Fixed Passkey Pairing on Peripheral without I/O

[Masa Kawa]

We are developing a Bluetooth peripheral device.

The peripheral has no input/output capability, and a fixed passkey is pre-programmed.

We would like the pairing to succeed only when the central device enters the correct passkey during pairing.

Are there any sample projects or examples that can help implement this functionality?

SDK:nRF5 SDK 15.3.0

SoftDevice:s132_nrf52_6.1.1

[Emil Lenngren]

I don't know why you want this; it is explicitly discouraged by the specification, since you can brute force it in 20 attempts, see https://insinuator.net/2021/10/change-your-ble-passkey-like-you-change-your-underwear/ for an explanation. The protocol is only designed for and secure if a new randomly generated key is used for each new attempt.

[Masa Kawa]

I understand the security concerns.

For the device we are developing, we are not considering using random keys for security; instead, we intend to use the passkey essentially as a device serial number (by attaching the fixed passkey to the device and having the user read it).

Could you please provide a detailed explanation of how to configure ble_gap_sec_params_t and what values should be set?

Should we use sd_ble_gap_sec_params_reply() during the BLE_GAP_EVT_SEC_PARAMS_REQUEST event?

If so, what would be the appropriate parameter values?

[tesc]

Hi,

If what you want is a serial number, then it would be better to either use the device address or let the device advertise with its serial number using manufacturer specific data in the advertising packet. That way you would find the device (based on the serial number) before you connect to it. With using passkey for this, you will have to connect first, then figure out whether or not you are connected to the correct device.

Regards,
Terje

[Masa Kawa]

Thank you for your response. 

We will refer to the information you provided regarding the concept of passkey and serial number.

As for the fixed passkey, we were able to implement it as follows, so we will close this inquiry:

1.Set the passkey at startup using sd_ble_opt_set.

2.When the BLE_GAP_EVT_SEC_PARAMS_REQUEST event occurs, respond with the following parameters using sd_ble_gap_sec_params_reply:

ble_gap_sec_params_t sec_param;
sec_param.bond = 0;
sec_param.mitm = 1;
sec_param.lesc = 0;
sec_param.keypress = 0;
sec_param.io_caps = BLE_GAP_IO_CAPS_DISPLAY_ONLY;
sec_param.oob = 0;
sec_param.min_key_size = 7;
sec_param.max_key_size = 16;