Require BLE 4.2 key exchange but not MITM

[Daniel]

I have an application which requires protection from passive eavesdropping, but not man in the middle attacks. I want to enforce the use of diffie hellman key exchange.

Security Mode 1 Level 4 does enforce diffie hellman key exchange, but it also enforces man in the middle protection. I really only need Security Mode 1 Level 2, but with Secure Connection support.

I thought about checking the lesc field in the data for the BLE_GAP_EVT_SEC_PARAMS_REQUEST event. However, sd_ble_gap_sec_params_reply returns NRF_ERROR_INVALID_STATE. I'm using Peer Manager, which is presumably already calling this function.

BLE_GATTS_EVT_RW_AUTHORIZE_REQUEST looks capable of doing what I want, but I wanted to check if there was a way which involved configuration only. Any suggestions?

I'm using SDK 13.0.0 and softdevice s140 5.0.0-2.alpha on the nRF52840.

[Petter Myhre]

If ECDH key agreement is used the connection will be in security level 4. Security mode 2 is legacy pairing using just works, which doesn't provide protection against passive eavesdroppers if there is an attack during the pairing process.

Why are you checking the LESC field? I don't get what you want to achieve.

BLE_GATTS_EVT_RW_AUTHORIZE_REQUEST is related to authorization, is that what you want to do? It does not protect against passive eavesdroppers.

[Daniel]

My application sets I/O capabilities to None. Even with ECDH key exchange, I only get security mode 1 level 2. This level is acceptable for my application, but I need to distinguish it from a legacy key exchange mode 1 level 2.

[Petter Myhre]

You will not get security level 2 with ECDH key exchange, you will get security level 4. If you end up in security level 2 you are doing legacy pairing (with just works). If you don't have any I/O capabilites you can use LESC Just Works, it protects against passive eavesdropping.

[Daniel]

Ok, then I guess my question becomes: why am I not getting mode 1 level 4? I'm using nRF Connect as the central node. I perform a pair with the "Enable LE Secure Connection pairing" option checked. The resulting security level is 2.

I've integrated LESC support from the ble_app_multirole_lesc example. I can see from the nRF logs that the LESC key is generated. I get a PM_EVT_CONN_SEC_SUCCEEDED with a procedure of 2. Then I get a BLE_GAP_EVT_AUTH_STATUS with mode 1 level 2. Would the nRF Connect log be helpful?

[Daniel]

The SDK macro to require level 4 is named BLE_GAP_CONN_SEC_MODE_SET_LESC_ENC_WITH_MITM, and there is no corresponding macro for LESC_ENC_NO_MITM.