to-decrypt-aes-ecb-nopadding-data#comment-40082

"

• AES is symmetric (block) cipher which means that there is 1 shared key which is used for both encryption (ENC) and decryption (DEC).
• But ENC and DEC functions are inverse and in general these are mathematical completely different when it comes to actual computation. So NO, you cannot use the same function for going there and back unless it implements both encrypt and decrypt mode (e.g. with some flag in the call).

"

And the proper way to do encrypt and decrypt is described detailly in here:
https://devzone.nordicsemi.com/nordic/nordic-blog/b/blog/posts/intro-to-application-level-security-using-the-ecb-

Wright

[Guilherme de Paula]

You are right!  Sorry, I did this with an nRF51 in 2013 and had forgotten the details.  The discussion you posted here has the correct solution.  In the end you call the same function to encrypt/decrypt, but those extra steps are required.