Key Distribution Explanation

[Scribble]

Hi guys,

I've reviewed the documentation showing some example key distribution settings here: https://infocenter.nordicsemi.com/index.jsp?topic=%2Fcom.nordic.infocenter.sdk5.v15.0.0%2Flib_pm_usage.html and have looked around the forums, but am finding my understanding of when to and not to distribute/receive various keys is still pretty incomplete.

From what I can see in these examples:

• The id key (Identity Resolving Key) is used when you want to use a private address
• The enc key (LTK) is used when supporting bonding when keyboard input can't be supplied (seems unlikely the keyboard input becomes the LTK so why is sharing turned off in this example?)
• OOB pairing doesn't share any keys because the required information is in the OOB, but if I wanted to support other modes as well I'd presumably still have to share keys?
• I also understand depending on the security mode, there's a different expectation on whether the peripheral or central shares the LTK key?
• What are the risks if I share a key when I'm not supposed to for my mode of operation, if any?
• When might I need the sign key? As this isn't discussed anywhere.

Hopefully you can see I'm having to make a lot of assumptions, some of which I'm sure are wrong.

I'd very much appreciate if anyone's able to clarify when each key is supposed to be used and any 'gotchas' I should be aware of.

Many thanks

[Kenneth]

Hi,

Answers to most of your questions can found in the BT core spec v5.0. It may be difficult to know where to look to find the relevant information, so this document is useful resource: 
https://www.bluetooth.com/~/media/files/specification/bluetooth-low-energy-security.ashx 

You can also find the message sequence chart for the softdevice implementation useful, since that show the softdevice api and events triggered by the various security procedures:
https://infocenter.nordicsemi.com/topic/com.nordic.infocenter.s132.api.v6.0.0/group___b_l_e___g_a_p___m_s_c.html 

For most part I would say that by including the peer manager in your application, then peer manager will automatically take care of this for you, and the peripheral and central devices will automatically negotiate the highest common security mode and level depending on the features supported. There is no need for the application to consider the LTK or IRK, if however you want to support passkey or OOB, then the application will need to provide the passkey or OOB keyupon request by the softdevice as shown in the message sequence charts.

Best regards,
Kenneth