ECB key transfer during pairing

[SUK]

Hi, I have a central that is trying to pair with a peripheral. I want this connection to be secure and I want to use ECB for encryption of data. My peripheral does not have a display or a keyboard. What pairing mechanism should I use? I was thinking about using "Just Works". I know this question has been asked a lot many times but I am still confused about this one point. Does the ECB encryption key get transferred to the central during the pairing using Just Works? If not how should I let the central know what key to use for decryption? Also is there any documentation which shows how the pairing works exactly?

Thanks.

[endnode]

Hi SUK,

Not being expert on BT4.x Security Manager and pairing mechanism but I will try to answer. "Just Works" is really the only option for devices which have no input/output interface so you cannot verify that key you receive over radio interface during pairing is genuinely the same as the on on the other device. So generic "zero" string is used to validate that AES key (generated/exchanged during the process) is the one you should use from now on. If you think it through you will find out that this pairing is basically not secure at all, anyone can intercept it and get the actual AES key and then decrypt (or alter/fake) any communication between these two devices later on. In addition even if you are not listening to the pairing itself you can try to convince one of the devices that you have lost the AES key and if it permits such re-pairing it will allow you to do the same again which of course compromises all the future communication. So using this method for anything sensitive is not a good idea.

Easy solution could be if your device is able to communicate by some other ways (e.g. NFC thanks to nRF52 in-built near-field communication capabilities) or if you are OK with hard-coding some master key into the FW (nRF5x have also something like on-time programmable registers but as they don't have any specific HW protection it almost doesn't matter if you store it there or in the code/data flash). In such case you can use OOB (Out Of Band) mode where AES key is derived/used from this "shared" secret and so you are not exchanging the key over the radio, you don't need to "verify" that it is genuine (by anything like "Just Works" or "Numeric Comparison") and you are set to go.

Cheers Jan

[endnode]

That's the part which confuses me: you say that you want to use LE Secure Connection and then you speak about AES ECB. If you want to use LE SC then stop speaking about AES ECB and stop even thinking about it because there is no option, just specification to follow. To the steps: If you see Security Manager description (BT SIG Core v4.2, Vol 3, Part H, Chapter 2) then you see that Pairing is 3-step process where in second step Long Term Key (LTK) is generated and in third step you use specific Transport Key(s) by using LTK. Once you are paired you always do only 3rd step, LTK stays the same on both sides (you need to keep some sort of database, that's what "peer manager" module in Nordic SDK is for, obviously just one example of many ways how to manage these). Then in chapter 2.2 you see full "Cryptographic Toolbox" which tells you all the details about how LTK is generated in 2nd step..