PASSKEY

[katyon]

 I’ve downloaded     nRF5_SDK_11.0.0_89a8197 and starting with examples from \examples\ble_peripheral\???\pca10040\s132\arm5_no_packs\

 I would like the other device to request a passkey (constant) at pairing (the passkey on my side is constant - no display needed)

After   gap_params_init();I’ve added the following code:

 

{

 static ble_opt_t optS;

   static uint8_t passw[]="123456";           

 optS.gap_opt.passkey.p_passkey=passw;

   err_code =sd_ble_opt_set(BLE_GAP_OPT_PASSKEY, &optS);

}

 

err_code returned :  0  

 

Still the module will pair and communicate without requesting a passkey.

I've tried to find an answer in Q&A . in some answers there was a reference to fields : io_caps,mitm. cant make out what does it mean. 

(these fields belong to structs relevant to services, not pairing)

 

Thanks for any help

   Yona

[Vidar Berg]

Hi Yona,

You can change the permission/security level on the BLE characteristics to require MITM pairing. The central does not need to pair with the device if security level is set to "open".

E..g, change BLE_GAP_CONN_SEC_MODE_SET_OPEN(&attr_md.read_perm) to BLE_GAP_CONN_SEC_MODE_SET_ENC_WITH_MITM (&attr_md.read_perm) if you want to limit read access to a certain characteristic. 

 

[katyon]

thank you for the answer.

making this change - finally  "produces"  the  events:

BLE_GAP_EVT_SEC_PARAMS_REQUEST,   BLE_GAP_EVT_AUTH_STATUS

how should I deal with them ?

(as the cellphone application does not know that passkey is needed- so reading the characteristic results in a  BLE disconnection)

Yona

[Vidar Berg]

Hi Yona,

Looks like I forgot to mention that you need to enable MITM and set IO capability in device_manager_init(). See diff file below for necessary changes:

Fullscreen static_passkey.diff Download

diff --git a/examples/ble_peripheral/ble_app_hrs/main.c b/examples/ble_peripheral/ble_app_hrs/main.c
index 6facd54..b7bf916 100644
--- a/examples/ble_peripheral/ble_app_hrs/main.c
+++ b/examples/ble_peripheral/ble_app_hrs/main.c
@@ -87,10 +87,10 @@
 #define MAX_CONN_PARAMS_UPDATE_COUNT     3                                          /**< Number of attempts before giving up the connection parameter negotiation. */
 
 #define SEC_PARAM_BOND                   1                                          /**< Perform bonding. */
-#define SEC_PARAM_MITM                   0                                          /**< Man In The Middle protection not required. */
+#define SEC_PARAM_MITM                   1                                          /**< Man In The Middle protection not required. */
 #define SEC_PARAM_LESC                   0                                          /**< LE Secure Connections not enabled. */
 #define SEC_PARAM_KEYPRESS               0                                          /**< Keypress notifications not enabled. */
-#define SEC_PARAM_IO_CAPABILITIES        BLE_GAP_IO_CAPS_NONE                       /**< No I/O capabilities. */
+#define SEC_PARAM_IO_CAPABILITIES        BLE_GAP_IO_CAPS_DISPLAY_ONLY               /**< No I/O capabilities. */
 #define SEC_PARAM_OOB                    0                                          /**< Out Of Band data not available. */
 #define SEC_PARAM_MIN_KEY_SIZE           7                                          /**< Minimum encryption key size. */
 #define SEC_PARAM_MAX_KEY_SIZE           16                                         /**< Maximum encryption key size. */
@@ -327,6 +327,15 @@ static void gap_params_init(void)
 
     err_code = sd_ble_gap_ppcp_set(&gap_conn_params);
     APP_ERROR_CHECK(err_code);
+                                          
+    static ble_opt_t optS;
+
+    static uint8_t passw[]="123456";           
+
+    optS.gap_opt.passkey.p_passkey=passw;
+
+    err_code =sd_ble_opt_set(BLE_GAP_OPT_PASSKEY, &optS);
+    APP_ERROR_CHECK(err_code);
 }
 
 
@@ -455,7 +464,7 @@ static void services_init(void)
     BLE_GAP_CONN_SEC_MODE_SET_NO_ACCESS(&hrs_init.hrs_hrm_attr_md.read_perm);
     BLE_GAP_CONN_SEC_MODE_SET_NO_ACCESS(&hrs_init.hrs_hrm_attr_md.write_perm);
 
-    BLE_GAP_CONN_SEC_MODE_SET_OPEN(&hrs_init.hrs_bsl_attr_md.read_perm);
+    BLE_GAP_CONN_SEC_MODE_SET_ENC_WITH_MITM(&hrs_init.hrs_bsl_attr_md.read_perm);
     BLE_GAP_CONN_SEC_MODE_SET_NO_ACCESS(&hrs_init.hrs_bsl_attr_md.write_perm);
 
     err_code = ble_hrs_init(&m_hrs, &hrs_init);

Vidar

[katyon]

it WORKS

realy

thanks for all

Yona

[katyon]

Hi again

although all works, still I have a small issue.

no problem to force read,write  to demand a PASSKEY, 

BUT cant make "notify" demand it.

if       char_md.p_cccd_md  = &cccd_md; 

and I write  

    BLE_GAP_CONN_SEC_MODE_SET_ENC_WITH_MITM(&cccd_md.read_perm);
    BLE_GAP_CONN_SEC_MODE_SET_ENC_WITH_MITM(&cccd_md.write_perm);

then  sd_ble_gatts_characteristic_add   returns error=7 (NRF_ERROR_INVALID_PARAM)

if I dont write it  then even if "read" demands PASSKEY, its "notify" dosnt

maby the problem is in the way I "make" read,notify: 

if read without notify then I use      sd_ble_gatts_value_set

if notify is involved then                  sd_ble_gatts_hvx   (same call covers read & notify)

(at the time- it didnt work any other way)

what do you think ?

thanks again and again

Yona

[Andre]

Leave the cccd_md open, apply the BLE_GAP_CONN_SEC_MODE_SET_ENC_WITH_MITM to the attr_md only.

[katyon]

doing so- makes the "notify" answer without requesting a passkey 

[Vidar Berg]

Hi, 

Do you get invalid param if your remove BLE_GAP_CONN_SEC_MODE_SET_ENC_WITH_MITM(&cccd_md.read_perm);? You only need BLE_GAP_CONN_SEC_MODE_SET_ENC_WITH_MITM(&cccd_md.write_perm); to require authentication for notifications. 

[katyon]

Hi

Do you get invalid param?    yes

if I dont     BLE_GAP_CONN_SEC_MODE_SET_ENC_WITH_MITM(&cccd_md.read_perm)   everything works

meaning: read+write demand a passkey. notify dosnt.

for example: my characteristic   is read+notify.

upon power up + BLE connection/pairing... I will get notifys without any request for PASSKEY. 

then: when trying to read  for the 1st time (notify & read - return the same data)- I'm required to enter a passkey

(ONLY THEN)

thats why I tried to mess  with cccd_md.

Yona

[katyon]

maybe there is a work around this  (cant force NOTIFY to demand a passkey - if PASSKEY was not entered yet)

if I can see at some location - how the pairing+security are doing (MITM+PASSKEY+...)

then I can NOTIFY / output a READ only if pairing+security are cleared

Yona

[Vidar Berg]

Hi,

Notifications are enabled by writing to the 0x2 to the CCCD so it is the write operation that should require authentication. It's not possible  to require authentication for reading of the CCCD, and that is why the softdevice returns the invalid param error. Note that CCCD only contains the configuration value, not the characteristic value. Also worth noting that this configuration is persistent across connections when the devices are bonded.

The characteristic value permissions are set on attr_md.read_perm  and  attr_md.write_perm if you use ble_hrs.c::heart_rate_measurement_char_add()as reference. 

[katyon]

Hi again

eventually I found   the variable    m_connection_table[0].state

it contains the connection state- so if passkey not cleared - I can avoid notifys.

now if I may- a new issue:     sd_flash_write,sd_flash_page_erase

calling sd_flash_write returns (after 20uS)  0x00 (probably NRF_SUCCESS)

than (after 2870uS) at   sys_evt_dispatch i receive  sys_evt=2    ( probably NRF_EVT_FLASH_OPERATION_SUCCESS)

STILL nothing is written to flash.

maybe you have a clue to what I'm doing wrong.

using nRF5_SDK_11.0.0_89a8197  SW package.

thanks again

YONA