nRF52 data Encryption

[Rajneesh]

Hello Nordic team

I am working on nRF52832 dev board and I have a requirements to encrypt and decrypt data using AES-128 ECB. Could you please provide the example code or documentation how to encrypt and decrypt the data?

Any help will be appreciated.

Thanks

Raj

[Einar Thorsrud]

Hello Raj,

You can use the nrf_crypto library for this. The AES Example demonstrates how it is used.

Einar

[Rajneesh]

Thanks Einar for response. The link you provided for AES example I didn't find the AS-ECB example. Could you please provide the correct example for AES-ECG?

[Rajneesh]

Thanks for the reply. This make sense to me. Can I use following APIs for encryption and decryption:

nonce_generate(nonce);
ctr_init(nonce,m_ecb_key);

ctr_encrypt(m_beacon_info);
ctr_encrypt(&m_beacon_info[16]);

/******************************************/

ctr_decrypt(m_beacon_info);
ctr_decrypt(&m_beacon_info[16]);

As this is working and I tested. But this is just encrypting 16 bytes and I have to encrypt 20 bytes of data. Can I pass 32 bytes of KEY and encrypt 20 bytes and ignore rest of the bytes?

[Einar Thorsrud]

Hi,

Based on the function names, I assume you are basing your code on this tutorial. This function works on full blocks only, so you would have to pad and call multiple times to encrypt/decrypt more than 16 bytes. That is possible.

Alternatively, you could use nrf_crypto to do the encryption/decryption as discussed before, which would give you are more complete API do the operations in one go, padding etc. as needed. This would not be in HW then, but that may not be a practical problem.

[codebreaker176]

Hi Einar,

Can you tell why is ctr_decrypt() being called twice in the below code?

Rajneesh said:

ctr_decrypt(m_beacon_info);
ctr_decrypt(&m_beacon_info[16]);

[Einar Thorsrud]

Hi,

I assume you are referring to the code in this post? The reason is that the function only works on single blocks (which is 16 byte long), and he needs to decrypt two blocks. Therefor the function is called twice, with a 16 byte offset for the second call.

[codebreaker176]

Thanks !