Bonding between nrf54L15 and nrf52810 failed

[ilockit_CFR]

Hello,

I encountered a problem while trying to bond a nrf54L15 (central) with a nrf52810 (peripheral). The firmware of the nrf54 is using Nordic Connect SDK and the nrf52 uses nRF5 SDK. I'm using bt_conn_set_security(conn, BT_SECURITY_L2) when connected to the nrf52. On the other side I get the error BLE_GAP_SEC_STATUS_AUTH_REQ and the pairing fails.

My security params of the nrf52 look like this:

ble_gap_sec_params_t sec_param;

    memset(&sec_param, 0, sizeof(ble_gap_sec_params_t));

    // Security parameters to be used for all security procedures.
    sec_param.bond           = 1;
    sec_param.mitm           = 0;
    sec_param.lesc           = 0;
    sec_param.keypress       = 0;
    sec_param.io_caps        = BLE_GAP_IO_CAPS_NONE;
    sec_param.oob            = 0;
    sec_param.min_key_size   = 7;
    sec_param.max_key_size   = 16;
    sec_param.kdist_own.enc  = 1;
    sec_param.kdist_own.id   = 1;
    sec_param.kdist_peer.enc = 1;
    sec_param.kdist_peer.id  = 1;

Here is a part of the Kconfig file of the nrf54:

CONFIG_BT_CENTRAL=y
CONFIG_BT_SCAN=y
CONFIG_BT_SMP=y
CONFIG_BT_GATT_CLIENT=y
CONFIG_BT_GATT_DM=y
CONFIG_HEAP_MEM_POOL_SIZE=4096
CONFIG_BT_SETTINGS=y
CONFIG_SETTINGS=y
CONFIG_HW_STACK_PROTECTION=y
CONFIG_BT_SCAN_WITH_IDENTITY=y
CONFIG_BT_FILTER_ACCEPT_LIST=y
CONFIG_BT_MAX_PAIRED=5
CONFIG_BT_SMP_SC_ONLY=n

I used the nearly identical code for another project, where I'm pairing a nrf52833 (central) with the nrf52810 (peripheral) and that just worked. Am I missing some configuration of the nrf54? The firmware of the nrf52810 should not be altered. 

Best regards,

Christian

[Vidar Berg]

Hello Christian,

It seems like the peripheral is failing to meet the authentication requirements from the central. Please try to only register the authentication callbacks show in picture below taken from the central_uart sample. Registering other callbacks such as "pairing_confirm" will imply user IO and MITM support. If it is possible to attach a debugger or get debug logs from the nrf54l central, please also check the error reported in the pairing failed callback.

 

Best regards,

Vidar

[ilockit_CFR]

Hello Vidar,

I'm registering only these three callbacks and the connection callback "connected", "disconnected" and "security_changed". I get the following debug output when connecting to the peripheral:

I: Connected (connected callback)
D: bt_conn_set_security = 0 (connected callback)
D: Security changed: C1:96:E9:FC:D7:90 (random) level 1 (security_changed callback)
D: Pairing failed conn: C1:96:E9:FC:D7:90 (random), reason 4 (pairing_failed callback)

Do you have an idea why the security level changed to level 1 instead of level 2?

Best regards,

Christian

[Turbo J]

Incompatible and insecure configuration.

Newer (3.x.y) NCS SDKs have deactivated bonding support for sec_param.lesc = 0; configured BTLE devices, those are no longer considered secure.

You can still turn this on manually with a configuration option, I believe its in the SDK upgrade/release notes documentation somewhere.

[Vidar Berg]

Thank you Turbo J , you are completely right. I did not think of this. Here's a link to migration document for reference: https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/releases_and_maturity/migration/migration_guide_3.0.html#bluetooth_le_legacy_pairing

[ilockit_CFR]

Thank you very much, that solved the issue. I wasn't aware of this when migrating to NCS SDK 3.1.0.