• State Resolved
  • Locked Locked
  • Replies 5 replies
  • Answers 1 answer
  • Subscribers 53 subscribers
  • Views 1232 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

CC2640: NIST security mode and level

Janet Shen
Expert 7795 points

Part Number: CC2640
Other Parts Discussed in Thread: BLE-STACK, CC2650, , CC2642R

Dear Champs,

Customer ask us the NIST security mode and level on CC2640. 

They provided below guide book from NIST

 

Which security mode and level do we support on CC2640 when used latest SDK v2.2.2? 

If you have any suggestion, please feel free to let me know.

Thanks a lot.

  • 0
    TI__Mastermind 41660 points
    Hi Janet,

    We support BLE4.2 features in the BLE Stack 2.2.2.

    To quote SWRU393 Section 1.1 Introduction: "The TI Bluetooth low energy protocol stack (BLE-Stack) v2.2.x includes these new features from Version
    4.2 of the specification:
    • LE Secure Connections
    • LE Data Length extension
    • LE Privacy 1.2
    The stack also supports the following 4.1 features:
    • LE L2CAP Connection-Oriented Channel Support
    • LE Link Layer Topology
    • LE Ping
    • Slave Feature Exchange
    • Connection Parameter Request
    These features are optional in the 4.2 specification, and can be selectively enabled at build time."
  • 0 in reply to Evan W
    TI__Expert 7795 points

    Dear Evan,

    As above NIST security guide book, we know its security mode and level as below classification:

    Does we CC2650 support mode 4 level 4 or more higher?

    If you have any suggestion, please feel free to let us know.

    Thanks a lot.

  • 0 in reply to Janet Shen
    TI__Guru** 105180 points

    Hello Janet,

    The tables that you have cited in your post above from the NIST Special Publication 800-121 (Revision 2) are from section 3.1 covering BR/EDR devices. These tables are therefore not applicable to Low Energy (LE) devices.

    Given that the nature of your inquiry is for BLE, it may be better to directly refer to the Bluetooth specification where LE Security Modes are further explained. See 10.2 LE SECURITY MODES in BLUETOOTH SPECIFICATION Version 4.2 [Vol 3, Part C]:

    10.2.1 LE Security Mode 1

    LE security mode 1 has the following security levels:

    1. No security (No authentication and no encryption)

    2. Unauthenticated pairing with encryption

    3. Authenticated pairing with encryption

    4. Authenticated LE Secure Connections pairing with encryption

    Consistent with Evan's post above, the CC2640 with BLE-Stack 2.2.2 and CC2640R2F / CC2642R (all SDKs) support all the security levels defined by LE Security Mode 1. Although the specification defines a LE Security Mode 2 with "data signing", this is seldom, if ever, implemented.  Refer to the GAP Bond Manager (GAPBondMgr) documentation in the respective SDK's BLE Stack User's Guide on how to configure each level within LE Security Mode 1.

    Finally, the NIST pub does have the following in the Executive Summary:

    "For the low energy feature of Bluetooth (introduced in Version 4.0 and updated in 4.1 and 4.2), Security Mode 1 Level 4 is the strongest mode because it requires authenticated low energy Secure Connections pairing with Elliptic Curve Diffie-Hellman (ECDH) based encryption. Security Mode 1 Level 3 requires authenticated pairing and encryption but does not use ECDH-based cryptography and thus provides limited eavesdropping protection due to weak encryption. Other security modes/levels allow unauthenticated pairing (meaning no MITM protection is provided during cryptographic key establishment), and some do not require any security at all."

    Best wishes

  • 0 in reply to JXS
    TI__Expert 7795 points
    Dear Jeff,

    Thanks for your sharing.
    I will try to explain this to customer to let them know SIG and NIST difference for security definition.
    If we know any problem, will ask the help on next post.
    Thanks a lot.
  • 0 in reply to Janet Shen
    TI__Guru** 105180 points
    No problem, Janet. Just to reiterate, the applicable section for BLE devices in the NIST pub is "3.2.1 Low Energy Security Modes and Levels".

    Please do let us know if they have any follow up questions.

    Best wishes