Merge pull request #9372 from pan-/fix-cryptotoolbox

BLE - Nordic: Release crypto cell when not in use.

Author: Cruz Monrreal

features/FEATURE_BLE/targets/TARGET_NORDIC/TARGET_NORDIC_SOFTDEVICE/TARGET_NRF52/source/nRF5xPalSecurityManager.cpp

@@ -107,15 +107,17 @@ nRF5xSecurityManager::~nRF5xSecurityManager()
 ble_error_t nRF5xSecurityManager::initialize()
 {
 #if defined(MBEDTLS_ECDH_C)
-    if (_crypto.generate_keys(
+    // Note: we do not use the object on the stack as the CryptoToolbox is quite large
+    // Please do not change or we risk a stack overflow.
+    CryptoToolbox* crypto = new CryptoToolbox();
+    bool success = crypto->generate_keys(
         make_ArrayView(X),
         make_ArrayView(Y),
         make_ArrayView(secret)
-    )) {
-        return BLE_ERROR_NONE;
-    }
+    );
+    delete crypto;
 
-    return BLE_ERROR_INTERNAL_STACK_FAILURE;
+    return success ? BLE_ERROR_NONE : BLE_ERROR_INTERNAL_STACK_FAILURE;
 #endif
     return BLE_ERROR_NONE;
 }
@@ -943,12 +945,16 @@ bool nRF5xSecurityManager::sm_handler(const ble_evt_t *evt)
             static const size_t key_size = public_key_coord_t::size_;
             ble_gap_lesc_dhkey_t shared_secret;
 
-            _crypto.generate_shared_secret(
+            // Allocated on the heap to reduce stack pressure. 
+            // Risk stack overflows if allocated on stack.
+            CryptoToolbox* crypto = new CryptoToolbox();
+            crypto->generate_shared_secret(
                 make_const_ArrayView<key_size>(dhkey_request.p_pk_peer->pk),
                 make_const_ArrayView<key_size>(dhkey_request.p_pk_peer->pk + key_size),
                 make_const_ArrayView(secret),
                 shared_secret.key
             );
+            delete crypto;
 
             sd_ble_gap_lesc_dhkey_reply(connection, &shared_secret);
 

features/FEATURE_BLE/targets/TARGET_NORDIC/TARGET_NORDIC_SOFTDEVICE/TARGET_NRF52/source/nRF5xPalSecurityManager.h

@@ -360,7 +360,6 @@ class nRF5xSecurityManager : public ::ble::pal::SecurityManager {
 
     pairing_control_block_t* _control_blocks;
 #if defined(MBEDTLS_ECDH_C)
-    CryptoToolbox _crypto;
     ble::public_key_coord_t X;
     ble::public_key_coord_t Y;
     ble::public_key_coord_t secret;