LESC Numeric Comparison pairing with DISPLAY_YESNO capabilities on peripheral

[Andrea p]

Hello everyone,

I tried reading around the devzone and the infocenter, but I still didn't manage to solve my question.

In my scenario I'm using:

• an nRF52832 as a peripheral to allow users to pair to the nordic
• peer_manager to handle pairing and bonding
• UART to transmit data to another UART device which has a display capabilities and two buttons, that will be used as Yes/No.
• SoftDevice 6.1.1

The pairing capabilities are DISPLAY_YESNO on the nrf52, and need to be DISPLAY_YESNO or KEYBOARD_DISPLAY on the central side to require the Numeric Comparison capabilities.

Question 1:

Do you confirm that BLE_GAP_CONN_SEC_MODE_SET_LESC_ENC_WITH_MITM(&sec_mode); will set the nrf52832 to accept only bonding requests that can satisfy the Numeric Comparison security capabilities?

Question 2:

How can I tell the SoftDevice if it should proceed with pairing? In other words: how can I tell the  Yes/No answer to the SoftDevice?

The procedure I'm adopting is:

1.  Pairing request incoming: Peer manager handles SEC_PARAMS_REQUEST event and answers with SEC_PARAMS_REPLY
2. I get the passkey via the BLE_GAP_EVT_PASSKEY_DISPLAY
3.  I send the passkey to the UART and I wait for the YES/NO (How can I tell if I need to answer yes/no, or if the user on their side will input the passkey I'm showing on the display?)
4. If I had to answer Yes/No, I need to tell the softdevice to continue with pairing? Do I need to send, if correct, sd_ble_gap_auth_key_reply(BLE_GAP_AUTH_KEY_TYPE_PASSKEY,NULL)  or, if failed, sd_ble_gap_auth_key_reply(BLE_GAP_AUTH_KEY_TYPE_NONE,NULL) ?

Thanks in advance,

Andrea

[Hung Bui]

Hi Andrea, 

1. You would need to set SEC_PARAM_MITM  = 1 as well. It's set inside peer_manager_init(). But it's not only Nummeric Comparison but also Passkey and Out of band is allowed. Both of them has higher security protection than Nummeric though. 

2. Please follow the message sequence chart here. The ble_app_multirole_lesc example is a good reference source. 

[BAI]

Using the numeric comparison method for pairing, can a static passkey be used?

[Emil Lenngren]

No. The six digit value shown at both devices is a cryptographic hash of the exchanged public keys and some random numbers unique for every pairing attempt. The six digit value will thus be new for every attempt. The user needs to confirm that the numbers are equal on both devices, which indicates that no MITM has tampered with the public keys.