central device will not raise security level with new periphral if no power reset on central side

RE: central device will not raise security level with new periphral if no power reset on central side

Simonr — Wed, 14 Aug 2024 06:40:03 GMT

Hi again

1. One LTK is 128 bits (16 bytes), but there is an overhead on bonding data depending on what options you enable (CONFIG_BT_SIGNING/CONFIG_BT_SMP_SC_PAIR_ONLY/CONFIG_BT_KEYS_OVERWRITE_OLDEST) and the bond data size will be ~80 bytes per device. Please note that there's an upper limit of how many devices you can pair with in Zephyr. https://github.com/nrfconnect/sdk-zephyr/blob/main/subsys/bluetooth/host/Kconfig#L670

2. No guide or sample to do this, as we do not recommend this. We just wanted you to be aware that it's possible, but we don't have any further information on how to do it. This you will have to figure out.

Best regards,

Simon

RE: central device will not raise security level with new periphral if no power reset on central side

LongQi — Wed, 14 Aug 2024 02:01:21 GMT

1. How to calculate the flash size needed for the keys persistent and how to partition for this purpose?

2. How to "tweak the host layer"? Is there any guide document and sample application?

RE: central device will not raise security level with new periphral if no power reset on central side

Simonr — Fri, 09 Aug 2024 12:47:02 GMT

The key handling for pairing is handled in the BLE Host, and uses settings that are by default to store the keys persistently in flash. It is highly recommended not to use RAM for this due to its volatile nature, so we do not have an alternative like this available. I'm sorry, but it will be up to you to tweak the host layer if this is necessary.

Best regards,

Simon

RE: central device will not raise security level with new periphral if no power reset on central side

LongQi — Thu, 08 Aug 2024 07:10:50 GMT

My understanding of pairing from the course is that:

Pairing: The process of generating, distributing, and authenticating keys for encryption purposes.
Bonding: The process of pairing followed by distribution of keys used to encrypt the link in future reconnections.

but let's not struggling the concept of these two words. Our product still needs static passkey entry but not store the encryption keys to flash. How to do that?

RE: central device will not raise security level with new periphral if no power reset on central side

Simonr — Thu, 08 Aug 2024 06:25:42 GMT

Connections can be done without storing specific info in either of the flash, but if they are going to pair over BLE, some pairing information will be stored on both ends.

You can read more on the pairing process in the Bluetooth Low Energy Devacademy course here.

"The pairing process requires the devices to repeat the process every time they want to encrypt the link again. In addition to “pairing”, the term “bonding” is used when the peers store the encryption key so they can re-encrypt the link in future connections with the same peer. During bonding, they can also exchange and store identity keys so they can recognize each other for future connections through the random resolvable private address."

Best regards,

Simon

RE: central device will not raise security level with new periphral if no power reset on central side

LongQi — Thu, 08 Aug 2024 03:37:14 GMT

I'm confused. Why saving the pair info or not will affect the pairing process? are you sure about this? So I can not pair without saving the config to flash? keep erasing is not the solution, it'll damage the flash very soon because the robots will come to charging station very often.

RE: central device will not raise security level with new periphral if no power reset on central side

Simonr — Wed, 07 Aug 2024 11:48:48 GMT

That's not possible I'm afraid, setting this config to 0 means your device won't support pairing. You will need to erase the pairing information upon disconnection if that is a way out.

Best regards,

Simon

RE: central device will not raise security level with new periphral if no power reset on central side

LongQi — Tue, 06 Aug 2024 08:36:55 GMT

I think pair is still needed but just not saving the pair information to flash. Could you recommend how to config this? will CONFIG_BT_MAX_PAIRED=0 works?

RE: central device will not raise security level with new periphral if no power reset on central side

Simonr — Tue, 06 Aug 2024 08:13:58 GMT

I think the way to do this would be to not pair or delete the paired devices at a certain point. You can't not set a number for max paired devices, as that would require a lot of Flash memory. If you're dependent on the security pairing gives you I'd recommend deleting the pairing info when the maximum is reached.

Best regards,

SImon

RE: central device will not raise security level with new periphral if no power reset on central side

LongQi — Mon, 05 Aug 2024 08:33:51 GMT

Simonr is there any update?

RE: central device will not raise security level with new periphral if no power reset on central side

LongQi — Thu, 01 Aug 2024 09:41:19 GMT

CONFIG_BT_MAX_PAIRED works for me but our application is a typical robot charger system. robot is peripheral and charger is central. there are multiple robot and charger in a fleet, any robot can go for any charger. and the robot and charger quantity may be a big number for some project. Is there a way NOT to limit the pair number?

RE: central device will not raise security level with new periphral if no power reset on central side

LongQi — Thu, 01 Aug 2024 06:38:35 GMT

I intend to have one connection only, A-B or A-C, not at the same time.

RE: central device will not raise security level with new periphral if no power reset on central side

Simonr — Thu, 01 Aug 2024 06:17:46 GMT

What is the CONFIG_BT_MAX_CONN and CONFIG_BT_MAX_PAIRED set to in your central application? My initial guess would be that you are only allowing one connected/paired device at a time, so the central device isn't able to connect to the other device, and you have to reset the central to disconnect and unpair with one device. Please give these two configs a try and see if that helps. You can also try to enable some logging so we can see what kind of error/return value the central returns when trying to connect to the other device.

Best regards,

Simon

RE: central device will not raise security level with new periphral if no power reset on central side

LongQi — Wed, 31 Jul 2024 09:31:08 GMT

I tried to remove the authtication then the switching process will be very smoth without any issue.