nRF Connect app able to connect without being prompted for passcode

[helpme]

I managed to enable pairing without bonding on ble_app_uart by porting peer manager over from ble_app_gls. I am using SDK11 s130 on nRF51-dk.

I observed some strange behavior on ble_app_uart using different Nordic Android apps.

When I connect nRF UART app to my ble_app_uart, user will be prompted for passcode. This is normal as pairing is enabled. When I connect nRF Connect app to my ble_app_uart, connection will be established immediately and user is not even prompted for passcode. Why the different behavior between nRF UART and nRF Connect when they connect my pairing-enabled ble_app_uart?

On the other hand, when I connect nRF Connect app to ble_app_gls, the user will be prompted for passcode. What is the difference between the pairing code between ble_app_gls and ble_app_uart?

To enable pairing, what I did was modify the following inside ble_nus.c

Inside rx_char_add(), I have

BLE_GAP_CONN_SEC_MODE_SET_ENC_WITH_MITM(&cccd_md.write_perm);
BLE_GAP_CONN_SEC_MODE_SET_OPEN(&cccd_md.read_perm);
BLE_GAP_CONN_SEC_MODE_SET_ENC_WITH_MITM(&attr_md.read_perm);
BLE_GAP_CONN_SEC_MODE_SET_ENC_WITH_MITM(&attr_md.write_perm);

Inside tx_char_add, I have

BLE_GAP_CONN_SEC_MODE_SET_OPEN(&attr_md.read_perm);
BLE_GAP_CONN_SEC_MODE_SET_ENC_NO_MITM(&attr_md.write_perm);

[Petter Myhre]

A peripheral will allow any central to connect to it, as long as it is not using a whitelist.

If you with iOS or Android try to read/write a characteristic value/CCCD that that requires a link with a higher security level this will trigger pairing.

The app will automatically access the characteristic values, but with nRF Connect you have to do it yourself, this should trigger pairing.

[Petter Myhre]

The connection is establised without pairing, but ble_app_gls will send a security request to the central, the central will then initate pairing.

In on_ble_evt(), in ble_app_gls, you can see that the security request timer i started when receiving the BLE_GAP_EVT_CONNECT event:

    err_code = app_timer_start(m_sec_req_timer_id, SECURITY_REQUEST_DELAY, NULL);
    APP_ERROR_CHECK(err_code);

When the timer expires sec_req_timeout_handler() will be called, which in turn calls pm_conn_secure() which sends the security request.