Pairing & Bonding happens even when the client's iocap is no_io_caps

Question

I have a ble server with display developed for passkey security. It works fine when the Master (i.e. client) is set to have Keyboard input capability, which is good. 
 The problem is that when the client is set to have no_io_caps, the pairing and bonding still happens successfully. That means the client may bypass the security without needing to enter the passkey. I am wondering where in code would I need to change in order for the server to stop pairing with client devices without entering the correct passkey. 
 Note that the following are the security settings I used: 
 #define SEC_PARAM_BOND 1 /**< Perform bonding. */
#define SEC_PARAM_MITM 1 /**< Man In The Middle protection not required. */
#define SEC_PARAM_LESC 0 /**< LE Secure Connections not enabled. */
#define SEC_PARAM_KEYPRESS 0 /**< Keypress notifications not enabled. */
#define SEC_PARAM_IO_CAPABILITIES BLE_GAP_IO_CAPS_DISPLAY_ONLY /**< No I/O capabilities. */
#define SEC_PARAM_OOB 0 /**< Out Of Band data not available. */
#define SEC_PARAM_MIN_KEY_SIZE 7 /**< Minimum encryption key size. */
#define SEC_PARAM_MAX_KEY_SIZE 16 /**< Maximum encryption key size. */ 
 Also, I had made sure that the bonds on both the client and the server are removed before all my tests. 
 Your help will be greatly appreciated.

bjorn-spockeli · Accepted Answer

Hi Joseph,

Q1:there is a LESC module in the nRF5x SDK v15.2.0 that handles the LESC events for you and is integrated in the PM manager. I recommend taking a look at at the Experimental: LE Secure Connections Multirole Example in the SDK.

Add nRF5_SDK_15.2.0_9412b96\components\ble\peer_manager\nrf_ble_lesc.c to your project and include #include "nrf_ble_lesc.h" in main.c

You also need to set PM_LESC_ENABLED to 1 in sdk_config.h. If this isnt present in you sdk_config file, then simply add the following snippet to the Peer Manager section

// <q> PM_LESC_ENABLED  - Enable/disable LESC support in Peer Manager.
 

// <i> If set to true, you need to call nrf_ble_lesc_request_handler() in the main loop to respond to LESC-related BLE events. If LESC support is not required, set this to false to save code space.

#ifndef PM_LESC_ENABLED
#define PM_LESC_ENABLED 1
#endif

You also need to add nrf_ble_lesc_request_handler to the idle_state_handler() function in main.c

static void idle_state_handle(void)
{
    ret_code_t err_code;
    
    err_code = nrf_ble_lesc_request_handler();
    APP_ERROR_CHECK(err_code);
    
    if (NRF_LOG_PROCESS() == false)
    {
        nrf_pwr_mgmt_run();
    }
}

Q2: Could you attach the trace of the communication between your iPhone and the NRF52832? I would like to see if the pairing request sent from the iPhone sets the Secure Connection Flag. As stated previously both sides must state that they support LESC, otherwise the paring will be performed with the common denominator in terms of supported features.

Pairing & Bonding happens even when the client's iocap is no_io_caps

Top Replies