nRF Sniffer decryption is not working after entering passkey

[Acutetech]

I am a newbie with nRF Sniffer, which I have installed on one PCA10040 board. I am sniffing communications between a Samsung phone running nRF Connect and a second PCA10040 running the glucose sample app.

I believe I am following the instructions in the User Guide section 5.5: when the glucose app prints the 6-digit passkey I enter this into Wireshark and type enter, then I enter it into the phone. The phone and peripheral then bond and work, but Wireshark starts printing "Encrypted packet decrypted incorrectly (Bad MIC)" . When I click on Log I see this:

INFO: Setting Passkey: 691295

INFO: Sent key value to sniffer: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 10, 140, 95]

A screenshot is here:

/resized-image/__size/640x480/__key/support-attachments/beef5d1b77644c448dabff31668f3a47-e588f28969f94ee0a39b08c9e8afde0d/Screenshot-2018_2D00_11_2D00_19-10.57.32.png

Q1: Are my results expected? What should I do differently?

Q2: Assuming I am able to get beyond this problem, is it possible to sniff subsequent connections? The Central and Peripheral will be bonded and the peripheral will not print a passkey. Can nRF Sniffer decrypt the second session based on keys it has saved?

[David Edwin]

Can you mention the wireshark version used, nRF sniffer version used and board version.

Q2: Yes, nRF Sniffer should be able to sniff the subsequent re-connections.

Q1: Seems to be as expected on actions. On the timing of actions, ensure that the wireshark has the PIN before you tap to accept on the device screen (which you seem to have done as well).

Ensure you are using the nRF Sniffer v2 Beta 3 .

I will investigate after you have posted the versions of the software and hardware as requested above.

[Acutetech]

I installed software last Friday, so should be "latest".

Wireshark says 2.6.4

I have two nRF52 boards with labels that say PCA10040 1.2.4 2018.39 (nRF sniffer) and 2018.49 (Peripheral).

nRF Sniffer was extracted from a zip file nrf_sniffer_2.0.0-beta3_12oct2018_1c2a221.zip

I confirm that I entered the passkey in Wireshark before entering it in the Central.

The peripheral, slave and central are within say 75cm of each other. AFAIK I disable BLE on other nearby devices.

I have just tried sniffing a different peripheral which uses Just Works bonding (no passkey). I continued to use nRF Connect on the Samsung phone. They bond correctly but nRF Sniffer behaves the same, with "Encrypted packet decrypted incorrectly" immediately after the LL_START_ENC_REQ packet.

[David Edwin]

If you want to re-connect to bonded peripheral, then the "perform bonding" check box must be ticked when in the pairing screen.

Keep the boards close by for the test, maybe a few centimeters apart, with the sniffer in the center.

[Acutetech]

No better. The boards are almost touching. Most (but not all) packets give "packet decrypted incorrectly" messages. There is no sign of packets being lost or corrupted prior to encryption being enabled.

Have you actually tried the identical setup yourself?

[David Edwin]

sniffer_pca10040_mic_recover_v2_18Dec2018.hex

This seems to perform better for MIC failure. can you test this and let me know.

Edit: Updated hex fix

[bill.diken]

Acutetech I'm having an identical issue with Wireshark 3.0.1 with the latest nrf sniffer nrfsniffer200beta312oct20181c2a221 with the nRF52840 DK board. I can't seem to get decryption to work reliably, I do sometimes see correct value at the attribute even with the MIC error message but it only works for the first few transmissions before it't completely broken. Were you ever able to resolve this issue?

[Acutetech]

I could not resolve the problem and gave up.

This is pure speculation: I had another problem with notification data being corrupted, which was later fixed by a library update, or similar (I think to BLE Library 2.0.4). I wonder if there could be a connection? For this other problem see devzone.nordicsemi.com/.../167037

[David Edwin]

There is a new release being worked on to fix encryption issues and seems to perform better.nrf_sniffer_2.0.0-temp_beta-4_2May2019_47b3f5f.zip

You can try this and let me know if this works better. Unfortunately this snapshot that I uploaded here has not yet been tested for passkey but has been tested for Justworks pairing.

Edited: The sniffing of encrypted link  is improved only for the nRF52xxx based development kits, the performance of the nRF51 based development kits when used as sniffer remains the same as the previous release.

[bill.diken]

David, I used the file you provided, although I had to change the contents of the nrf_sniffer.bat file to get Wireshark to recognize the devboard.

@echo off
python "%~dp0nrf_sniffer.py"  %*

The bad MIC error is still there, it seems that it decrypts the first few transactions correctly and then starts to fail and doesn't recover. What seems to work better is the disconnect/reconnect detection, in the previous build I could never get packets when there was a disconnect and the strap started advertising or when it tried to establish a new connection.

[David Edwin]

Can you share your pcap file ?

<<Reminder>> : Can you share your pcap file

Additional comment:

Make sure that the sniffer board is between the central and peripheral.
Keep a minimum separation of about 10cm between the sniffer and the other boards.
(the sniffer's ability to decrypt is still sensitive to packet loss)