Connecting a device with a bonding key and a device without a bonding key

[takashina hiroki]

SDK: 15.3.0
Example: ble_app_multirole_lesc
DeviceA: EYSHJNZWZ (nRF52832)
DeviceB: Smartphone (iPhone)

DeviceA has a bonding key.
DeviceB does not have a bonding key.
When DeviceA and DeviceB try to connect, a security error occurs.
At that time, DeviceA can detect security anomalies.
However, DeviceB cannot detect security anomalies.
What can be the cause of this?
Are there any countermeasures?

[Amanda Hsieh]

Hi, 

When DeviceA and DeviceB try to connect, a security error occurs.

Could you provide the log or the error message?

-Amanda H 

[takashina hiroki]

The DeviceA log is shown below.

<info> app: [r_ble_event] BLE_GAP_EVT_CONNECTED
<info> app: [r_bp_on_evt_connected] Peripheral connection
<info> app: [r_bs_pm_evt_handler] PM_EVT_CONN_SEC_PARAMS_REQ : bond=0, mitm=0, lesc=0, keypress=0, io_caps=0x0
<info> app: [r_bs_pm_evt_handler] PM_EVT_CONN_SEC_PARAMS_REQ : oob=0, min_key_size=0x4, max_key_size=0x0, kdist_own=0x20, kdist_peer=0x81
<info> app: [e_gatt_evt_handler] gatt event
<info> app: [r_gatt_event] NRF_BLE_GATT_EVT_ATT_MTU_UPDATED
<info> app: [r_gatt_event] 	central : 30, peripheral : 30
<info> app: [r_ble_event] BLE_GATTC_EVT_EXCHANGE_MTU_RSP
<info> app: [r_ble_on_evt_gattc_exchange_mtu_rsp] server_rx_mtu : 30
<info> app: [e_gatt_evt_handler] gatt event
<info> app: [r_gatt_event] NRF_BLE_GATT_EVT_DATA_LENGTH_UPDATED
<info> app: [r_gatt_event] 	conn_handle : 0x2, data_length : 34
<info> app: [r_ble_event] BLE_GAP_OPT_AUTH_PAYLOAD_TIMEOUT
<info> app: [r_ble_event] BLE_GAP_EVT_PHY_UPDATE_REQUEST
<info> app: [r_ble_on_evt_phy_update_req] tx_phys=3, rx_phys=3
<info> app: [r_ble_on_evt_phy_update_req] phy update start
<info> app: [r_ble_event] BLE_GAP_EVT_PHY_UPDATE
<info> app: [r_ble_on_evt_phy_update] status=0x0, tx_phy=2, rx_phy=2
<info> app: [r_bs_pm_evt_handler_device] PM_EVT_CONN_SEC_START : procedure=0x0
<info> peer_manager_handler: Connection security failed: role: Peripheral, conn_handle: 0x2, procedure: Encryption, error: 4102
<warning> peer_manager_handler: Disconnecting conn_handle 2.
<info> app: [r_bs_pm_evt_handler_device] PM_EVT_CONN_SEC_FAILED : error_src=0x0, error=0x1006, procedure=0x0
<info> app: [r_ble_event] BLE_GAP_EVT_SEC_INFO_REQUEST
<info> app: [r_bs_on_evt_sec_info_req] enc_info=1, id_info=0, sign_info=0
<info> app: [r_ble_event] BLE_GAP_EVT_PASSKEY_DISPLAY
<info> app: [r_bs_on_evt_passkey_display_main] passkey=°/Opu match_req=1
<info> app: [r_bs_on_evt_passkey_display_main] Passkey display request
<info> app: [e_bp_adv_handler] BLE_ADV_EVT_FAST
<info> app: [r_ble_event] BLE_GAP_EVT_DISCONNECTED
<info> app: [r_bp_on_evt_disconnected_main] p_disconnected->reason : 0x16

[Amanda Hsieh]

Hi, 

Disconnect reason 0x16 means BLE_HCI_LOCAL_HOST_TERMINATED_CONNECTION. 

Error 4102 is the same as PM_CONN_SEC_ERROR_PIN_OR_KEY_MISSING. It means that encryption failed because the peripheral has lost the LTK for this bond. As indicated in this post, try to remove the bond on both sides of the link, and bond again.

-Amanda H.

 

[takashina hiroki]

I understand the cause of this anomaly and how to deal with it.

The problem now is that DeviceB cannot detect security anomalies.
I want to know the cause and countermeasures.

[Amanda Hsieh]

Hi, 

If you follow the instructions in the LE Secure Connections Multirole Example page to test nRF connect,

Verify that the passkey in nRF Connect and the passkey logged on UART are identical.

You would get the detail from the nRF Connect UART log.  

-Amanda H.