Pairing with qr code for passkey, production managament with crc and bootloader

[Olfox]

Hi,

My product have no keyboard or display , no nfc too. We want a paring procedure to not let open the connexion to everybody not paired first.

My idea was to use a fixed passkey into the code, and print into a qr code this passkey and mac adress. Our smartphone app will use this two parametres to scan and list only the product with concerned mac adress and then establish a paired connexion with the passkey, previously got by scanning the qr code.

My software also use secure bootloader to do DFU (s113 + ble_app_buttonless_dfu_ + secure_booloader_s113_pca10100) , nrf52833.

My questions is : 

1. Where to find this passkey into the code to set it ?

2. In production, i will have to personnalise this passkey into each product, making a different .hex with a specific crc to be able to boot i guess. Fastest way will be to build to get the good crc and flash only the memory adresse with good crc and passkey. Is it the good way to proceed ?

3. If it is, may be we need some script to first change the passkey into the source code, then build application , and finally program the device with nrfconnect command ? It seems to be quiet heavy but may be the unic solution?

4. in case of update of the firmware with dfu once customers has bought the product, does it means we will have to generate a unic zip for each product sales ? What is just impossible. So finally i dont't really see how to proceed a part of placing the passykey somewhere into the memory that is independant of crc check, what i don't think possible.

I didn't found easiest way to do something quiet simple in fact. This seems to be a typical case for BLE products , no?

Thanks a lot for your help, there is so many questions...  

[Hung Bui]

Hi Florian, 

1. If you look for "static passkey" in devzone you should be able to find many example code for that, for example this: https://devzone.nordicsemi.com/f/nordic-q-a/15030/how-to-set-a-static-passkey-on-nrf52832-pca10040

2. You can think of using the device ID in the FICR as the passkey. It can be consider unique to each device. The passkey has only 1 mil possibilities anyway. 

3. If you use device ID in  FICR you don't need to change the code for each device. But you need to read the FICR of each of the device to print the QR code later on. 

4. If you use Device ID you don't need to do modify the firmware for each device. 

[Olfox]

It is ok it works.

On first connexion, i'm able to type the 6digit pincode extract from the 6 lsb of DEVICE_ID0. 

But i have a strange effect. Once first phone paired it works fine. Then i pair a second phone, it works too. But when i try to connect the first phone, i get an error mesage on Android sayong " Association refused by myNrfDevice" where my Nrf device is my nrf52833.

Is it possible to have two paired device or more ?

Also when i try to dis associate on android side and then try to do the association process with pin code again, i have the same message ans i get this error on my nrf console:

<info> peer_manager_handler: Connection security failed: role: Peripheral, conn_handle: 0x0, procedure: Bonding, error: 133

I need to "Erase all" with SES to clean the nrf and then i can try again. It seems to be linked to the softdevice may be that keep in memory the second private key or something like this may be.

[Hung Bui]

Hi Florian, 
It could be related to the feature that blocking an already bonded phone to bond again (allow_repairing). 
Please have a look at this case: https://devzone.nordicsemi.com/f/nordic-q-a/37837/sdk15-paring-problem

But this doesn't explain why you couldn't connect the first phone after you bond with 2nd phone. You may want to check the log on the nRF52 device. Also maybe capture a sniffer trace. 

[Olfox]

Hi Hung,

Yes you are right, i realised there no link with the fact to pair a seconf phone, it was just link to the fact to delete bounded nrf in android that cause the issue. 

I also had a "bug" that if you try to connect with nrfconnect app, the pop up windows to enter key is shown, but only with a Yes or Cancel button. If you click on Yes or Cancel the window disappear and if you are fast enough when you click on the servcie that has been list behind, it works and you are connected without re entered the passkey . Surprising :D 

But ok i will try this, thanks for the link it is really helpfull !

Concerning sniffer, i have two nrf52833 dev kit ( pca10100) i can use one for this purpose no problem. But this board seems to not be supported in the list.