nRF Mesh App Cannot Interact with Devices after IV Index Update

RE: nRF Mesh App Cannot Interact with Devices after IV Index Update

jm_solar — Mon, 10 Mar 2025 20:17:02 GMT

Hi Simon,

Thank you I think this is solved and can be closed

RE: nRF Mesh App Cannot Interact with Devices after IV Index Update

Simonr — Tue, 04 Mar 2025 08:18:42 GMT

Ah, I see! I didn't catch that you were sharing the sequence number/address of the provisioners. Doing that will effectively be replay attacking yourself. Each provisioner should be allocated its own unicast address. This approach avoids sequence number conflicts and ensures that each provisioner operates independently within the network.

Glad we have it figured out then. Let me know if we can close this case or if you have any further follow-ups.

RE: nRF Mesh App Cannot Interact with Devices after IV Index Update

jm_solar — Tue, 04 Mar 2025 00:04:19 GMT

devzone.nordicsemi.com/.../android_2D00_log.txt

I've attached a log from the Android app. In this session I did the following:

1. Tried to get the TTL from the connected device (timed out)

2. Tried to deprovision the connected device (timed out)

3. Created a new provisioner and set the phone to use this new provisioner

4. Again requested the TTL from the connected device which succeeded.

I was also able to crack open one of our devices today to get logs (they were in sealed enclosures for environmental testing which restricted access). I found that the device was rejecting the messages as a replay attack - it seems the IV index update was a bit of a red herring. Apologies for spending your time on that.

It seems like perhaps the best practice is that every device should be allocated its own address rather than having all the phone devices share an address? Or is there a good way to share the sequence number?

RE: nRF Mesh App Cannot Interact with Devices after IV Index Update

jm_solar — Mon, 03 Mar 2025 23:31:50 GMT

Hi Simon,

I don't have logs for you yet, are Android logs okay? We currently primarily are developing for android so that will be easier for us.

I wanted to update that one of our engineers seems to have found a "work around" perhaps. It seems that if we create a new provisioner and operate as that provisioner instead we can interact with the devices and de-provision them. This new provisioner can also be shared between devices. Perhaps the new provisioner will also stop working next IV-Index update. Unfortunately these devices need to be updated so I don't think they will operate that long. But I will try to get an android log before they are taken down.

RE: nRF Mesh App Cannot Interact with Devices after IV Index Update

Simonr — Mon, 03 Mar 2025 08:20:06 GMT

I talked to our nRF Mesh developer today, and they agree with you that you should get the IV index when returning. If you have a Mac OS device, you can use an app called Console (native on Mac), and select the connected iPhone, enable Debug and Info messages in the menu, and set a filter for 'subsystem = com.nordicsemi.nRFProvision'

That should give you some useful debug info. If you're not able to get anywhere from that, please upload that here and we can review the debug info on our end.

Best regards,

Simon

RE: nRF Mesh App Cannot Interact with Devices after IV Index Update

jm_solar — Fri, 28 Feb 2025 18:27:52 GMT

Hi Simon,

My understanding is that the phone should get the current IV index from the SMB messages upon returning, is this not correct?

I found this presentation from Nordic that says "A node, inactive for more than 96 hours, needs to be able to scan for at least 5 seconds for Secure Network Beacon to recover IV Index". I was expecting the phone/app would do this. I did try enabling IV test mode, that made no difference.

Also our co-worker who originally setup the next work, now ~2 weeks ago, returned to the office today and has the same results with the original provisioner device as we had on other devices.

Our use case requires the networks to be able to be operated in the field later by a phone or other mobile device to add/remove/replace devices (gaps between uses could perhaps be measured in decades if the system is working very reliably). We are working on our own app using the Nordic SDKs for customer use but internally using the nrf Mesh app in the meantime.

RE: nRF Mesh App Cannot Interact with Devices after IV Index Update

Simonr — Fri, 28 Feb 2025 14:16:27 GMT

Hey Jonathan

Thank you for the additional details. I'm sorry for the late reply here. Can you also share the details on how your phone (provisioner) gets the IV index update events in that week of the devices running? If the phone just "leaves" the network it might never get any IV index updates, and thus it is "out of the loop" after coming back for a week.

Best regards,

Simon

RE: nRF Mesh App Cannot Connect to Devices after IV Index Update

jm_solar — Mon, 24 Feb 2025 20:23:47 GMT

Hi Simon,

Sorry I should have incldued these details originally:

1. Yes provisioned from a phone using the nrf mesh app

2. The shortest period of time we have seen this is ~1 week

3. Currently it is only on different devices (we have tried multiple). I want to try with the original provisioner device, unfortunately it is with a a coworker who has been out sick. I will update as soon as we are able to try that, hopefully in the next few days.

4. We are able to see the device and connect, but we cannot operate any models, deprovision devices, etc. These operations all time out.

Thank you

RE: nRF Mesh App Cannot Connect to Devices after IV Index Update

Simonr — Mon, 24 Feb 2025 13:50:56 GMT

There are some more details we need to be able to start helping you here.

1. Is it a phone acting as the provisioner when you set up the network or some other device?

2. When you say you "wait a while". How long is the network going before you come back and change the configuration exactly?

3. Do you use the same provisioner/app for importing the JSON from the network as you used initially, or are you using some other device for this?

4. When trying to connect to devices to unprovision them, what do you mean by seeing them and not being able to interact with them? Are all of these proxy nodes presented in a GATT scan, or are you using another device for unprovisioning than you used for the initial provisioning? Do you get an error code of some kind since you're "unable to interact with the devices?

Best regards,

Simon