RE: Methods for Bluetooth mesh secure provisioning, and can it be done using the serial interface?

Hung Bui — Tue, 10 Sep 2019 13:37:19 GMT

Hi Pilli,

My understanding is that there must be at least one real (non static) OOB method of exchanging data is used. Either it's in the ECDH calculation (Public key exchange) or in the authorization phase where the Input/Output/static OOB is used.

If you use static OOB, you must not transfer the public key openly (via Bluetooth). The static OOB data can be compromised if the attacker has access to device (read the flash). So if the OOB key is sent over Bluetooth, the attacker can act as Man in the middle (MITM)

You can use serial to get the public keys. The protocol on how to send them is on your own. When you receive it you would need to wait for NRF_MESH_PROV_EVT_OOB_PUBKEY_REQUEST event, and then reply with nrf_mesh_prov_pubkey_provide()

If you want to do output/input OOB, you would need to wait for NRF_MESH_PROV_EVT_OUTPUT_REQUEST then display it or NRF_MESH_PROV_EVT_INPUT_REQUEST then reply with nrf_mesh_prov_auth_data_provide.

You can find an example of doing output OOB in our demo here, check out the my_mesh_provisionee.c file .