Gazelle & NRF 52840

[Samuel01]

I am trying to evaluate the NRF 52840 using the Gazell protocol.

I need some secured link between 2 devices with a low latency, and authentified (so no one can replace one of the devices, inject etc). But I also need some communication in both ways so with ack payload. The encryption (hide the data from a sniffer) is not mandatory, while it doesn't allow an attacker to do injection or spoofing etc.

I see that the Gazell protocol can encrypt, which I don't need, but I am  not sure if the data unencrypted is authentified when a device and a host are paired and comunicating using unencrypted data ?

If the gazell protocol doesn't match, do you have any other secured (encryption is not mandatory) link that could be interesting ?

Thanks for the clarification !

[Kenneth]

Hello,

You can read more about how the Gazell transport layer works here: https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/protocols/gazell/gzll.html 

You can read more about how the Gazell pairing library ensure secure wireless link between two devices here: https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/protocols/gazell/gzp.html 

It's fully possible to meet your requirements using Gazell pairing.

Kenneth

[Samuel01]

Hello, 

Thanks for your reply, I have already checked this documentation. Unfortunately, when I try to communicate in encrypted way, there is no function available to add a payload to the ack. It seems this payload is used for key exchange.

[Kenneth]

If I remember correctly then you can use pipe1 for encrypted data and pipe2-7 for unencrypted data. While pipe0 is used for pairing and key exchange.

Kenenth

[Samuel01]

Yes it's also what I found, only 1 pipe is encrypted, so it's not possible to have encrypted or at least authentified communication in both directions.

[Kenneth]

I honestly don't understand, I can't imagine that it's encrypted only one way. 

I assume you have a gazell host that is receiving data and a gazell device transmitting data, all communication should be done on pipe1 that is encrypted after gazell pairing. The gazell device is the one that need to initiate all communication. The gazell host can at any time prepare data to be sent on pipe1 back to the gazell device, but the only way it can be sent from the host to the device, is by the gazell device transmitting a packet which indirectly will then fetch the packet from the gazell host.

Kenneth

[Samuel01]

If you have a look at the gzp.h, you will see for the host the functions 

gzp_crypt_user_data_received and 

gzp_crypt_user_data_read. 

And for the device the function 

gzp_crypt_data_send.

But there is no send function for the host, or attach_payload function.

[Kenneth]

Sorry, you are right. I was under the impression it was, but it's been a while since I worked on Gazell so my memory proved me wrong.

The GZP API doesn't provide a specific high-level function for host-to-device encrypted data because it uses the underlying Gazell ACK mechanism. For encrypted host-to-device communication, you need to manually encrypt the ACK payload data before calling nrf_gzll_add_packet_to_tx_fifo() on the host. So maybe that can help.

Kenneth