Secure connect when event PM_EVT_BONDED_PEER_CONNECTED

[Mikhail]

nRF52832, SDK15, s132

When I have event PM_EVT_BONDED_PEER_CONNECTED, should I call

pm_conn_secure(p_evt->conn_handle, false);

for secure connection? Or it secure connect will call automaticly from SD? Because after event  

PM_EVT_BONDED_PEER_CONNECTED 

I get automaticly PM_EVT_CONN_SEC_SUCCEEDED

Or this

pm_conn_secure(p_evt->conn_handle, false);

needs only for bonding?

[Einar Thorsrud]

Hi,

Someone needs to initiate encryption of the link, but if you are making a peripheral and have already bonded, the central will typically do this. The rest is not handled by the SoftDevice itself, but it is handled for you. Specifically, the SoftDevice will send the application a BLE_GAP_EVT_SEC_INFO_REQUEST (see MSC), and it is taken care of in the peer manager function sec_info_request_process() (security_dispatcher.c).

[Mikhail]

Hi! Thanks.

I have situation:

when after work in HID mode I (peripherial) get event  PM_EVT_BONDED_PEER_CONNECTED and send request for secure connect to smartphone (google pixel 2) will reject bond pair from smartphone. When I didn't send request after PM_EVT_BONDED_PEER_CONNECTED, I get also in RTT debugger event that secure connection established and pair from smartphone not deleted.

Why softdevice nrf sended secure request? 

[Einar Thorsrud]

Hi,

Mikhail said:

Why softdevice nrf sended secure request? 

Bonds are handled by the application, and the SoftDevice will never request security by itself. Either it was requested by your application (including the Peer manager library), or it was requested by the peer. Do you have a sniffer trace showing what is going on on the link?

[Mikhail]

Hi!

I have sniffer, but now I see that secure connection make always from central side. If I (nrf52) central, I should make secure connect on the my (central) side. If I peripherial , i shouldn't make secure connect and central side make it itself. 

Therefore I suppose that secure connection should initialize central side. Is it true?

[Einar Thorsrud]

Hi,

Yes. The central always decide if the link should be encrypted, but the peripheral can also request it (and the central should normally accept it).