Passkey activation

RE: Passkey activation

Petter Myhre — Tue, 11 Oct 2016 15:03:45 GMT

When in the peripheral role kdist_own defines which keys it shall distribute to the central, while kdist_peer defines which keys the central shall distribute to you.

/** @brief Keys that can be exchanged during a bonding procedure. */
typedef struct
{
  uint8_t enc     : 1;                        /**< Long Term Key and Master Identification. */
  uint8_t id      : 1;                        /**< Identity Resolving Key and Identity Address Information. */
  uint8_t sign    : 1;                        /**< Connection Signature Resolving Key. */
  uint8_t link    : 1;                        /**< Derive the Link Key from the LTK. */
} ble_gap_sec_kdist_t;

RE: Passkey activation

Sascha — Tue, 11 Oct 2016 12:32:06 GMT

I think we found the reason, why it didnt work. Our steps to set static passkey.

in main.c.:

// Standard defines #define SEC_PARAM_BOND 1 #define SEC_PARAM_MITM 0 #define SEC_PARAM_LESC 0 #define SEC_PARAM_KEYPRESS 0 #define SEC_PARAM_IO_CAPABILITIES BLE_GAP_IO_CAPS_DISPLAY_ONLY // passkey defines #define STATIC_PASSKEY "111111" uint8_t passkey[] = STATIC_PASSKEY; ble_opt_t static_pin_option;
in gap_params_init():

static_pin_option.gap_opt.passkey.p_passkey = passkey; err_code = sd_ble_opt_set(BLE_GAP_OPT_PASSKEY, &static_pin_option); APP_ERROR_CHECK(err_code);

With this the passkey entry didnt work: it abort after key was typed in. So we compared our project with the ble_app_gls example line by line. I dont know exactly why, perhaps for some testing, in our peer_manager_init() the sec_param were set to:

sec_param.kdist_own.enc  = 0;
sec_param.kdist_own.id   = 0;
sec_param.kdist_peer.enc = 0;
sec_param.kdist_peer.id  = 0;

and in gls example is set to 1. We changed it, and now it works as required. But, can anyone explane us why it is now working and what is the reason why it didnt work?

RE: Passkey activation

Petter Myhre — Mon, 10 Oct 2016 14:29:49 GMT

Maybe you can edit your question and upload your complete project so we can test it here? What SDK and SoftDevice version are you using?

RE: Passkey activation

Sascha — Mon, 10 Oct 2016 12:45:39 GMT

The reason: 0x13 BLE_HCI_REMOTE_USER_TERMINATED_CONNECTION Direct after i press OK, when i typed in the key.

RE: Passkey activation

Alex — Mon, 10 Oct 2016 12:19:21 GMT

First of all look at log of nRF Connect application. Also put break point at BLE_GAP_EVT_DISCONNECTED event and see what is in p_ble_evt->evt.gap_evt.params.disconnected.reason

RE: Passkey activation

Sascha — Mon, 10 Oct 2016 12:14:51 GMT

It do not run into the app_error_handler(). Otherwise, we dont know a point to view at, where it could break up or check the key, we typed in.

RE: Passkey activation

Alex — Mon, 10 Oct 2016 07:46:55 GMT

Most likely connection aborted due to reset at app_error_handler(). Can you run in debug mode and see where your code fails?

RE: Passkey activation

Sascha — Mon, 10 Oct 2016 07:40:27 GMT

Hey Alex and Petter, sorry, but we dont get it.
We tried different things.
We took the ble_app_template example with 2 new Characteristics.
In main:
"#define SEC_PARAM_IO_CAPABILITIES BLE_GAP_IO_CAPS_DISPLAY_ONLY"
"#define STATIC_PASSKEY "111111"
uint8_t passkey[] = STATIC_PASSKEY;

in gap_params_init():
err_code = sd_ble_gap_ppcp_set(&gap_conn_params);

in our characteristic_add() for the secure characteristic:
BLE_GAP_CONN_SEC_MODE_SET_ENC_NO_MITM(&attr_md.read_perm);

Now, when we are connected, we can see our characteristics. When we try to read out, there is the pin request. If i type in, the connection abort. There is no uart communication for mitm protection, so i think the static passkey is set correct!?

RE: Passkey activation

Petter Myhre — Wed, 05 Oct 2016 08:42:22 GMT

If you have trouble with ble_app_gls you should add another question. Please have a look at this, it may explain why you don't get a passkey request. And Alex you are correct, Passkey Entry and OOB is used to protect against MITM attacks.

RE: Passkey activation

Alex — Wed, 05 Oct 2016 08:36:59 GMT

Passkey will be asked as soon as you try to read encrypted characteristic. Just connection doesn't require it. Also look at this thread . Some old Android don't ask passkey on connection. We have ASUS with Android 5.0.2 which doesn't work. By the way, I'm not good expert in BLE security I always thought that passkey is for MITM.

RE: Passkey activation

Sascha — Wed, 05 Oct 2016 08:25:08 GMT

Hi Alex, thanks for your answer. I tried that. But i have no passkey request on my smartphone. I connect with iphone and android phones and it connects without any message, to type in any key. While testing, i had another problem with the passkey: i took the ble_app_gls example for testing. I dont know why, but when i try to connect to it with an android device, i dont get any connection, it abort direct after pushing connect. when i try with iphone, the passkey request appears on the phone. Does anybody know what is the problem here? thx

RE: Passkey activation

Alex — Tue, 04 Oct 2016 14:35:53 GMT

Put it at the end of gap_params_init(). Make sure you set SEC_PARAM_IO_CAPABILITIES BLE_GAP_IO_CAPS_DISPLAY_ONLY