SDAA130 September   2025 CC2640 , CC2650

 

  1.   1
  2.   Summary
  3.   Trademarks

Summary

The SimpleLink™ CC2640 and CC2650 devices offer an Elliptic Curve Cryptography library. The following input validations are not present in that library:

Missing Validation Validation Defined By Impacted Functions
Private key is in range [1, n – 1] NIST SP 800-56A Rev 3, section 5.6.2.1.2 ECCROMCC26XX_genKeys

TI PSIRT ID: TI-PSIRT-2022-040129

CVEID: None

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS base score: 6.5

Table 1-1 Affected Products
Part Software Name Software version BLE Stack Name BLE Stack Version
CC2650, CC2640

SIMPLELINK-CC2640R2-

SDK: SimpleLink™

CC2640R2 SDK - Bluetooth®

low energy

 v5.30.00.03 BLE-Stack v1.01.14.00
BLE5-Stack v3.03.08.00

Potentially Impacted Features

The following are potential impacts:

  • Failure to validate private key inputs when generating the public key can result in the private key material being leaked to a malicious third party that receives the public key.
  • Failure to validate private key inputs prior to generating an ECDSA signature can result in insecure signatures.

Suggested Mitigations

The following software release addresses this vulnerability. Customers can upgrade to this version to avoid this vulnerability.

Part Software Name Software version BLE Stack Name BLE Stack Version
CC2650, CC2640

SIMPLELINK-CC2640R2-

SDK: SimpleLink™

CC2640R2 SDK - Bluetooth®

low energy

 v5.30.01.11 BLE-Stack v1.01.15.00
BLE5-Stack v3.03.09.00

Customers are recommended to upgrade to the latest SDK for CC2640 and CC2650. The impacted functions are now provided with wrappers in source code to validate the inputs prior to calling the library functions.

The validation steps increase the time to perform the operations. If customers have to limit when the validation is performed, new function has been provided which do not perform the validation. Customers are encouraged to always validate the inputs at least once (for example, validate keys on first use and then store the validated keys in non-volatile memory with integrity protections for subsequent uses.)

In addition, customers are encouraged to confirm that ECC private key material is in the range [1, n -1] before using the private key in any operations.

External References

ANS X9.62, Public Key Cryptography for the Financial Services Industry: The Elliptic Curve Digital Signature Standard (ECDSA), November 2005.

FIPS PUB 186-4, Digital Signature Standard (DSS), July 2013. https://doi.org/10.6028/NIST.FIPS.186-4

NIST Special Publication 800-56A Revision 3, Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography, April 2018. https://doi.org/10.6028/NIST.SP.800-56Ar3