Disable Bonding and allow only pairing

[Daniel]

Hi,

Is there a way to disable bonding?  I am having issues when I delete the paired device from my phone. After I delete the pairing, nordic still has the stored keys for the same phone. 

I want to disable bonding and let the user know bonding is not supported. Is there a way to do this?  I still want to have an authenticated secure link.

[Turbo J]

Daniel said:

I still want to have an authenticated secure link.

That REQUIRES bonding. Sounds like a "wash me, but don't make me wet" question.

Note that there are other mthods to solve the "phone forgot the bt keys" aka man-in-the-middle attack problem, depending whether your device has buttons or how secure you want the connection to be.

[Kenneth]

You can allow repairing, though typically this is not recommended to do by default, since it is considered a security issue to allow repairing without some user interaction:

// This event handler is in main.c

static void pm_evt_handler(pm_evt_t const * p_evt)
{
    pm_handler_on_pm_evt(p_evt);
    pm_handler_flash_clean(p_evt);

    switch (p_evt->evt_id)
    {
...
...
...
        
        case PM_EVT_CONN_SEC_CONFIG_REQ:
        {
            // Allow pairing request from an already bonded peer.
            pm_conn_sec_config_t conn_sec_config = {.allow_repairing = true};
            pm_conn_sec_config_reply(p_evt->conn_handle, &conn_sec_config);
        } break;

        default:
            break;
    }
}

[Daniel]

Hi, 

I don't have any button on my ble peripheral. When I used nrf-connect , it allows pairing without bonding.

How does it do this? 

[Daniel]

What is the security issue here?  

User will have to enter passkey for pairing.

[Turbo J]

On a device without any buttons?

Daniel said:

I don't have any button on my ble peripheral.

Note: Buttonless devices do not allow MITM security. The only exception would use something like NFC for key exchange.