Title: Clarification on LE Secure Connections and SMP responsibilities when using SoftDevice Controller as HCI controller on nRF52840

[Anand Ponraj]

We are using an nRF52840 running SoftDevice Controller (SDC) in a custom Host + Controller architecture:

• SDC runs on nRF52840 as the Bluetooth LE Controller.
• Our firmware on nRF52840 implements the HCI transport.
• An external Host (non‑Nordic) runs the Bluetooth Host stack and communicates with SDC via HCI.

We need detailed clarification on how LE Secure Connections (LE SC) and SMP are intended to be handled in this setup.

1. SMP and LE SC responsibilities

   • Is the full LE SMP state machine (including LE Secure Connections) implemented inside SDC in this HCI‑controller configuration, or is SMP expected to be implemented entirely on the Host?
   • Are ECC P‑256 key generation and ECDH DHKey computation performed internally by SDC, or must the Host perform these operations?
   • Are the LE SC cryptographic functions (f4, f5, f6, g2, etc.) and LTK generation handled inside SDC, or are they Host responsibilities?
   • In short: when SDC is used purely as an HCI controller, is LE Secure Connections fully managed by SDC, or by the Host?

2. IO Capability and OOB configuration

   • We do not see SDC HCI APIs such as sdc_hci_cmd_io_capability_reply() or sdc_hci_cmd_le_set_oob_data() in the nrfxlib SDC HCI API index.[SDC HCI API]
   • How should the Host respond to IO Capability Request and configure IO capabilities when using SDC as an HCI controller?
   • How should we provide OOB Confirm and Random values for LE Secure Connections OOB pairing in this architecture? Which specific SDC HCI commands (if any) are intended for LE SC OOB data provisioning?

3. DHKey access

   • Is it possible for the Host to request generation of the ECDH DHKey via HCI and read the DHKey value, or is DHKey computation strictly internal to SDC and never exposed over HCI in this configuration?

4. SMP PDU handling over L2CAP

   • If SDC implements SMP internally, should the Host avoid handling SMP PDUs over L2CAP and treat the link as “already secured” based on HCI events?
   • Or is the intended model that the Host implements the full SMP over L2CAP, and SDC only provides lower‑level LE encryption primitives via HCI (e.g., LE Enable Encryption, LE Long Term Key Request Reply/Negative Reply, etc.)?[HCI LE cmds]

Our goal is to understand the officially supported and recommended division of responsibilities between SDC and an external Host for:

• LE Secure Connections (Just Works / Passkey / Numeric Comparison)
• LE SC OOB pairing
• SMP PDU handling and key management

so that we can implement our Host side correctly and remain compliant with Nordic’s intended SDC usage.

Please provide:

• A clear statement of which parts of LE SC/SMP are implemented in SDC vs. expected on the Host in HCI mode.
• The list of HCI commands/events that should be used for LE SC and OOB pairing in this architecture.
• Any relevant application notes or documentation links that describe this Host + SDC‑as‑HCI‑controller model.

[Einar Thorsrud]

Hi,

A clear statement of which parts of LE SC/SMP are implemented in SDC vs. expected on the Host in HCI mode.

Pairing and bonding is implemented in the host only (see Security Manager in the Bluetooth specification). Therefore, there is no code or APIs for this in the SoftDevice Controller, as that implements a standard Bluetooth HCI interface.

The list of HCI commands/events that should be used for LE SC and OOB pairing in this architecture.

None (see above).

Any relevant application notes or documentation links that describe this Host + SDC‑as‑HCI‑controller model.

This follows the Bluetooth specification. The only integration we support directly is the integration with the Zephyr host in the nRF Connect SDK, so this can be used as a reference. However, as it is a standard HCI interface you only need to refer to the BLE specification for that, and also see the vendor specific commands documented here (though this is may often not be needed). You can see an example of using the SoftDevice Controller with another host (typically BlueZ on Linux) by referring to the Zephyr Bluetooth samples that start with "HCI".