Ensuring 16 Byte of entropy in Security Mode 1v4

Question

Hello, 
 I'm currently trying to implement a setup of BLE devices (nRF52 DK and nRF52840 DK) which is potentially secure against the KNOB attack (and also other attacks) and uses the full 16 bytes of entropy for the encryption. I've found this thread https://devzone.nordicsemi.com/f/nordic-q-a/54566/knob-attack-for-ble-nrf52840 which mentions that the attack is not applicable due to the min key length of 7 bytes (I guess this is also the same for the nRF52832) but that's still too low for my setup. Of course, I could set the min key length to 16 bytes for both devices, but I just want to use the full key length for specific services. According to 
 https://bluetooth.service-now.com/ess/knowledge.do? sysparm_document_key=kb_knowledge,3995cd29db7b3f007d6c808768961931 
 I could use Legacy Pairing which doesn't seem to be the best choice if it comes to different attacks such as passive eavesdropping. Therefore, I want to use the LE Security Mode 1v4 to ensure a 128-bit strength encryption key (Spec 5.1 p. 2186) which apparently is satisfied if I use a pairing procedure using either Numeric Comparison or Passkey Entry with Secure Connection. In the paper eprint.iacr.org/.../933.pdf on page 11 it is specifically mentioned that "even if a device using security mode 1 with level 4, the LTK's entropy can still be downgraded to 7 bytes". Am I missing something or this a bug of the tested devices? Is it possible to downgrade the nRF52840 or nRF52832 to use 7 bytes of entropy in Security Mode 1v4? 
 Best regards, 
 Tobias

bjorn-spockeli · Accepted Answer

HI Tobias, 
 setting the security_req_t for reading or writing to characteristic value to SEC_MITM, will set the security level to mode 1 level 3 
 Lets take the Battery Level Characteristic as an example. In bas_init() we see that 
 // Require LESC with MITM (Numeric Comparison)
 bas_init_struct.bl_cccd_wr_sec = SEC_MITM;
 bas_init_struct.bl_report_rd_sec = SEC_MITM; 
 and that the characteristic is added by calling battery_level_char_add(), which in turn calls characteristic_add(), which in turn calls set_security_req(). 
 static inline void set_security_req(security_req_t level, ble_gap_conn_sec_mode_t * p_perm)
{
 BLE_GAP_CONN_SEC_MODE_SET_NO_ACCESS(p_perm);
 switch (level)
 {
 case SEC_NO_ACCESS:
 BLE_GAP_CONN_SEC_MODE_SET_NO_ACCESS(p_perm);
 break;
 case SEC_OPEN:
 BLE_GAP_CONN_SEC_MODE_SET_OPEN(p_perm);
 break;
 case SEC_JUST_WORKS:
 BLE_GAP_CONN_SEC_MODE_SET_ENC_NO_MITM(p_perm);
 break;
 case SEC_MITM:
 BLE_GAP_CONN_SEC_MODE_SET_ENC_WITH_MITM(p_perm);
 break;
 case SEC_SIGNED:
 BLE_GAP_CONN_SEC_MODE_SET_SIGNED_NO_MITM(p_perm);
 break;
 case SEC_SIGNED_MITM:
 BLE_GAP_CONN_SEC_MODE_SET_SIGNED_WITH_MITM(p_perm);
 break;
 }
 return;
}
 
 The macros used in expands to the following: 
 /**@defgroup BLE_GAP_CONN_SEC_MODE_SET_MACROS GAP attribute security requirement setters
 *
 * See @ref ble_gap_conn_sec_mode_t.
 * @{ */
/**@brief Set sec_mode pointed to by ptr to have no access rights.*/
#define BLE_GAP_CONN_SEC_MODE_SET_NO_ACCESS(ptr) do {(ptr)->sm = 0; (ptr)->lv = 0;} while(0)
/**@brief Set sec_mode pointed to by ptr to require no protection, open link.*/
#define BLE_GAP_CONN_SEC_MODE_SET_OPEN(ptr) do {(ptr)->sm = 1; (ptr)->lv = 1;} while(0)
/**@brief Set sec_mode pointed to by ptr to require encryption, but no MITM protection.*/
#define BLE_GAP_CONN_SEC_MODE_SET_ENC_NO_MITM(ptr) do {(ptr)->sm = 1; (ptr)->lv = 2;} while(0)
/**@brief Set sec_mode pointed to by ptr to require encryption and MITM protection.*/
#define BLE_GAP_CONN_SEC_MODE_SET_ENC_WITH_MITM(ptr) do {(ptr)->sm = 1; (ptr)->lv = 3;} while(0)
/**@brief Set sec_mode pointed to by ptr to require LESC encryption and MITM protection.*/
#define BLE_GAP_CONN_SEC_MODE_SET_LESC_ENC_WITH_MITM(ptr) do {(ptr)->sm = 1; (ptr)->lv = 4;} while(0)
/**@brief Set sec_mode pointed to by ptr to require signing or encryption, no MITM protection needed.*/
#define BLE_GAP_CONN_SEC_MODE_SET_SIGNED_NO_MITM(ptr) do {(ptr)->sm = 2; (ptr)->lv = 1;} while(0)
/**@brief Set sec_mode pointed to by ptr to require signing or encryption with MITM protection.*/
#define BLE_GAP_CONN_SEC_MODE_SET_SIGNED_WITH_MITM(ptr) do {(ptr)->sm = 2; (ptr)->lv = 2;} while(0)
/**@} */ 
 So if you want the security of a characteristic set to mode 1 level 4, then you need to set the security_req_t to SEC_SIGNED 
 Best regards 
 Bjørn

Ensuring 16 Byte of entropy in Security Mode 1v4

Top Replies