How to know that the device disconnected due to an authentication failure

RE: How to know that the device disconnected due to an authentication failure

Kenneth — Mon, 19 May 2025 13:17:34 GMT

Please make a sniffer log if you are not able to make this work by removing the device from the phone (and BT off/on to clear cache) and a full erase of the peripheral (e.g. eraseall or recover).

Kenneth

RE: How to know that the device disconnected due to an authentication failure

V.Lorz — Fri, 16 May 2025 18:45:00 GMT

None of those options seemed to make a change in behaviour.

Could you, please, point me to a working example for LE Secure Connections pairing using Level 2, Just Works?

I configured the characteristics for using READ/WRITE with BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_WRITE_ENCRYPT, called bt_conn_set_security(conn, BT_SECURITY_L2); in the connected callback.

Should I add any configuration option in prj.conf to indicate the Android device it should not try to pair with the device using a PIN or KEY?

RE: How to know that the device disconnected due to an authentication failure

Kenneth — Tue, 29 Apr 2025 12:30:46 GMT

Sorry, try with

CONFIG_BT_ID_UNPAIR_MATCHING_BONDS=y
CONFIG_BT_ID_ALLOW_UNAUTH_OVERWRITE=y
CONFIG_BT_KEYS_OVERWRITE_OLDEST=y

Kenneth

RE: How to know that the device disconnected due to an authentication failure

V.Lorz — Mon, 28 Apr 2025 21:07:18 GMT

I seems like CONFIG_BT_ID_ALLOW_UNAUTH_OVERWRITE has a dependency on CONFIG_BT_SMP_ALLOW_UNAUTH_OVERWRITE being 'n'.

It is the peripheral which still has the keys intact.

RE: How to know that the device disconnected due to an authentication failure

Kenneth — Mon, 28 Apr 2025 20:26:03 GMT

I suspect this is a corner case that you encounter during development and not on an end product.

You can try to add the kconfig options I have suggested just to check if that make any difference.

Can tell me which side had keys intact here when you encountered the issue, is it the phone or the peripheral that still had the keys intact?

Kenneth

RE: How to know that the device disconnected due to an authentication failure

V.Lorz — Mon, 28 Apr 2025 17:54:32 GMT

Thanks Kenneth,

I implemented the callback but I receive error code 9, according to enum bt_security_err this is BT_SECURITY_ERR_UNSPECIFIED.

Is this the intended behaviour? Or should I expect a different code?

RE: How to know that the device disconnected due to an authentication failure

Kenneth — Mon, 28 Apr 2025 15:16:39 GMT

Hi Chase,

For test you can try to add (one or all):

CONFIG_BT_ID_UNPAIR_MATCHING_BONDS=y
CONFIG_BT_ID_ALLOW_UNAUTH_OVERWRITE=y
CONFIG_BT_KEYS_OVERWRITE_OLDEST=y
CONFIG_BT_SMP_ALLOW_UNAUTH_OVERWRITE=y

If that doesn't help, then my next suggestion is an on-air sniffer log:
https://www.nordicsemi.com/Products/Development-tools/nRF-Sniffer-for-Bluetooth-LE
https://docs.nordicsemi.com/bundle/nrfutil/page/README.html

You can send me the .pcapng file from wireshark, just make sure to sniff the specific connection by following:
https://docs.nordicsemi.com/bundle/nrfutil/page/nrfutil-ble-sniffer/guides/common_actions_sniffing_conn_single_periph.html

Edit: Sorry, I can see I didn't really address your question.

[quote user=""]How can I know, inside the callback disconnected, that the connection was closed with BT_HCI_ERR_AUTH_FAIL? I always receive reason 22 (BT_HCI_ERR_LOCALHOST_TERM_CONN).[/quote]

Maybe register a bt_conn_auth_info_cb callback to capture authentication failures (pairing_failed). In the pairing_failed() callback, you can react appropriately, e.g., call bt_unpair().

Kenneth