Why gatttool can access characteristics whithout secure connection on ble_app_gls example from SDK?

RE: Why gatttool can access characteristics whithout secure connection on ble_app_gls example from SDK?

Chencheng — Fri, 18 Jan 2019 15:34:31 GMT

Great, Thanks!

RE: Why gatttool can access characteristics whithout secure connection on ble_app_gls example from SDK?

Vidar Berg — Fri, 18 Jan 2019 15:26:26 GMT

Hi Checheng,

I think it's easier if you look at the switch case in ble_srv_common.c::set_security_req() which invoke BLE_GAP_CONN_SEC_MODE_SET_* macros. These macros show what security mode and level each security_req_t member correspond to. Then have a look at the different security modes and levels defined by the core spec (core spec v5, vol. 3, part C, section 10.2).

"All OOB, numeric comparison, and passkey pairing are for MITM protection as I understand." Yes, that is correct.

RE: Why gatttool can access characteristics whithout secure connection on ble_app_gls example from SDK?

Chencheng — Fri, 18 Jan 2019 14:26:25 GMT

Thanks Vidar,

That's exact answer to my problem.

BTW, can you elaborate what pairing methods does SEC_SIGNED applies to? Or what is the difference between SEC_MITM and SEC_SIGNED_MITM? Do they differs just as LEGACY versus LESC connection?

(http://infocenter.nordicsemi.com/index.jsp?topic=%2Fcom.nordic.infocenter.s132.api.v6.1.0%2Fgroup___b_l_e___g_a_p___p_e_r_i_p_h___s_e_c___m_s_c.html&cp=2_3_1_1_0_2_1_3_10)

All OOB, numeric comparison, and passkey pairing are for MITM protection as I understand.

Best regards,

Chencheng

RE: Why gatttool can access characteristics whithout secure connection on ble_app_gls example from SDK?

Vidar Berg — Fri, 18 Jan 2019 14:10:09 GMT

Hi,

The security level on the gls characteristics are set to "just works" by default, so MITM protection is not required to access these. You can change the security level in service init to require MITM:

// Here the sec level for the Glucose Service can be changed/increased.
gls_init.gl_meas_cccd_wr_sec = SEC_JUST_WORKS;
gls_init.gl_feature_rd_sec = SEC_JUST_WORKS;
gls_init.racp_cccd_wr_sec = SEC_JUST_WORKS;
gls_init.racp_wr_sec = SEC_JUST_WORKS;

Here are some message sequence charts that illustrate the different bonding procedures: http://infocenter.nordicsemi.com/topic/com.nordic.infocenter.s132.api.v6.1.0/group___b_l_e___g_a_p___p_e_r_i_p_h___s_e_c___m_s_c.html?cp=2_3_1_1_0_2_1_3_10

Best regards,

Vidar