Can we use ECDH when CONFIG_BT_TINYCRYPT_ECC=n?

[victor zheng]

Hi Team

For some reason, I need to disable CONFIG_BT_TINYCRYPT_ECC. But I don't know if our BLE controller in NCS rely on Tinycrypt lib when it need support the ECDH  paring?

Can I use LE SC paring without TINYCRYPT lib in NCS? Thank you.

Regards

Victor

[Simon]

It does not seem like it's possible to use LESC pairing when CONFIG_BT_TINYCRYPT_ECC is disabled. I just tested this with the peripheral_uart sample.

I set these in the prj.conf

CONFIG_BT_TINYCRYPT_ECC=n
CONFIG_BT_SMP_SC_PAIR_ONLY=y

The option BT_SMP_SC_PAIR_ONLY will disable legacy pairing, such that only LESC pairing can be used. I got the following error:

"<err> bt_smp: SC Pair Only Mode selected but LE SC not supported"

I'm not very familiar with BLE Security in NCS, so I can't say no to the question below with certainty.

Can I use LE SC paring without TINYCRYPT lib in NCS? Thank you.

I've asked internally and will get back to you.

Best regards,

Simon

[Simon]

(sorry for the unstructured reply, it seems like there is a bug with DevZone that removes all spaces)

---

I got a reply internally:

"The tinycrypt library is used to calculate the DH-keys used with LE Secure connections. The SoftDevice Controller nor the zephyr controller support calculating the keys in the controller. Therefore the tinycrypt library is included by default, see sdk-zephyr/Kconfig at master · nrfconnect/sdk-zephyr (github.com).

This library is only used to calculate the keys. Other libraries can therefore also do the trick. If the customer is willing to do some changes themselves, they can change the APIs being used in this file: sdk-zephyr/hci_ecc.c at master · nrfconnect/sdk-zephyr (github.com)

This PR demonstrates how the nrf_oberon library can be used to calculate the keys: Bluetooth: Optimize bluetooth thread and stack usage by joerchan · Pull Request #3244 · nrfconnect/sdk-nrf (github.com)."

It seems like you have to find another way to calculate the Diffie-Hellman keys if you want to disable the tinycrypt library.

Change the API used here https://github.com/nrfconnect/sdk-zephyr/blob/0944459b5b622048a08ad1f8cf8a044c135fd0d3/subsys/bluetooth/host/hci_ecc.c#L16-L19 e.g. by the nrf_oberon library.

Best regards,

Simon