Is NFC + static passkey bonding possible?

[Fanis]

Hi, i'm currently working on a low power sensor device based on nrf52832. I want to transfer data only to bonded central devices. Priority is using static passkey, but my hardware can deal with NFC as well. I'm a little confused with all pairing options. Both methods work well separately: predefined PIN (6 ascii numbers) request with sd_ble_opt_set(...) function inside gap_params_init, and NFC pairing with authorisation key (7-16 hex bytes) and whitelist stuff as shown in experimental NFC bonding examples. But when i try to combine them, it all goes crazy. What i'm looking for is preserve PIN authentification, but in case of smartphone with NFC support, perform pairing and bonding by a "touch" without entering digits. As far as i understand SEC_PARAM_OOB macros forces you to make a decision between the two inside peer_manager_init(...). It's also unclear to me that i can use BLE_GAP_AUTH_KEY_TYPE_PASSKEY instead of BLE_GAP_AUTH_KEY_TYPE_OOB when performing err_code = sd_ble_gap_auth_key_reply(...).

[Petter Myhre]

I'm assuming you are making a peripheral device.

When the central sends a pairing request the Peer Manager must know if it is going to tell the central if OOB is supported or not. If OOB is supported by both sides, this is what shall be used, per spec. If OOB isn't supported by either side, IO capabilities will be checked to see if passkey entry can be performed.

You can tell the Peer Manager if OOB is supported or not by using pm_sec_params_set(). This can be called several times to set/unset OOB support.

[Fanis]

I've just expected OOB and MITM options Turned on will give me more security when i switch to bonding mode with NFC (my application initializes static passkey bonding, but on button press i run pm_sec_params_set() with oob features to switch to bonding over NFC setup). For some reason in this state bonding doesn't use OOB_AUTH_KEY transmitted through NFC. Yes pairing request pops up when attaching Android phone, but actually any one else can pair to the device using it's BLE and with no password (similar to Just Works).