Static passkey - central and peripheral code issues (NCS connect)

[lbe]

Good morning everyone,

I am going crazy to solve this problem, but I hope we can figure it out with some help.

I am working on a prototype for which we need to use a static passkey (we know the security risks and that this is strongly discouraged, so please let's not focus on this point).

We are working with two nrf52833 boards and with NCS 2.3.0, and the code used as a starting point is the UART (for both roles).

On the peripheral side, I am able to correctly configure the board, so that when I try to connect with the NRF Connect app from my smartphone, the static passkey

is asked, and upon correct insertion of the password, the devices are bonded correctly.

I am unable to obtain the same behavior on the central.

The point where I am stuck is that apparently, after getting connected, the central invokes the bt_conn_set_security command, and I got the following error on the central

[00:00:04.986,694] .[1;31m<err> bt_smp: pairing failed (peer reason 0x8).[0m
[00:00:04.987,304] .[1;33m<wrn> ebrain_uart_bridge_central: Security failed: FA:51:0B:6F:06:18 (random) level 1 err 9.[0m
[00:00:04.987,701] .[1;33m<wrn> ebrain_uart_bridge_central: Pairing failed conn: FA:51:0B:6F:06:18 (random), reason 9.[0m

and at the same time on the peripheral I get the following error message

[00:00:09.587,799] .[1;33m<wrn> bt_smp: Unexpected SMP code 0x01.[0m

I defined in the prj.conf file the options

CONFIG_BT_SMP=y

CONFIG_BT_FIXED_PASSKEY=y

and I tried several combinations of the callbacks indicated in the forum, the last one being

static struct bt_conn_auth_cb conn_auth_callbacks = {
	.passkey_entry = passkey_entry,
	.cancel = auth_cancel,
};

static struct bt_conn_auth_info_cb conn_auth_info_callbacks = {
	.pairing_complete = pairing_complete,
	.pairing_failed = pairing_failed,
};

but I do not seem to find a solution....

Is anyone able to provide a complete example (especially for the central side) where a static passkey is succesfully transmitted from the central to the peripheral?

Thanks in advance for your help!

Lorenzo

[Kenneth]

Hello,

A long time ago I made an example, likely the example will not compile in new NCS releases, but I would expect the code is readable enough to understand what I did at the time:
https://devzone.nordicsemi.com/f/nordic-q-a/69202/zephyr-ble-static-passkey-between-central-and-peripheral-on-two-nrf52840s 

Kenneth

[lbe]

Hello Kenneth, thanks for the pointer, but I already read that discussion and followed the indicated steps.

As of now, I have in fact the peripheral working fine and accepting a static passkey sent using the smartphone app "Nrf Connect".

My problem is when I use a nrf52833DK as a central instead of the smartphone: whatever I try, I get the errors indicated in the original post...It seems that the problems start when I call the

	err = bt_conn_set_security(conn, BT_SECURITY_L4);

which is not accepted by the peripheral....

So, what is the central supposed to send to the peripheral? At what moment should the central send the passkey to validate its connection to the peripheral?

[Kenneth]

Isn't BT_SECURITY_L4 le secure connection? You should likely try BT_SECURITY_L3.

Kenneth

[lbe]

I tried, but anything other than BT_SECURITY_L1 gives the same errors.

My impression is that the peripheral awaits for some information that is not sent to it.....

[Kenneth]

If the peripheral works with the phone, then the problem here is the central.

Are you sure the central actually support security? What does the prj.conf look like?

[Kenneth]

What conn_auth_callbacks and conn_auth_info_callbacks have you set on the central?

Edit: Never mind, I can see those above.

Kenneth

[lbe]

Yes, this is what I think too....

This is my prj.conf file

#
# Copyright (c) 2018 Nordic Semiconductor
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#

# Enable the UART driver
CONFIG_UART_ASYNC_API=y
CONFIG_NRFX_UARTE0=y
CONFIG_SERIAL=y
CONFIG_CONSOLE=y
CONFIG_UART_CONSOLE=y

# Enable the BLE stack with GATT Client configuration
CONFIG_BT=y
CONFIG_BT_CENTRAL=y
CONFIG_BT_GATT_CLIENT=y

# Enable the BLE modules from NCS
CONFIG_BT_NUS_CLIENT=y
CONFIG_BT_SCAN=y
CONFIG_BT_SCAN_FILTER_ENABLE=n
CONFIG_BT_GATT_DM=y
CONFIG_HEAP_MEM_POOL_SIZE=2048

# This example requires more workqueue stack
CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=2048

# Enable bonding
CONFIG_BT_SETTINGS=y
CONFIG_FLASH=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_FLASH_MAP=y
CONFIG_NVS=y
CONFIG_SETTINGS=y

CONFIG_BT_SMP=y
CONFIG_BT_FIXED_PASSKEY=y



# Config logger
CONFIG_LOG=y
CONFIG_USE_SEGGER_RTT=y
CONFIG_LOG_BACKEND_RTT=n
CONFIG_LOG_BACKEND_UART=y

CONFIG_BT_LOG_LEVEL_OFF=y

CONFIG_ASSERT=y

[Kenneth]

I can see you have CONFIG_BT_FIXED_PASSKEY=y, you should not need that. Since that will be handled by: For the device with passkey entry you will need to register a .passkey_entry callback in conn_auth_callbacks, make sure to call bt_conn_auth_passkey_entry(with 123456) in the callback.

Can you try without?

Kenneth 

[lbe]

Hello again, thanks for helping out on this.

Actually, I already tried also this combination (I mean, without the CONFIG_BT_FIXED_PASSKEY=y) , but my .passkey_entry callback is never called.

Its code is the following

static void passkey_entry(struct bt_conn *conn)
{
	LOG_INF("Calling Passkey entry\n");
	char addr[BT_ADDR_LE_STR_LEN];
	default_conn = bt_conn_ref(conn);
	bt_addr_le_to_str(bt_conn_get_dst(conn), addr, sizeof(addr));

	unsigned int fixed_passkey = 223344;
	bt_conn_auth_passkey_entry(conn, fixed_passkey);
}

and as shown above it is defined here

static struct bt_conn_auth_cb conn_auth_callbacks = {
	.passkey_entry = passkey_entry,
	.cancel = auth_cancel,
};

I do not seem to ever reach this point though, because of the "Security Failed" message following the bt_set_security....

[Kenneth]

Do you have the possibility to capture an on-air sniffer log?
https://infocenter.nordicsemi.com/topic/ug_sniffer_ble/UG/sniffer_ble/intro.html 

After installation you can:
https://infocenter.nordicsemi.com/topic/ug_sniffer_ble/UG/sniffer_ble/action_paired.html 

Kenneth

[lbe]

Hello,

Thanks for the suggestion....I'll try to put this in place and come back to you with the results