Peer manager and LESC possibilities

[sijohans]

Hello,

I am looking into the peer manager and the LESC module and have some question regarding what is possible to do with this.

1. Is it possible to manage the private key to use for also other purposes on application level (e.g. signing)
   
   1. It looks like the key pair needs to be generated every time the device restarts. Is this always the intended use case, or would it be possible to use a static key?
2. Is it possible to retrieve the public key of the connected peer. I can only see that OOB data can be retrieved (ble_gap_lesc_oob_data_t). Depending on who have connected, they might have different rights on application level depending on this.
   1. Further, is it possible to whitelist specific public keys that may authenticate with the device?

I am quite new to the peer manager and the LESC module. Am i getting this wrong, or is this key intended to be an ephemeral key only?

[Amanda Hsieh]

Hi, 

In the LESC, the Public key and private key of each device have to be randomly generated according to the Elliptic Curve Diffie-Hellman (ECDH) rules. In our SDK this is done by calling nrf_crypto_ecc_key_pair_generate() which will use the micro-ECC module to generate the key pair.

Note though that static passkey in combination with LESC is not any more secure than LESC "just works". The protocol is designed for a random passkey and breaks totally if a passkey is reused. See this post Questions about LESC, MITM and passkey. 

The key is intended to encrypt the connection. If you want to limit the connection authentication, you can consider bonding. See this post.

See the Peripheral LESC Pairing and Central LESC Pairing. 

-Amanda H.