BLE encryption link

RE: BLE encryption link

Amanda Hsieh — Thu, 05 Sep 2019 12:44:59 GMT

Hi Abele,

Good to hear the success, and also thanks for sharing the experiences.

-Amanda H.

RE: BLE encryption link

abe — Thu, 05 Sep 2019 12:25:11 GMT

Hi Amanda,

Using the macro BLE_GAP_CONN_SEC_MODE_SET_ENC_NO_MITM on characteristic configuration, GATT write is enabled ONLY with pairing (unauthenticated encrypted link).
here my code:

static uint32_t custom_value_char_add(ble_cusi_t * p_cusi, const ble_cusi_init_t * p_cusi_init)
{
    uint32_t            err_code;
    ble_gatts_char_md_t char_md;
    ble_gatts_attr_md_t cccd_md;
    ble_gatts_attr_t    attr_char_value;
    ble_uuid_t          ble_uuid;
    ble_gatts_attr_md_t attr_md;

    // Add Custom Value characteristic
    memset(&cccd_md, 0, sizeof(cccd_md));

    //  write operation on cccd should not be possible without authentication.
    BLE_GAP_CONN_SEC_MODE_SET_OPEN(&cccd_md.read_perm);
    BLE_GAP_CONN_SEC_MODE_SET_ENC_NO_MITM(&cccd_md.write_perm);
    
    cccd_md.write_perm = p_cusi_init->custom_value_char_attr_md.write_perm;
    cccd_md.read_perm  = p_cusi_init->custom_value_char_attr_md.read_perm;
    cccd_md.vloc       = BLE_GATTS_VLOC_STACK;

    memset(&char_md, 0, sizeof(char_md));

    char_md.char_props.read   = 1;
    char_md.char_props.write  = 1;
    char_md.char_props.notify = 0; 
    char_md.p_char_user_desc  = NULL;
    char_md.p_char_pf         = NULL;
    char_md.p_user_desc_md    = NULL;
    char_md.p_cccd_md         = &cccd_md; 
    char_md.p_sccd_md         = NULL;

I reached may goal, thanks for your help.
Abele

RE: BLE encryption link

Amanda Hsieh — Tue, 03 Sep 2019 12:53:27 GMT

Hi Abele,

[quote user="Abele"]My goal is to enable data write ONLY if the device is paired. How can I make this? [/quote]

You can modify the "Properties" field in the Characteristic Declaration has changed to "Write". In this Bluetooth low energy Characteristics, a beginner's, Step 2.F section shows how to add read/write properties to our characteristic value. You can disable the write property part.

[quote user="Abele"]Further, using nRF Connect for Android phone, how can I perform "pairing"??[/quote]

The BLE stack automatically pops up an alert view to prompt the user to confirm or cancel the pairing process. You can try HID Keyboard Application on nrf52840 DK with an Android phone.

-Amanda H.

RE: BLE encryption link

abe — Tue, 03 Sep 2019 09:41:43 GMT

Hi Amanda,

I tried some test with the macro you quote me. I'm using nRF Conncet v3.1.0 for desktop to check the results.
Now I'm able to perform a "pairing" that result as "Unauthenticated encrypted link" (see image here below)
My goal is to enable data write ONLY if the device is paired. How can I make this?
Now only connection is enough to write data.
Further, using nRF Connect for Android phone, how can I perform "pairing"??

Many thanks for your help.
Regards

Abele

RE: BLE encryption link

abe — Fri, 23 Aug 2019 12:47:04 GMT

Ok Amanda, as soon as I can I will try to make changes on these macro and will report you the results.
Hear you next week
Thanks.
Abele

RE: BLE encryption link

Amanda Hsieh — Fri, 23 Aug 2019 12:36:35 GMT

Hi Abele,

If I understand correctly, you are asking:

What will happen if

BLE_GAP_CONN_SEC_MODE_SET_ENC_NO_MITM replaces BLE_GAP_CONN_SEC_MODE_SET_OPEN in the gap_params_init()

=> Set sec_mode pointed to by &sec_mode to require encryption, but no MITM protection. You might see this situation.

Modify the SEC_PARAM_MITM definition from 0 to 1 for peer_manager_init

=> Man In The Middle protection is required. You might see the case in the nRF5 SDK v15.3.0: Usage.

-Amanda H.

RE: BLE encryption link

abe — Fri, 23 Aug 2019 11:45:25 GMT

Thanks Amanda. I read the post you link above, but if I well understand explain hot to set encryption one single gatt characteristic at time.

I see peer_manager_init, with some Security parameters macro

/**@brief Function for the Peer Manager initialization.
 */
static void peer_manager_init(void)
{
    ble_gap_sec_params_t sec_param;
    ret_code_t           err_code;

    err_code = pm_init();
    APP_ERROR_CHECK(err_code);

    memset(&sec_param, 0, sizeof(ble_gap_sec_params_t));

    // Security parameters to be used for all security procedures.
    sec_param.bond           = SEC_PARAM_BOND;
    sec_param.mitm           = SEC_PARAM_MITM;
    sec_param.lesc           = SEC_PARAM_LESC;
    sec_param.keypress       = SEC_PARAM_KEYPRESS;
    sec_param.io_caps        = SEC_PARAM_IO_CAPABILITIES;
    sec_param.oob            = SEC_PARAM_OOB;
    sec_param.min_key_size   = SEC_PARAM_MIN_KEY_SIZE;
    sec_param.max_key_size   = SEC_PARAM_MAX_KEY_SIZE;
    sec_param.kdist_own.enc  = 1;
    sec_param.kdist_own.id   = 1;
    sec_param.kdist_peer.enc = 1;
    sec_param.kdist_peer.id  = 1;

    err_code = pm_sec_params_set(&sec_param);
    APP_ERROR_CHECK(err_code);

    err_code = pm_register(pm_evt_handler);
    APP_ERROR_CHECK(err_code);
}

and gap_params_init, where is used the macro BLE_GAP_CONN_SEC_MODE_SET_OPEN.

/**@brief Function for the GAP initialization.
 *
 * @details This function sets up all the necessary GAP (Generic Access Profile) parameters of the
 *          device including the device name, appearance, and the preferred connection parameters.
 */
static void gap_params_init(void)
{
    ret_code_t              err_code;
    ble_gap_conn_params_t   gap_conn_params;
    ble_gap_conn_sec_mode_t sec_mode;

    BLE_GAP_CONN_SEC_MODE_SET_OPEN(&sec_mode);

    err_code = sd_ble_gap_device_name_set(&sec_mode,
                                          (const uint8_t *)DEVICE_NAME,
                                          strlen(DEVICE_NAME));
    APP_ERROR_CHECK(err_code);

    /* YOUR_JOB: Use an appearance value matching the application's use case.
       err_code = sd_ble_gap_appearance_set(BLE_APPEARANCE_);
       APP_ERROR_CHECK(err_code); */

    memset(&gap_conn_params, 0, sizeof(gap_conn_params));

    gap_conn_params.min_conn_interval = MIN_CONN_INTERVAL;
    gap_conn_params.max_conn_interval = MAX_CONN_INTERVAL;
    gap_conn_params.slave_latency     = SLAVE_LATENCY;
    gap_conn_params.conn_sup_timeout  = CONN_SUP_TIMEOUT;

    err_code = sd_ble_gap_ppcp_set(&gap_conn_params);
    APP_ERROR_CHECK(err_code);
}

What happens if I change the macro inside this two functions?
For example, using in gap_params_init the macro BLE_GAP_CONN_SEC_MODE_SET_ENC_NO_MITM or in peer_manager_init changing the SEC_PARAM_MITM macro define 0 to 1?

Many thanks for your help

Abele

RE: BLE encryption link

Amanda Hsieh — Fri, 23 Aug 2019 10:54:55 GMT

Hi Abele,

You don't have to bond to get an encrypted link. You will get an encrypted link if you pair, but if you don't bond, you will have to pair every time you connect to get an encrypted link. Also, see my colleague explained in this post.

The Peer manager implements pairing and has a bond field in the security parameters that you pass when it is initialized. By setting that to 0 you indicate that bonding is not supported. With this change, pairing will take place as before, but there will be no bonding (storing of bonding information such as keys)

-Amanda H.

RE: BLE encryption link

abe — Thu, 22 Aug 2019 11:20:50 GMT

Hi,

If I have good understand, the encryption is performed only with bonding??
I'm developing a new board that have a BLE peripheral (starting from blinky example) and my goals is to encrypt the communication only with/during pairing, this custom project don't wish bonding.
There is any way to do encryption without bonding?
Abele

RE: BLE encryption link

Amanda Hsieh — Thu, 22 Aug 2019 10:59:52 GMT

Hi,

There are some examples in the SDK that uses encryption (bonding). You can take a look at the Bond Management Application example or Proximity Application example.

-Amanda H.