how to establish secure connection between Android and nRF?

RE: how to establish secure connection between Android and nRF?

FormerMember — Fri, 13 Jun 2014 15:01:28 GMT

The bonding process consits among others of the exchange of the encryption keys, and when the bonding process is finished the link is encrypted. You can see this if you use our sniffer to track what is being sent of the air. The sniffer can be downloaded here: www.nordicsemi.com/.../26386

The keyboard in our reference design "nRFready Desktop 2" uses OOB, but I don't think it has been tested on Android.

RE: how to establish secure connection between Android and nRF?

Gilson — Fri, 13 Jun 2014 14:10:21 GMT

Kristin, Maybe I did not make myself clear. I want to enable security during the bonding, encryption of the message comes later I understand. "just works" is NOT as good, I need to come with a way to set the PIN programmatically or OOB.

I really need an example of Android using OOB, I see people here asking for examples and I would like to suggest for Nordic to provide examples showing the 3 different methods. Let the business developers decide for themselves. Sometimes we have to talk to our marketing department before we make the decision, it is not always developers choice until there is road block.

Is there an Android-nRF sample that demonstrates OOB use ?

RE: how to establish secure connection between Android and nRF?

FormerMember — Fri, 13 Jun 2014 13:39:47 GMT

The only difference between the bonding methods (Just works, display-keyboard, OOB, etc) is the security during the bonding process; when using display-keyboard, OOB, or any other MITM "process" you can make sure that there is no man-in-the-middle (MITM) attacs. However, the security of the encryption will be the same both with and without MITM bonding. Therefore, if there is no security concern during bonding, "just works" will be as good any of the other bonding "methods".

If you don't want anybody else to be able to connect to your device, you can use whitelist. If using whitelisting, you can limit the number of phones/centrals that can bond to the device.