"Encrypted packet decrypted incorrectly (bad MIC)" - how to get LTK

[ilker Aktuna]

Hi,

I am trying to sniff between my phone and a BLE device.

When I put the device in pairing mode, I can see it in the "advertising" list. Then I select it (but I don't know if I should select anything from the "legacy passkey", "legacy ltk", "follow le address") 

I can see packets from/to that device.

Then I make the pairing on my phone (no PIN is required)

But then I can't get any data , all is encrypted and all I see is "empty PDU" or "Encrypted packet decrypted incorrectly (bad MIC)"

What is the correct method ?

As far as aI remember from my past experiences, if I sniff within the pairing session , I should not need a LTK.

But if LTK will help, can you guide me how to get the LTK ?

Btw, if I do the pairing, I no longer see the device in "advertising" list. If I get the LTK and try to sniff after pairing, how do I filter that device ?

[billtsai]

Hi,

If your device has no lesc, then you can sniff LTK in pairing process.

Otherwise, you need a LTK to decrypt packet.

LTK will store in flash if you use bonding.

But you need to provide which sdk you use.

[ilker Aktuna]

thanks for your response. But I am not a professional and the terms you use  , I am not familiar with them.

"if your devişce has no lesc" -> what is lesc , and how do I know if my device has lesc ?

"then you can sniff LTK in pairing process" -> how can I do that ?

"which sdk you use." -> I don't know. I have a laptop with Wireshark installed and 2 years ago I had installed extensions to sniff using nRF52840. I had followed official guides that time. But I'm not sure where the guide is now.

[billtsai]

I can't download your file.

You can refer to my sniffer file. My wireshark version is v4.0.6.

In packet 2134, the device responses host that device does not support secure connection. 

In packet 2433, the device sends LTK to host. 

You can use the same method to find more information.

desktop_dfu_sniffer_log.pcapng

[ilker Aktuna]

mb.pcapng

Can you please check this file ? My sniff session is not like your example.

[ilker Aktuna]

this traffic is between a BLE device and an app on Android phone.

Probably the app has an hardcoded LTK and without it I won't be able to decrypt the traffic for investigation.

Would it be possible to get the LTK on the Android phone ? Is it possible to sniff on the phone itself and get an unencrypted trace ?

[Amanda Hsieh]

Hi, 

Please check out Exercise 3 Follow and decrypt a paired connection in the Bluetooth Low Energy Fundamentals course (which is highly recommended).

-Amanda H.

[ilker Aktuna]

I checked it now but it does not match with my scenario.

First of all I am not using that board. I am trying to sniff some 3rd party device. And the communication is different. If you had checked my file mb.pcapng that I had attached in my previous post, you could understand. One side requests LTK but the other side does not send LTK.

In this case how shall I get the LTK or how shall I decrypt without a LTK ?

Please download my file and check. 

Thanks.

[Amanda Hsieh]

Hi,

all I see is "empty PDU" or "Encrypted packet decrypted incorrectly (bad MIC)"

It is most commonly caused by the sniffer not having the private keys for the connection, so it can not decrypt the packages it intercepts.

Please check  Exercise 3 Follow and decrypt a paired connection on how to get the LTK if you are using NCS. It cannot decrypt without a LTK. 

-Amanda H.

[ilker Aktuna]

I have read through that tutorial/course, but as you can see in my scenario, LTK is not transferred in pairing phase (or am I missing it ?) 

I have already provided you pcap output, so you can see from there.

So what is the point of following that tutorial in my case ?

If the LTK is not provided while pairing , I won't be able to decrypt packets. 

I asked you if it would be possible to get the LTK , or decrypt using hci sniff on the android phone.

I could not get an answer to this.

So what is the purpose of suggesting me to read the tutorial (which I already did) ?

[Amanda Hsieh]

ilker Aktuna said:

if it would be possible to get the LTK , or decrypt using hci sniff on the android phone.

I think it cannot get LTK from your sniffer log, but you can refer to that course to get LTK if you are using NCS. 

[ilker Aktuna]

I am sorry, I don't understand. What is NCS ? 

[Amanda Hsieh]

NCS is our nRF Connect SDK.