nRF52 data Encryption

[Rajneesh]

Hello Nordic team

I am working on nRF52832 dev board and I have a requirements to encrypt and decrypt data using AES-128 ECB. Could you please provide the example code or documentation how to encrypt and decrypt the data?

Any help will be appreciated.

Thanks

Raj

[Einar Thorsrud]

Hello Raj,

You can use the nrf_crypto library for this. The AES Example demonstrates how it is used.

Einar

[Rajneesh]

Thanks Einar for response. The link you provided for AES example I didn't find the AS-ECB example. Could you please provide the correct example for AES-ECG?

[Einar Thorsrud]

Hi,

The AES example doe snot demonstrate ECB, but the exact same approach can be used with other variants. I suggest you refer to this part of the documentation for the details. Essentially you need to use g_nrf_crypto_aes_ecb_128_info to specify the algorithm. You can also refer to the CLI example which does use AES-ECB, but this is not as easy to understand as it is much bigger than the small AES examples.

[Rajneesh]

Thanks Einar. I tried and tested aes_cbc_with_padding example and encryption and decryption both works well.

Now, I have to use this encryption in ble_beacon example and decryption in decryption in central_scanner example (any central example).

can you please help me to figure out the way to use this aes_cbc example with BLE project? Is there amy example available so that I can use it?

Thanks

Raj

[Einar Thorsrud]

Hi Raj,

There is no conflict between BLE and nrf_crypto. You can simply put your crypto code into the beacon and scanner example, and it should work. There is one tedious task that needs to be done, though, and that is to add all dependencies for nrf_crypto (include paths and .c files) and add needed sdk_config configuration macros. The easiest way to get this could be to use example projects that use pairing, as the peer manager has dependencies of nrf_crypto.

Einar

[Rajneesh]

Thanks for the reply. This make sense to me. Can I use following APIs for encryption and decryption:

nonce_generate(nonce);
ctr_init(nonce,m_ecb_key);

ctr_encrypt(m_beacon_info);
ctr_encrypt(&m_beacon_info[16]);

/******************************************/

ctr_decrypt(m_beacon_info);
ctr_decrypt(&m_beacon_info[16]);

As this is working and I tested. But this is just encrypting 16 bytes and I have to encrypt 20 bytes of data. Can I pass 32 bytes of KEY and encrypt 20 bytes and ignore rest of the bytes?

[Einar Thorsrud]

Hi,

Based on the function names, I assume you are basing your code on this tutorial. This function works on full blocks only, so you would have to pad and call multiple times to encrypt/decrypt more than 16 bytes. That is possible.

Alternatively, you could use nrf_crypto to do the encryption/decryption as discussed before, which would give you are more complete API do the operations in one go, padding etc. as needed. This would not be in HW then, but that may not be a practical problem.

[codebreaker176]

Hi Einar,

Can you tell why is ctr_decrypt() being called twice in the below code?

Rajneesh said:

ctr_decrypt(m_beacon_info);
ctr_decrypt(&m_beacon_info[16]);

[Einar Thorsrud]

Hi,

I assume you are referring to the code in this post? The reason is that the function only works on single blocks (which is 16 byte long), and he needs to decrypt two blocks. Therefor the function is called twice, with a 16 byte offset for the second call.