Android pairing without bonding - nRF Connect

RE: Android pairing without bonding - nRF Connect

bjorn-spockeli — Thu, 21 Feb 2019 14:29:18 GMT

At least the Android device is behaving consistenly. I reached out to our App developer and this is his response

"I don’t know if only pairing is supported on Android. This for sure can’t be triggered from Android. Perhaps it just assumes that if it’s paired, it should also start encryption."

Best regards

Bjørn

RE: Android pairing without bonding - nRF Connect

Mateusz — Wed, 13 Feb 2019 21:05:02 GMT

Out of curiosity, I also tried pairing with NXP's KW41Z and got the same result. Android tried to start the encryption process after re-connecting, even though the peripheral responded with no bonding earlier. Again, with SC on. Would be nice to check what would happen with SC off.

RE: Android pairing without bonding - nRF Connect

bjorn-spockeli — Fri, 08 Feb 2019 16:38:36 GMT

Ok, so the LL_ENC_REQ is actually sent on air, that busts my theory that this is Android checking if the key is stored or not. The LL_ENC_REQ also contains what appears to be valid key div and init vectors.

I will ask our Android developer if he has seen this issue before.

RE: Android pairing without bonding - nRF Connect

Mateusz — Fri, 08 Feb 2019 15:45:41 GMT

Hi Bjørn,

See attached. This time, I used Android 9 with a Moto x4 phone, so it appears that the same thing is happening with latest Android.

I've used nRF Sniffer v2, as requested.

I do see LL_ENC_REQ in frame 545 of android-next-pairing.pcapng.

Thanks!

devzone.nordicsemi.com/.../android_2D00_initial_2D00_pairing.pcapng devzone.nordicsemi.com/.../android_2D00_next_2D00_pairing.pcapng

RE: Android pairing without bonding - nRF Connect

bjorn-spockeli — Thu, 07 Feb 2019 12:29:04 GMT

My bad, they open fine Wireshark here as well.

Looking at the LE Start Encryption Command in the Bluetooth Specification, I see that it takes Connection_Handle, Random_Number, Encrypted_Diversifier, Long_Term_Key as parameters.

The LE_Start_Encryption command is used to authenticate the given
encryption key associated with the remote device specified by the
Connection_Handle, and once authenticated will encrypt the connection.

So it would appear that Android device has stored the Long_Term_Key from the previous connection and is trying to use this to re-establish the encrypted link. The Long term key is infact identical to the one used in conneted.log . In connected.log I also see that the the Android device is sending the Pairing request with the Bonding flag set to true, but the nRF sends a Paring response with the No Bonding flag set.However, this should result in both devices opting for no bonding.

I would like to know if the LL_ENC_REQ is actually sent on-air to the nRF or if this is something the Android BLE stack does to check if the encryption key has been stored or not. Could you capture a trace with nRF Sniffer v2?

Best regards
Bjørn

RE: Android pairing without bonding - nRF Connect

Mateusz — Tue, 05 Feb 2019 13:49:30 GMT

Hi Bjørn,

Yes, I think they should have probably ended with *.bin or *.btsnoop. With that said, I just tried downloading them and they open fine in Wireshark, so they haven't been garbled up in any way after upload. Wireshark does seem to have an option to export data to *.txt, but I believe most data goes missing with that option.

Thanks!

RE: Android pairing without bonding - nRF Connect

bjorn-spockeli — Tue, 05 Feb 2019 12:30:59 GMT

Hi Mateusz,

can you attach the btsnoop traces as readable files? The encoding isnt playing nice with the embedded code windows here on DevZone.

Best regards

Bjørn