Supported cryptographic operations in the nRF Connect SDK

This reference page lists the supported features and limitations of cryptographic operations in the nRF Connect SDK.

Note

Cryptographic features and algorithms that are not listed on this page are not supported by Oberon PSA Crypto in the nRF Connect SDK. Similarly, if a driver is not available for a device Series for a given feature, it is not included in the corresponding section.

Support definitions

This page uses the same definitions as the Software maturity levels page, with the exception of not listing features that are not supported.

Supported

The feature or component is implemented and maintained, and is suitable for product development.

Not supported (–)

The feature or component is neither implemented nor maintained, and it does not work.

Experimental

The feature can be used for development, but it is not recommended for production. This means that the feature is incomplete in functionality or verification and can be expected to change in future releases. The feature is made available in its current state, but the design and interfaces can change between release tags. The feature is also labeled as experimental in Kconfig files and a build warning is generated to indicate this status.

Hardware support for PSA Crypto implementations

The following tables list hardware support for the PSA Crypto implementations in the nRF Connect SDK.

nRF52 SeriesnRF53 SeriesnRF54H SeriesnRF54L SeriesnRF91 Series

The following tables list the cryptographic support for nRF52 Series devices. The nRF52 Series devices do not support the CRACEN driver.

Cryptographic support by implementation - nRF52 Series

Implementation	nRF52810	nRF52811	nRF52820	nRF52832	nRF52833	nRF52840
Oberon PSA Crypto - nrf_cc3xx	–	–	–	–	–	Supported
Oberon PSA Crypto - CRACEN	–	–	–	–	–	–
Oberon PSA Crypto - nrf_oberon	–	–	–	Supported	Supported	Supported
TF-M Crypto Service	–	–	–	–	–	–
IronSide Secure Enclave	–	–	–	–	–	–

Cryptographic feature support

The following sections list the supported cryptographic features and algorithms. The lists are organized by device Series and cryptographic drivers: nrf_cc3xx, CRACEN, and nrf_oberon.

The listed CONFIG_ Kconfig options enable the features and algorithms for the drivers that support them. The Kconfig options follow the CONFIG_PSA_WANT_* + CONFIG_PSA_USE_* configuration scheme, which is described in detail on the Cryptographic drivers page. When you select Kconfig options for the wanted features and drivers to use, the corresponding Oberon PSA Crypto directives are compiled into the build to make the optimal driver selection. For more information, see the Cryptographic drivers page.

Note

On the nRF54H20 SoC, the IronSide SE implements a fixed set of features and algorithms that cannot be changed by the user. The PSA_WANT_* and PSA_USE_* directives are directly implemented within IronSide SE. Enabling any feature with the corresponding Kconfig options will have no effect.

Key types and key management

The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring key types that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting and the corresponding CONFIG_PSA_USE_* Kconfig option, Oberon PSA Crypto selects the most appropriate driver for the management of the supported key types.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

nRF52 SeriesnRF53 SeriesnRF54H SeriesnRF54L SeriesnRF91 Series

The following tables list the supported key types for nRF52 Series devices.

nrf_cc3xxnrf_oberon

Key type support per device (nrf_cc3xx driver) - nRF52 Series

Key type	Configuration option	nRF52840
AES	CONFIG_PSA_WANT_KEY_TYPE_AES	Supported
Chacha20	CONFIG_PSA_WANT_KEY_TYPE_CHACHA20	Supported
ECC Key Pair Import	CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT	Supported
ECC Key Pair Export	CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT	Supported
ECC Key Pair Generate	CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE	Supported
ECC Key Pair Derive	CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE	Supported
ECC Public Key	CONFIG_PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY	Supported
RSA Key Pair Import	CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT	Supported
RSA Key Pair Export	CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT	Supported
RSA Key Pair Generate	CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE	Supported
RSA Key Pair Derive	CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE	Supported
RSA Public Key	CONFIG_PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY	Supported
XChaCha20	CONFIG_PSA_WANT_KEY_TYPE_XCHACHA20	–
HMAC	CONFIG_PSA_WANT_KEY_TYPE_HMAC	Supported
HSS Public Key	CONFIG_PSA_WANT_KEY_TYPE_HSS_PUBLIC_KEY	–
LMS Public Key	CONFIG_PSA_WANT_KEY_TYPE_LMS_PUBLIC_KEY	–
XMSS Public Key	CONFIG_PSA_WANT_KEY_TYPE_XMSS_PUBLIC_KEY	–
XMSS-MT Public Key	CONFIG_PSA_WANT_KEY_TYPE_XMSS_MT_PUBLIC_KEY	–
ML-DSA-44	CONFIG_PSA_WANT_ML_DSA_KEY_SIZE_44	–
ML-DSA-65	CONFIG_PSA_WANT_ML_DSA_KEY_SIZE_65	–
ML-DSA-87	CONFIG_PSA_WANT_ML_DSA_KEY_SIZE_87	–
ML-DSA Key Pair Import	CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_KEY_PAIR_IMPORT	–
ML-DSA Key Pair Export	CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_KEY_PAIR_EXPORT	–
ML-DSA Key Pair Generate	CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_KEY_PAIR_GENERATE	–
ML-DSA Key Pair Derive	CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_KEY_PAIR_DERIVE	–
ML-DSA Public Key	CONFIG_PSA_WANT_KEY_TYPE_ML_DSA_PUBLIC_KEY	–
ML-KEM-512	CONFIG_PSA_WANT_ML_KEM_KEY_SIZE_512	–
ML-KEM-768	CONFIG_PSA_WANT_ML_KEM_KEY_SIZE_768	–
ML-KEM-1024	CONFIG_PSA_WANT_ML_KEM_KEY_SIZE_1024	–
ML-KEM Key Pair Import	CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_IMPORT	–
ML-KEM Key Pair Export	CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_EXPORT	–
ML-KEM Key Pair Generate	CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_GENERATE	–
ML-KEM Key Pair Derive	CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_KEY_PAIR_DERIVE	–
ML-KEM Public Key	CONFIG_PSA_WANT_KEY_TYPE_ML_KEM_PUBLIC_KEY	–
WPA3-SAE PT key	CONFIG_PSA_WANT_KEY_TYPE_WPA3_SAE	–
ASCON	CONFIG_PSA_WANT_KEY_TYPE_ASCON	–

Key management

The following tables show the CONFIG_PSA_USE_* Kconfig options for configuring driver preferences. Based on this setting, Oberon PSA Crypto selects the most appropriate driver for the management of the supported key types (selected with the corresponding CONFIG_PSA_WANT_*).

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following tables list the key management support for nRF52 Series devices.

nrf_cc3xxnrf_oberon

Key management support (nrf_cc3xx driver) - nRF52 Series

Kconfig option

Supported key types

CONFIG_PSA_USE_CC3XX_KEY_MANAGEMENT_DRIVER

CONFIG_PSA_WANT_KEY_TYPE_AES CONFIG_PSA_WANT_KEY_TYPE_CHACHA20 CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE CONFIG_PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE CONFIG_PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY

Cipher modes

The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring cipher modes that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting and the corresponding CONFIG_PSA_USE_* Kconfig option, Oberon PSA Crypto selects the most appropriate cipher driver for the supported cipher modes.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

Note

Key size configuration is supported as described in AES key size configuration, for all algorithms except the stream cipher.

The nrf_cc3xx driver is limited to AES key sizes of 128 bits on devices with Arm CryptoCell CC310.

nRF52 SeriesnRF53 SeriesnRF54H SeriesnRF54L SeriesnRF91 Series

The following tables list the supported cipher modes for nRF52 Series devices.

nrf_cc3xxnrf_oberon

Cipher mode support per device (nrf_cc3xx driver) - nRF52 Series

Cipher mode	Configuration option	nRF52840
ECB no padding	CONFIG_PSA_WANT_ALG_ECB_NO_PADDING	Supported
CBC no padding	CONFIG_PSA_WANT_ALG_CBC_NO_PADDING	Supported
CBC PKCS#7 padding	CONFIG_PSA_WANT_ALG_CBC_PKCS7	Supported
CTR	CONFIG_PSA_WANT_ALG_CTR	Supported
CCM* no tag	CONFIG_PSA_WANT_ALG_CCM_STAR_NO_TAG	–
Stream cipher	CONFIG_PSA_WANT_ALG_STREAM_CIPHER	Supported

Cipher driver

The following tables show the CONFIG_PSA_USE_* Kconfig options for configuring driver preferences. Based on this setting, Oberon PSA Crypto selects the most appropriate driver for the supported cipher modes (selected with the corresponding CONFIG_PSA_WANT_*).

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following tables list the cipher driver support for nRF52 Series devices.

nrf_cc3xxnrf_oberon

Cipher driver support (nrf_cc3xx driver) - nRF52 Series

Kconfig option	Supported cipher modes
CONFIG_PSA_USE_CC3XX_CIPHER_DRIVER	CONFIG_PSA_WANT_ALG_ECB_NO_PADDING CONFIG_PSA_WANT_ALG_CBC_NO_PADDING CONFIG_PSA_WANT_ALG_CBC_PKCS7 CONFIG_PSA_WANT_ALG_CTR CONFIG_PSA_WANT_ALG_STREAM_CIPHER

Key agreement algorithms

The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring key agreement algorithms that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting and the corresponding CONFIG_PSA_USE_* Kconfig option, Oberon PSA Crypto selects the most appropriate driver for the supported key agreement algorithms.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

Note

The algorithm support when using ECC key types is dependent on one or more Kconfig options enabling curve support according to ECC curve types.

nRF52 SeriesnRF53 SeriesnRF54H SeriesnRF54L SeriesnRF91 Series

The following tables list the supported key agreement algorithms for nRF52 Series devices.

nrf_cc3xxnrf_oberon

Key agreement algorithm support (nrf_cc3xx driver) - nRF52 Series

Key agreement algorithm	Configuration option	nRF52840
ECDH	CONFIG_PSA_WANT_ALG_ECDH	Supported

Key agreement driver

The following tables show the CONFIG_PSA_USE_* Kconfig options for configuring driver preferences. Based on this setting, Oberon PSA Crypto selects the most appropriate driver for the supported key agreement algorithms (selected with the corresponding CONFIG_PSA_WANT_*).

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following tables list the key agreement driver support for nRF52 Series devices.

nrf_cc3xxnrf_oberon

Key agreement driver support (nrf_cc3xx driver) - nRF52 Series

Kconfig option	Supported key agreement algorithms
CONFIG_PSA_USE_CC3XX_KEY_AGREEMENT_DRIVER	CONFIG_PSA_WANT_ALG_ECDH

Key encapsulation algorithms

The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring key encapsulation algorithms that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting and the corresponding CONFIG_PSA_USE_* Kconfig option, Oberon PSA Crypto selects the most appropriate driver for the supported key encapsulation algorithms.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following tables list the supported key encapsulation algorithms for nRF52 Series devices.

nrf_oberon

Key encapsulation algorithm support (nrf_oberon driver) - nRF52 Series

Key encapsulation algorithm	Configuration option	nRF52832	nRF52833	nRF52840
ML-KEM	CONFIG_PSA_WANT_ALG_ML_KEM	Experimental	Experimental	Experimental

Key encapsulation driver

The following tables show the CONFIG_PSA_USE_* Kconfig options for configuring driver preferences. Based on this setting, Oberon PSA Crypto selects the most appropriate driver for the supported key encapsulation algorithms (selected with the corresponding CONFIG_PSA_WANT_*).

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following tables list the key encapsulation driver support for nRF52 Series devices.

nrf_oberon

Key encapsulation driver support (nrf_oberon driver) - nRF52 Series

Kconfig option	Supported key encapsulation algorithms
Configuration automatically generated based on the enabled key encapsulation algorithms. Acts as software fallback for the other drivers.	CONFIG_PSA_WANT_ALG_ML_KEM

KDF algorithms

The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring KDF algorithms that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting and the corresponding CONFIG_PSA_USE_* Kconfig option, Oberon PSA Crypto selects the most appropriate driver for the supported KDF algorithms.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

nRF52 SeriesnRF53 SeriesnRF54H SeriesnRF54L SeriesnRF91 Series

The following table lists the supported KDF algorithms for nRF52 Series devices.

nrf_oberon

KDF algorithm support (nrf_oberon driver) - nRF52 Series

KDF algorithm	Configuration option	nRF52832	nRF52833	nRF52840
HKDF	CONFIG_PSA_WANT_ALG_HKDF	Supported	Supported	Supported
HKDF-Extract	CONFIG_PSA_WANT_ALG_HKDF_EXTRACT	Supported	Supported	Supported
HKDF-Expand	CONFIG_PSA_WANT_ALG_HKDF_EXPAND	Supported	Supported	Supported
PBKDF2-HMAC	CONFIG_PSA_WANT_ALG_PBKDF2_HMAC	Supported	Supported	Supported
PBKDF2-AES-CMAC-PRF-128	CONFIG_PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128	Supported	Supported	Supported
TLS 1.2 PRF	CONFIG_PSA_WANT_ALG_TLS12_PRF	Supported	Supported	Supported
TLS 1.2 PSK to MS	CONFIG_PSA_WANT_ALG_TLS12_PSK_TO_MS	Supported	Supported	Supported
TLS 1.2 EC J-PAKE to PMS	CONFIG_PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS	Supported	Supported	Supported
SP 800-108r1 CMAC w/counter	CONFIG_PSA_WANT_ALG_SP800_108_COUNTER_CMAC	Supported	Supported	Supported
SP 800-108 HMAC counter mode	CONFIG_PSA_WANT_ALG_SP800_108_COUNTER_HMAC	Supported	Supported	Supported
WPA3-SAE hash-to-element	CONFIG_PSA_WANT_ALG_WPA3_SAE_H2E	–	–	–

Key derivation function driver

The following tables show the CONFIG_PSA_USE_* Kconfig options for configuring driver preferences. Based on this setting, Oberon PSA Crypto selects the most appropriate driver for the supported KDF algorithms (selected with the corresponding CONFIG_PSA_WANT_*).

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following table lists the KDF driver support for nRF52 Series devices.

nrf_oberon

KDF driver support (nrf_oberon driver) - nRF52 Series

Kconfig option	Supported KDF algorithms
Configuration automatically generated based on the enabled KDF algorithms. Acts as software fallback for the other drivers.	CONFIG_PSA_WANT_ALG_HKDF CONFIG_PSA_WANT_ALG_HKDF_EXTRACT CONFIG_PSA_WANT_ALG_HKDF_EXPAND CONFIG_PSA_WANT_ALG_PBKDF2_HMAC CONFIG_PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 CONFIG_PSA_WANT_ALG_TLS12_PRF CONFIG_PSA_WANT_ALG_TLS12_PSK_TO_MS CONFIG_PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS CONFIG_PSA_WANT_ALG_SP800_108_COUNTER_CMAC CONFIG_PSA_WANT_ALG_SP800_108_COUNTER_HMAC

Key wrapping algorithms

The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring AES key wrapping algorithms that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting and the corresponding CONFIG_PSA_USE_* Kconfig option, Oberon PSA Crypto selects the most appropriate driver for the supported AES key wrapping algorithms.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following tables list the supported AES key wrapping algorithms for nRF52 Series devices.

nrf_oberon

Key wrapping support (nrf_oberon driver) - nRF52 Series

Key wrapping algorithm	Configuration option	nRF52832	nRF52833	nRF52840
AES Key wrap (AES-KW)	CONFIG_PSA_WANT_ALG_AES_KW	Experimental	Experimental	Experimental
AES Key wrap with Padding (AES-KWP)	CONFIG_PSA_WANT_ALG_AES_KWP	Experimental	Experimental	Experimental

MAC algorithms

The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring MAC algorithms that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting and the corresponding CONFIG_PSA_USE_* Kconfig option, Oberon PSA Crypto selects the most appropriate driver for the supported MAC algorithms.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

Note

Key size configuration for CMAC is supported as described in AES key size configuration.

nRF52 SeriesnRF53 SeriesnRF54H SeriesnRF54L SeriesnRF91 Series

The following tables list the supported MAC algorithms for nRF52 Series devices.

nrf_cc3xxnrf_oberon

MAC algorithm support (nrf_cc3xx driver) - nRF52 Series

MAC algorithm	Configuration option	nRF52840
CMAC	CONFIG_PSA_WANT_ALG_CMAC	Supported
HMAC	CONFIG_PSA_WANT_ALG_HMAC	Supported

Note

• CONFIG_PSA_WANT_ALG_CMAC is limited to AES key sizes of 128 bits on devices with Arm CryptoCell CC310

• CONFIG_PSA_WANT_ALG_HMAC is limited to SHA-1, SHA-224, and SHA-256

MAC driver

The following tables show the CONFIG_PSA_USE_* Kconfig options for configuring driver preferences. Based on this setting, Oberon PSA Crypto selects the most appropriate driver for the supported MAC algorithms (selected with the corresponding CONFIG_PSA_WANT_*).

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following tables list the MAC driver support for nRF52 Series devices.

nrf_cc3xxnrf_oberon

MAC driver support (nrf_cc3xx driver) - nRF52 Series

Kconfig option	Supported MAC algorithms
CONFIG_PSA_USE_CC3XX_MAC_DRIVER	CONFIG_PSA_WANT_ALG_CMAC (limited to AES key sizes of 128 bits on devices with Arm CryptoCell CC310) CONFIG_PSA_WANT_ALG_HMAC (limited to SHA-1, SHA-224, and SHA-256)

AEAD algorithms

The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring AEAD algorithms that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting and the corresponding CONFIG_PSA_USE_* Kconfig option, Oberon PSA Crypto selects the most appropriate driver for the supported AEAD algorithms.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

Note

Key size configuration for CCM and GCM is supported as described in AES key size configuration.

nRF52 SeriesnRF53 SeriesnRF54H SeriesnRF54L SeriesnRF91 Series

The following tables list the supported AEAD algorithms for nRF52 Series devices.

nrf_cc3xxnrf_oberon

AEAD algorithm support (nrf_cc3xx driver) - nRF52 Series

AEAD algorithm	Configuration option	nRF52840
CCM	CONFIG_PSA_WANT_ALG_CCM	Supported
GCM	CONFIG_PSA_WANT_ALG_GCM	–
ChaCha20-Poly1305	CONFIG_PSA_WANT_ALG_CHACHA20_POLY1305	Supported
XChaCha20-Poly1305	CONFIG_PSA_WANT_ALG_XCHACHA20_POLY1305	–
ASCON AEAD128	CONFIG_PSA_WANT_ALG_ASCON_AEAD128	–

Note

CONFIG_PSA_WANT_ALG_CCM is limited to AES key sizes of 128 bits on devices with Arm CryptoCell CC310.

AEAD driver

The following tables show the CONFIG_PSA_USE_* Kconfig options for configuring driver preferences. Based on this setting, Oberon PSA Crypto selects the most appropriate driver for the supported AEAD algorithms (selected with the corresponding CONFIG_PSA_WANT_*).

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following tables list the AEAD driver support for nRF52 Series devices.

nrf_cc3xxnrf_oberon

AEAD driver support (nrf_cc3xx driver) - nRF52 Series

Kconfig option	Supported AEAD algorithms
CONFIG_PSA_USE_CC3XX_AEAD_DRIVER	CONFIG_PSA_WANT_ALG_CCM (limited to AES key sizes of 128 bits on devices with Arm CryptoCell CC310) CONFIG_PSA_WANT_ALG_CHACHA20_POLY1305

Asymmetric signature algorithms

The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring asymmetric signature algorithms that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting and the corresponding CONFIG_PSA_USE_* Kconfig option, Oberon PSA Crypto selects the most appropriate driver for the supported asymmetric signature algorithms.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

Note

• The algorithm support when using ECC key types is dependent on one or more Kconfig options enabling curve support according to ECC curve types.

• RSA key size configuration is supported as described in RSA key size configuration.

nRF52 SeriesnRF53 SeriesnRF54H SeriesnRF54L SeriesnRF91 Series

The following tables list the supported asymmetric signature algorithms for nRF52 Series devices.

nrf_cc3xxnrf_oberon

Asymmetric signature algorithm support (nrf_cc3xx driver) - nRF52 Series

Asymmetric signature algorithm	Configuration option	nRF52840
ECDSA	CONFIG_PSA_WANT_ALG_ECDSA	Supported
ECDSA without hashing	CONFIG_PSA_WANT_ALG_ECDSA_ANY	Supported
ECDSA (deterministic)	CONFIG_PSA_WANT_ALG_DETERMINISTIC_ECDSA	Supported
PureEdDSA	CONFIG_PSA_WANT_ALG_PURE_EDDSA	Supported
HashEdDSA Edwards25519	CONFIG_PSA_WANT_ALG_ED25519PH	–
HashEdDSA Edwards448	CONFIG_PSA_WANT_ALG_ED448PH	–
RSA PKCS#1 v1.5 sign	CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_SIGN	Supported
RSA PSS	CONFIG_PSA_WANT_ALG_RSA_PSS	Supported
HSS	CONFIG_PSA_WANT_ALG_HSS	–
LMS	CONFIG_PSA_WANT_ALG_LMS	–
ML-DSA	CONFIG_PSA_WANT_ALG_ML_DSA	–
XMSS	CONFIG_PSA_WANT_ALG_XMSS	–
XMSS-MT	CONFIG_PSA_WANT_ALG_XMSS_MT	–

Asymmetric signature driver

The following tables show the CONFIG_PSA_USE_* Kconfig options for configuring driver preferences. Based on this setting, Oberon PSA Crypto selects the most appropriate driver for the supported asymmetric signature algorithms (selected with the corresponding CONFIG_PSA_WANT_*).

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following tables list the asymmetric signature driver support for nRF52 Series devices.

nrf_cc3xxnrf_oberon

Asymmetric signature driver support (nrf_cc3xx driver) - nRF52 Series

Kconfig option	Supported asymmetric signature algorithms
CONFIG_PSA_USE_CC3XX_ASYMMETRIC_SIGNATURE_DRIVER	CONFIG_PSA_WANT_ALG_ECDSA CONFIG_PSA_WANT_ALG_ECDSA_ANY CONFIG_PSA_WANT_ALG_DETERMINISTIC_ECDSA CONFIG_PSA_WANT_ALG_PURE_EDDSA CONFIG_PSA_WANT_ALG_RSA_PSS CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_SIGN

Asymmetric encryption algorithms

The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring asymmetric encryption algorithms that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting and the corresponding CONFIG_PSA_USE_* Kconfig option, Oberon PSA Crypto selects the most appropriate driver for the supported asymmetric encryption algorithms.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

Note

RSA key size configuration is supported as described in RSA key size configuration.

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following tables list the supported asymmetric encryption algorithms for nRF52 Series devices.

nrf_cc3xxnrf_oberon

Asymmetric encryption algorithm support (nrf_cc3xx driver) - nRF52 Series

Asymmetric encryption algorithm	Configuration option	nRF52840
RSA OAEP	CONFIG_PSA_WANT_ALG_RSA_OAEP	Supported
RSA PKCS#1 v1.5 crypt	CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_CRYPT	Supported

Note

CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_CRYPT is limited to key sizes ≤ 2048 bits.

Asymmetric encryption driver

The following tables show the CONFIG_PSA_USE_* Kconfig options for configuring driver preferences. Based on this setting, Oberon PSA Crypto selects the most appropriate driver for the supported asymmetric encryption algorithms (selected with the corresponding CONFIG_PSA_WANT_*).

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following tables list the asymmetric encryption driver support for nRF52 Series devices.

nrf_cc3xxnrf_oberon

Asymmetric encryption driver support (nrf_cc3xx driver) - nRF52 Series

Kconfig option	Supported asymmetric encryption algorithms
CONFIG_PSA_USE_CC3XX_ASYMMETRIC_ENCRYPTION_DRIVER	CONFIG_PSA_WANT_ALG_RSA_OAEP CONFIG_PSA_WANT_ALG_RSA_PKCS1V15_CRYPT (limited to key sizes ≤ 2048 bits)

ECC curve types

The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring ECC curve types that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting and the corresponding CONFIG_PSA_USE_* Kconfig option, Oberon PSA Crypto selects the most appropriate driver for the supported ECC curve types.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

nRF52 SeriesnRF53 SeriesnRF54H SeriesnRF54L SeriesnRF91 Series

The following tables list the supported ECC curve types for nRF52 Series devices.

nrf_cc3xxnrf_oberon

ECC curve type support (nrf_cc3xx driver) - nRF52 Series

ECC curve type	Configuration option	nRF52840
BrainpoolP224r1	CONFIG_PSA_WANT_ECC_BRAINPOOL_P_R1_224	–
BrainpoolP256r1	CONFIG_PSA_WANT_ECC_BRAINPOOL_P_R1_256	Supported
BrainpoolP320r1	CONFIG_PSA_WANT_ECC_BRAINPOOL_P_R1_320	–
BrainpoolP384r1	CONFIG_PSA_WANT_ECC_BRAINPOOL_P_R1_384	–
BrainpoolP512r1	CONFIG_PSA_WANT_ECC_BRAINPOOL_P_R1_512	–
Curve25519 (X25519)	CONFIG_PSA_WANT_ECC_MONTGOMERY_255	Supported
Curve448 (X448)	CONFIG_PSA_WANT_ECC_MONTGOMERY_448	–
Edwards25519 (Ed25519)	CONFIG_PSA_WANT_ECC_TWISTED_EDWARDS_255	Supported
Edwards448 (Ed448)	CONFIG_PSA_WANT_ECC_TWISTED_EDWARDS_448	–
secp256k1	CONFIG_PSA_WANT_ECC_SECP_K1_256	Supported
secp224r1	CONFIG_PSA_WANT_ECC_SECP_R1_224	Supported
secp256r1	CONFIG_PSA_WANT_ECC_SECP_R1_256	Supported
secp384r1	CONFIG_PSA_WANT_ECC_SECP_R1_384	Supported
secp521r1	CONFIG_PSA_WANT_ECC_SECP_R1_521	–

ECC curve driver

The following tables show the CONFIG_PSA_USE_* Kconfig options for configuring driver preferences. Based on this setting, Oberon PSA Crypto selects the most appropriate driver for the supported ECC curve types (selected with the corresponding CONFIG_PSA_WANT_*).

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following tables list the ECC curve driver support for nRF52 Series devices.

nrf_cc3xxnrf_oberon

ECC curve driver support (nrf_cc3xx driver) - nRF52 Series

Kconfig option	Supported ECC curve types
CONFIG_PSA_USE_CC3XX_KEY_MANAGEMENT_DRIVER	CONFIG_PSA_WANT_ECC_BRAINPOOL_P_R1_256 CONFIG_PSA_WANT_ECC_MONTGOMERY_255 CONFIG_PSA_WANT_ECC_TWISTED_EDWARDS_255 CONFIG_PSA_WANT_ECC_SECP_K1_256 CONFIG_PSA_WANT_ECC_SECP_R1_224 CONFIG_PSA_WANT_ECC_SECP_R1_256 CONFIG_PSA_WANT_ECC_SECP_R1_384

RNG algorithms

RNG uses PRNG seeded by entropy (also known as TRNG). The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring RNG algorithms that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting and the corresponding CONFIG_PSA_USE_* Kconfig option, Oberon PSA Crypto selects the most appropriate driver for the supported RNG algorithms.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

Note

• Both PRNG algorithms are NIST-qualified Cryptographically Secure Pseudo Random Number Generators (CSPRNG).

• CONFIG_PSA_WANT_ALG_CTR_DRBG and CONFIG_PSA_WANT_ALG_HMAC_DRBG are custom configurations not described by the PSA Crypto specification.

• If multiple PRNG algorithms are enabled at the same time, CTR-DRBG will be prioritized for random number generation through the front-end APIs for PSA Crypto.

nRF52 SeriesnRF53 SeriesnRF54H SeriesnRF54L SeriesnRF91 Series

The following tables list the supported RNG algorithms for nRF52 Series devices.

nrf_cc3xxnrf_oberon

RNG algorithm support (nrf_cc3xx driver) - nRF52 Series

PRNG algorithm	Configuration option	nRF52840
RNG support	CONFIG_PSA_WANT_GENERATE_RANDOM	Supported
CTR-DRBG	CONFIG_PSA_WANT_ALG_CTR_DRBG	Supported
HMAC-DRBG	CONFIG_PSA_WANT_ALG_HMAC_DRBG	Supported

Note

• CONFIG_PSA_WANT_GENERATE_RANDOM is enabled by default for nRF52840.

• CONFIG_PSA_WANT_ALG_HMAC_DRBG is limited to 1024 bytes per request.

RNG driver

The following tables show the CONFIG_PSA_USE_* Kconfig options for configuring driver preferences. Based on this setting, Oberon PSA Crypto selects the most appropriate driver for the supported RNG algorithms (selected with the corresponding CONFIG_PSA_WANT_*).

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following tables list the RNG driver support for nRF52 Series devices.

nrf_cc3xxnrf_oberon

RNG driver support (nrf_cc3xx driver) - nRF52 Series

Kconfig option	Supported RNG algorithms
Enabled by default for nRF52840, nRF91 Series, and nRF5340 devices	CONFIG_PSA_WANT_ALG_CTR_DRBG CONFIG_PSA_WANT_ALG_HMAC_DRBG (limited to 1024 bytes per request)

Hash algorithms

The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring hash algorithms that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting and the corresponding CONFIG_PSA_USE_* Kconfig option, Oberon PSA Crypto selects the most appropriate driver for the supported hash algorithms.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

Note

The SHA-1 hash is weak and deprecated and is only recommended for use in legacy protocols.

nRF52 SeriesnRF53 SeriesnRF54H SeriesnRF54L SeriesnRF91 Series

The following tables list the supported hash algorithms for nRF52 Series devices.

nrf_cc3xxnrf_oberon

Hash algorithm support (nrf_cc3xx driver) - nRF52 Series

Hash algorithm	Configuration option	nRF52840
SHA-1 (weak)	CONFIG_PSA_WANT_ALG_SHA_1	Supported
SHA-224	CONFIG_PSA_WANT_ALG_SHA_224	Supported
SHA-256	CONFIG_PSA_WANT_ALG_SHA_256	Supported
SHA-384	CONFIG_PSA_WANT_ALG_SHA_384	–
SHA-512	CONFIG_PSA_WANT_ALG_SHA_512	–
SHA3-224	CONFIG_PSA_WANT_ALG_SHA3_224	–
SHA3-256	CONFIG_PSA_WANT_ALG_SHA3_256	–
SHA3-384	CONFIG_PSA_WANT_ALG_SHA3_384	–
SHA3-512	CONFIG_PSA_WANT_ALG_SHA3_512	–
SHA-256/192	CONFIG_PSA_WANT_ALG_SHA_256_192	–
SHAKE128 256 bits	CONFIG_PSA_WANT_ALG_SHAKE128_256	–
SHAKE256 192 bits	CONFIG_PSA_WANT_ALG_SHAKE256_192	–
SHAKE256 256 bits	CONFIG_PSA_WANT_ALG_SHAKE256_256	–
SHAKE256 512 bits	CONFIG_PSA_WANT_ALG_SHAKE256_512	–
ASCON HASH256	CONFIG_PSA_WANT_ALG_ASCON_HASH256	–

Hash driver

The following tables show the CONFIG_PSA_USE_* Kconfig options for configuring driver preferences. Based on this setting, Oberon PSA Crypto selects the most appropriate driver for the supported hash algorithms (selected with the corresponding CONFIG_PSA_WANT_*).

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following tables list the hash driver support for nRF52 Series devices.

nrf_cc3xxnrf_oberon

Hash driver support (nrf_cc3xx driver) - nRF52 Series

Kconfig option	Supported hash algorithms
CONFIG_PSA_USE_CC3XX_HASH_DRIVER	CONFIG_PSA_WANT_ALG_SHA_1 (weak) CONFIG_PSA_WANT_ALG_SHA_224 CONFIG_PSA_WANT_ALG_SHA_256

Extendable-Output Function (XOF) algorithms

The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring XOF algorithms that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting and the corresponding CONFIG_PSA_USE_* Kconfig option, Oberon PSA Crypto selects the most appropriate driver for the supported XOF algorithms.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following table lists the supported XOF algorithms for nRF52 Series devices.

nrf_oberon

XOF algorithm support (nrf_oberon driver) - nRF52 Series

XOF algorithm	Configuration option	nRF52832	nRF52833	nRF52840
SHAKE128	CONFIG_PSA_WANT_ALG_SHAKE128	Experimental	Experimental	Experimental
SHAKE256	CONFIG_PSA_WANT_ALG_SHAKE256	Experimental	Experimental	Experimental
ASCON XOF128	CONFIG_PSA_WANT_ALG_ASCON_XOF128	Experimental	Experimental	Experimental
ASCON CXOF128	CONFIG_PSA_WANT_ALG_ASCON_CXOF128	Experimental	Experimental	Experimental

XOF driver

The following tables show the CONFIG_PSA_USE_* Kconfig options for configuring driver preferences. Based on this setting, Oberon PSA Crypto selects the most appropriate driver for the supported XOF algorithms (selected with the corresponding CONFIG_PSA_WANT_*).

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following table lists the XOF driver support for nRF52 Series devices.

nrf_oberon

XOF driver support (nrf_oberon driver) - nRF52 Series

Kconfig option	Supported XOF algorithms
Configuration automatically generated based on the enabled XOF algorithms. Acts as software fallback for the other drivers.	CONFIG_PSA_WANT_ALG_SHAKE128 CONFIG_PSA_WANT_ALG_SHAKE256 CONFIG_PSA_WANT_ALG_ASCON_XOF128 CONFIG_PSA_WANT_ALG_ASCON_CXOF128

PAKE algorithms

The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring PAKE algorithms that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting and the corresponding CONFIG_PSA_USE_* Kconfig option, Oberon PSA Crypto selects the most appropriate driver for the supported PAKE algorithms.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

nRF52 SeriesnRF53 SeriesnRF54H SeriesnRF54L SeriesnRF91 Series

The following table lists the supported PAKE algorithms for nRF52 Series devices.

nrf_oberon

PAKE algorithm support (nrf_oberon driver) - nRF52 Series

PAKE algorithm	Configuration option	nRF52832	nRF52833	nRF52840
EC J-PAKE	CONFIG_PSA_WANT_ALG_JPAKE	Supported	Supported	Supported
SPAKE2+ with HMAC	CONFIG_PSA_WANT_ALG_SPAKE2P_HMAC	Supported	Supported	Supported
SPAKE2+ with CMAC	CONFIG_PSA_WANT_ALG_SPAKE2P_CMAC	Supported	Supported	Supported
SPAKE2+ for Matter	CONFIG_PSA_WANT_ALG_SPAKE2P_MATTER	Supported	Supported	Supported
SRP-6	CONFIG_PSA_WANT_ALG_SRP_6	Experimental	Experimental	Experimental
SRP password hashing	CONFIG_PSA_WANT_ALG_SRP_PASSWORD_HASH	Experimental	Experimental	Experimental

PAKE driver

The following tables show the CONFIG_PSA_USE_* Kconfig options for configuring driver preferences. Based on this setting, Oberon PSA Crypto selects the most appropriate driver for the supported PAKE algorithms (selected with the corresponding CONFIG_PSA_WANT_*).

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following table lists the PAKE driver support for nRF52 Series devices.

nrf_oberon

PAKE driver support (nrf_oberon driver) - nRF52 Series

Kconfig option	Supported PAKE algorithms
Configuration automatically generated based on the enabled PAKE algorithms. Acts as software fallback for the other drivers.	CONFIG_PSA_WANT_ALG_JPAKE CONFIG_PSA_WANT_ALG_SPAKE2P_HMAC CONFIG_PSA_WANT_ALG_SPAKE2P_CMAC CONFIG_PSA_WANT_ALG_SPAKE2P_MATTER CONFIG_PSA_WANT_ALG_SRP_6 CONFIG_PSA_WANT_ALG_SRP_PASSWORD_HASH

Key pair operations

The following sections list the supported key pair operation Kconfig options for different key types. The Kconfig options follow the CONFIG_PSA_WANT_* configuration scheme, which is described in detail on the Cryptographic drivers page.

RSA key pair operations

The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring RSA key pair operations that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting, Oberon PSA Crypto selects the most appropriate driver for the supported RSA key pair operations.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following tables list the supported RSA key pair operations for nRF52 Series devices.

nrf_cc3xxnrf_oberon

RSA key pair operation support (nrf_cc3xx driver) - nRF52 Series

RSA key pair operation	Configuration option	nRF52840
Import	CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT	Supported
Export	CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT	Supported
Generate	CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE	Supported
Derive	CONFIG_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE	Supported

SRP key pair operations

The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring SRP key pair operations that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting, Oberon PSA Crypto selects the most appropriate driver for the supported SRP key pair operations.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following table lists the supported SRP key pair operations for nRF52 Series devices.

nrf_oberon

SRP key pair operation support (nrf_oberon driver) - nRF52 Series

SRP key pair operation	Configuration option	nRF52832	nRF52833	nRF52840
Import	CONFIG_PSA_WANT_KEY_TYPE_SRP_KEY_PAIR_IMPORT	Supported	Supported	Supported
Export	CONFIG_PSA_WANT_KEY_TYPE_SRP_KEY_PAIR_EXPORT	Supported	Supported	Supported
Generate	CONFIG_PSA_WANT_KEY_TYPE_SRP_KEY_PAIR_GENERATE	–	–	–
Derive	CONFIG_PSA_WANT_KEY_TYPE_SRP_KEY_PAIR_DERIVE	Supported	Supported	Supported

SPAKE2P key pair operations

The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring SPAKE2P key pair operations that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting, Oberon PSA Crypto selects the most appropriate driver for the supported SPAKE2P key pair operations.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

nRF52 SeriesnRF53 SeriesnRF54H SeriesnRF54L SeriesnRF91 Series

The following table lists the supported SPAKE2P key pair operations for nRF52 Series devices.

nrf_oberon

SPAKE2P key pair operation support (nrf_oberon driver) - nRF52 Series

SPAKE2P key pair operation	Configuration option	nRF52832	nRF52833	nRF52840
Import	CONFIG_PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_IMPORT	Supported	Supported	Supported
Export	CONFIG_PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_EXPORT	Supported	Supported	Supported
Generate	CONFIG_PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_GENERATE	Supported	Supported	Supported
Derive	CONFIG_PSA_WANT_KEY_TYPE_SPAKE2P_KEY_PAIR_DERIVE	Supported	Supported	Supported

ECC key pair operations

The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring ECC key pair operations that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting, Oberon PSA Crypto selects the most appropriate driver for the supported ECC key pair operations.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

nRF52 SeriesnRF53 SeriesnRF54H SeriesnRF54L SeriesnRF91 Series

The following tables list the supported ECC key pair operations for nRF52 Series devices.

nrf_cc3xxnrf_oberon

ECC key pair operation support (nrf_cc3xx driver) - nRF52 Series

ECC key pair operation	Configuration option	nRF52840
Generate	CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE	Supported
Import	CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT	Supported
Export	CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT	Supported
Derive	CONFIG_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE	Supported

Key size configurations

The following sections list the supported AES and RSA key size Kconfig options. The Kconfig options follow the CONFIG_PSA_WANT_* configuration scheme, which is described in detail on the Cryptographic drivers page.

AES key size configuration

The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring AES key sizes that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting, Oberon PSA Crypto selects the most appropriate driver for the supported AES key sizes.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

nRF52 SeriesnRF53 SeriesnRF54H SeriesnRF54L SeriesnRF91 Series

The following tables list the supported AES key sizes for nRF52 Series devices.

nrf_cc3xxnrf_oberon

AES key size support (nrf_cc3xx driver) - nRF52 Series

AES key size	Configuration option	nRF52840
128 bits	CONFIG_PSA_WANT_AES_KEY_SIZE_128	Supported
192 bits	CONFIG_PSA_WANT_AES_KEY_SIZE_192	–
256 bits	CONFIG_PSA_WANT_AES_KEY_SIZE_256	–

RSA key size configuration

The following tables show the CONFIG_PSA_WANT_* Kconfig options for configuring RSA key sizes that Oberon PSA Crypto should add support for in the application at compile time. Based on this setting, Oberon PSA Crypto selects the most appropriate driver for the supported RSA key sizes.

The options are grouped by Series and drivers available for the device Series, and support level for each device is listed.

nRF52 SeriesnRF53 SeriesnRF54L SeriesnRF91 Series

The following tables list the supported RSA key sizes for nRF52 Series devices.

nrf_cc3xxnrf_oberon

RSA key size support (nrf_cc3xx driver) - nRF52 Series

RSA key size	Configuration option	nRF52840
1024 bits	CONFIG_PSA_WANT_RSA_KEY_SIZE_1024	Supported
1536 bits	CONFIG_PSA_WANT_RSA_KEY_SIZE_1536	Supported
2048 bits	CONFIG_PSA_WANT_RSA_KEY_SIZE_2048	Supported
3072 bits	CONFIG_PSA_WANT_RSA_KEY_SIZE_3072	–
4096 bits	CONFIG_PSA_WANT_RSA_KEY_SIZE_4096	–
6144 bits	CONFIG_PSA_WANT_RSA_KEY_SIZE_6144	–
8192 bits	CONFIG_PSA_WANT_RSA_KEY_SIZE_8192	–

Side-channel countermeasures

The following tables show the Kconfig options for configuring side-channel countermeasures. These countermeasures are available on the CRACEN peripheral and protect private key operations against power analysis attacks.

The options are grouped by Series and support level for each device is listed. The countermeasures are available only on the CRACEN driver.

nRF54L SeriesnRF54H Series

The following table lists the supported side-channel countermeasures for nRF54L Series devices.

CRACEN

Note

CONFIG_CRACEN_LITE_ECC_COUNTERMEASURES_EXTENDED does not support scalar blinding for Montgomery curve multiplication (X25519, X448).

nRF54L15, nRF54L10, and nRF54L05 do not support countermeasures for Montgomery curve multiplication (X25519, X448), EdDSA base point multiplication, and Edwards point multiplication.

Side-channel countermeasures support (CRACEN driver) - nRF54L Series

Countermeasure	Configuration option	nRF54L15	nRF54L10	nRF54L05	nRF54LM20A	nRF54LM20B	nRF54LV10A	nRF54LS05A	nRF54LS05B
ECC scalar randomization	CONFIG_CRACEN_ECC_COUNTERMEASURES	Supported	Supported	Supported	Supported	Supported	Supported	–	–
ECC projective coordinate randomization	CONFIG_CRACEN_ECC_COUNTERMEASURES	Supported	Supported	Supported	Supported	Supported	Supported	–	–
ECC extended (Montgomery/Edwards)	CONFIG_CRACEN_LITE_ECC_COUNTERMEASURES_EXTENDED (see note above)	–	–	–	Supported	Supported	Supported	–	–
RSA exponent randomization	CONFIG_CRACEN_RSA_COUNTERMEASURES	Supported	Supported	Supported	Supported	Supported	Supported	–	–
RSA modulus randomization	CONFIG_CRACEN_RSA_COUNTERMEASURES	Supported	Supported	Supported	Supported	Supported	Supported	–	–