Can not open file error on "Importing Keil projects"

[takashina hiroki]

I have a question about "Importing Keil projects".

I want to run "ble_app_multirole_lesc (SDK V14.2.0)" using "SEGGER Embedded Studio".
However, there is no project file compatible with "SEGGER Embedded Studio" in this sample project.

Therefore, I imported the project according to the document of "Importing Keil projects".
As a result, the project was created.
However, the following error occurs.

Cannot open file: C:/***/nRF5_SDK_14.2.0_17b948a/examples/ble_central_and_peripheral/experimental/ble_app_multirole_lesc/pca10040/s132/arm5_no_packs/Output/ble_app_multirole_lesc_pca10040_s132 nrf52832_xxaa/Obj/ble_app_multirole_lesc_pca10040_s132.ind

Please tell me the cause.

[awneil]

Do you have a particular reason for using that old SDK version?

Newer SDKs do have SES projects!

I never found the import terribly useful - easier to just create the SES project from scratch

takashina hiroki said:

Cannot open file: C:/***/nRF5_SDK_14.2.0_17b948a/examples/ble_central_and_peripheral/experimental/ble_app_multirole_lesc/pca10040/s132/arm5_no_packs/Output/ble_app_multirole_lesc_pca10040_s132 nrf52832_xxaa/Obj/ble_app_multirole_lesc_pca10040_s132.ind

That's an output file anyhow - isn't it?

(it's in the 'output' folder)

So you shouldn't need to be importing it at all!

[Vidar Berg]

SDK 14.2.0 includes SES projects for most examples except for this one. I'd recommend starting with one of the existing SES projects instead of trying to import the Keil project. Also, the LESC implementation has a vulnerability in this SDK, please have a look the whitepaper for more details: nWP031 - Security Threat in Bluetooth LESC Pairing. 

[takashina hiroki]

Thank you for answering.

I will try to start with one of the existing SES projects.
Also, thanks for the information about the SDK vulnerability.
Can this vulnerability be eliminated with SDK 14.2.0?
Need to be SDK 15.0.0 or later to solve?

Please tell me.

[Vidar Berg]

Yes, you can fix this in SDK 14.2.0. Excerpt from the whitepaper:

nRF5 SDK versions prior to v15.0.0

Elliptic curve public keys were not validated for examples with Bluetooth LE Secure Connections in nRF5 SDK versions prior to v15.0.0.

Experimental APIs for cryptographic routines are provided in nRF5 SDK versions prior to v15.0.0. There are also examples showing Bluetooth LE Secure Connections using these experimental cryptographic APIs.

Implementations in nRF5 SDK versions prior to v15.0.0 use µECC to perform ECDH/DHKey generation in Bluetooth LE Secure Connections paring procedures. The implementations do not validate the remote Elliptic Curve Public Key as part of the pairing procedure, making it susceptible to the attacks described in Vulnerability Note VU#304725.

The following are possible solutions to mitigate security issues for using µECC in SDK versions prior to nRF5 SDK v15.0.0:

1. Migrate to nRF5 SDK v15.0.0 and use the nrf_crypto APIs and the ble_lesc module according to the SDK examples containing Bluetooth LE Secure Connections pairing procedures.
2. Add a specific call to the API to validate the elliptic curve public key received from the remote during the pairing procedure before using it to calculate the ECDH/DHKey. This API is called uECC_valid_public_key. Abort the pairing procedure if an invalid public key is detected by sending a random generated DHKey.

I also think it may be worth having a look at the BLE examples which has "non-experimental" support for LESC in SDK 15.3.0, ble_app_hrs for instance.  

[takashina hiroki]

Thank you for answering.

I'll give it a try.