How to get past "link secure failed! error: PM_CONN_SEC_ERROR_DISCONNECT

[Pierre Landau]

I was working with examples/ble_peripheral/ble_app_gls. In the SDK11alpha configuration, I paired the dev board with my Android phone running nRF Toolbox and was able to start to modify the example and do things with the glucose data.

I've worked my changes into SDK11 - the change from device_manager to peer_manager had me starting over all of my work as the main program changed so much. No matter.

The real issue is that now I went into the Android part with the nRF Control Panel, and undid the pairing (since the softdevice on the nRF51 is different, etc.) and now want to re-pair the two devices.

However, in the RTT printout, I see: 0> BLE_GAP_EVT_SEC_PARAMS_REQUEST 0> À link secure failed! error: PM_CONN_SEC_ERROR_DISCONNECT

and on the Android phone, the display shows "bonding..." for awhile, and simultaneous with the second line appearing on RTT, it shows "not bonded".

How best to work around this?

[FormerMember]

It would be very useful to check what is being transferred over the air. Do you have an extra nRF51-DK or a nRF51-Dongle? If so, could you use the sniffer to track what is being transferred over the air? And upload the sniffer trace here?

The sniffer should be used with Wireshark, and it works best with version 1.10, not one of the newer versions. Wireshark can be downloaded here:

• www.wireshark.org/.../
• www.wireshark.org/.../

[Pierre Landau]

So I got the sniffer set up. It basically didn't catch much of anything in the repeated pairing attempts until the pairing magically worked and it started capturing lots of traffic. No idea why the pairing was failing previously (in BT Classic you got to sniff the key exchange process but seemingly not so much here). I also wonder whether one of the newer Wireshark versions (I used 1.10 per instructions) might actually be able to decode Glucose Profile or Battery Level packets? I saved the file just in case it contains some hidden data on the pairing mess, but this page does not seem to have an easy "upload here" button.

[Pierre Landau]

Sorry about that - apparently the pairing still did not succeed. I see "received pairing request (packet 1307). This shows: AuthReq: Bonding, MITM Max encryption size 16 Initiator key distribution: LTK IRK CSRK Responder Key Distribution: LTK IRK CSRK

Then Rcvd pairing response: Bonding, Initiator keys: LTK IRK, Responder keys LTK IRK (packet 1310) , followed by more than a minute of empty data PDUs until the remote disconnects.

[FormerMember]

The sniffer can catch the key exchange process. In order to do so, you have to make sure that the sniffer is present when the two devices exchange encryption keys, not just when the devices are re-connecting. You can upload the file in the original question, not in the comments.

Could you delete the bonding information on both the phone and the nRF51/52 device before using sniffer to capture the bonding process?

[Pierre Landau]

I had previously deleted the bonding on the phone; this time I also deleted the bonding tables on the nRF51 before running the sniffing session.

Unfortunately, I only see two apparently relevant packets: Master-->Slave, SMP, Rcvd Pairing Request: Bonding, MITM, Initiator Key(s): LTK IRK CSRK, Responder Key(s): LTK IRK CSRK. and Slave-->Master, Rcvd Pairing Response: Bonding, MITM, Initiator Key(s): LTK IRK, Responder Key(s) LTK IRK.

This is followed by a minute or so of empty data PDU's but no further packets that appear relevant to pairing.

[Pierre Landau]

Several seconds after these, I see: Rcvd Connection Parameter Update Request Rcvd Connection Parameter Update Reesponse (Accepted) but nothing relevant to pairing, and eventually the phone shows "not bonded" while RTT shows "link secure failed! error: PM_CONN_SEC_ERROR_DISCONNECT", which is not particularly informative