Assymetrical encryption for BLE Mesh provisioning

[Vladimir Aparin]

In continue to https://devzone.nordicsemi.com/f/nordic-q-a/39424/ble-mesh-self-provisioning-or-factory-preconfigured

Can we use the assymetrical encryption on provisioning stage? We want to store some keys into end nodes and main key into provisioner (server) to be sure that it's our device.

[Joakim Jakobsen]

Hi.

When your question is related to your previous thread, you are welcome to simply continiue the discussion in the same thread.

However, which keys is it that you want to "store" in the end nodes and the provisioner?

Maybe you could elaborate a bit what on what you want to acheive here?

Thanks.
Best regards,
Joakim

[Vladimir Aparin]

I made the new one because this question I got from another one customer, when prevous ticket has already closed.

We want to store the keys which can identify the end nodes and provisioner. This idea arose by analogy with SSL. We want to add some nodes in mesh network in automatical mode but without hardcoded network key.

Suggest algorithm: new node starting in network and asking to be added into the network, provisioner checking, that new device has the valid key (send encrypted MAC for example or another uniqe ID , to be sure, that we can't just copy the firmware) and start the provisioning procedure in automatic mode only for valid end nodes.

[bjorn-spockeli]

Im not sure if adding a this verification step to the provisioning process will require a lot of modification of the mesh stack code or not. I have asked the Mesh team for their comment, will update the case once i hear back from them. 

Best regards

Bjørn