Modify pre shared OOB key for Legacy Connection

[Beldramma]

Hi !

I am working on SDK 15.2 and on a NRF52832.

The others devices I will interact with are on BLE 4, so I can use only Legacy Connection mode for security. 

I would like to use Out of Band mode, with a pre shared key stored on my device. The other device, a BLE Gateway, will have a file with this key stored too. 

First, I would like to know if there are examples to do that. 

Second, i would like to know if it is possible to modify the value of the key and keep its value even if we switch off the device. 

Thanks,

[Beldramma]

Another question : about the sd_ble_gap_sec_params_reply function, when I call it in the BLE_GAP_EVT_SEC_PARAMS_REQUEST event, I don't really understand how to fill the last parameter, sec_keyset.

What is own ? what is peer ?

How do i fill enc_key ? Have I to do it ?

sames questions for id_key, and sign_key.

[Kenneth]

Basically what is done here is that you provide a buffer to the softdevice. This buffer is filled with keys  by the softdevice when the BLE_GAP_EVT_AUTH_STATUS even occurs.

https://infocenter.nordicsemi.com/topic/com.nordic.infocenter.s132.api.v7.2.0/group___b_l_e___g_a_p___p_e_r_i_p_h___b_o_n_d_i_n_g___p_k___c_e_n_t_r_a_l___o_o_b___m_s_c.html 

I strongly recommend using peer manager to handle this for you.

[Beldramma]

Yeah, but in the parameters, it is written that this is a In/out parameter, so I can fill it before calling the function. But with what ?

Kenneth said:

I strongly recommend using peer manager to handle this for you.

Ok, but I need to know if we don't bond, is it possible to handle the security without the peer_manager, with handling only the BLE_GAP_EVT_SEC_PARAMS_REQUEST event and BLE_GAP_EVT_AUTH_KEY_REQUEST event ? I am asking that because in my program ( not in the hrs examples), i have still the problem about the ram address.

And another question :

With my security parameters, so :

• Legacy connection
• No bonding
• Pairing with OOB with keys stored on the central and the peripheral

Which security parameter do I have to choose to secure my attributes :

SEC_JUST_WORKS or SEC_MITM ? or another ?

I am asking that because, it seems to  me that I have to use the SEC_MITM security, but when I do that, I cannot receive the notifications with the hrs example. But it seems also to me that the SEC_JUST_WORKS security don't use the OOB.

[Sreejith Sundh]

Hi Kenneth,

Kenneth said:

It is possible to use pre-shared OOB keys yes. I made an example for nRF5 SDK v13 that show this, in principle it should be the same for more recent nRF5 SDK also. You will need to handle the BLE_GAP_EVT_AUTH_KEY_REQUEST in on_ble_evt() on both the central and peripheral device. 

I have implemented the same OOB Legacy Pairing with preshared key as you mentioned here. But the OOB key with Zero (as shown in below) only works

static ble_advdata_tk_value_t m_oob_auth_key = {
.tk = { 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00}
};

Feed key 00000000000000000000000000000000

but when I try it with numbers other than zero it is not working....Could you please suggest any solution here, why this happening like this..?

Thanks and Regards,

Sreejith

[Kenneth]

Are you controlling both sides of the link? E.g. have you updated the project to use preshared keys on both peripheral and central? Maybe check that SDK v13 example works before you try to update one of the sides to a newer SDK.

Kenneth