INVALID PARAMS when migrating to security mode 1 level 4

RE: INVALID PARAMS when migrating to security mode 1 level 4

Amanda Hsieh — Fri, 11 Dec 2020 10:17:12 GMT

Hi Bloq,

Good question. It is certainly not how it should be used. I do not see how this would be better than just works. If only the iOS has input or output device, then this does not give you any benefit. There is no way to know if you have connected to the device you intend to or an attacker.

So this just gives an illusion of security, but that is all. It is better to use just works then in my opinion.

-Amanda H.

RE: INVALID PARAMS when migrating to security mode 1 level 4

Bloq — Thu, 10 Dec 2020 14:03:06 GMT

Thank you both for the helpful responses. I have proceeded with two implementations. They are as follows, both WITH BONDING:

1: LESC With MITM Using Numeric Comparison (mode 1 level 4) : The only adjustment that I made was automatically accepting the numeric comparison on the peripheral side because of a lack of buttons or display. I know this is sort of cheating but we are still accepting the pairing on the IOS side. So only half cheating. How does this effect the level of security and allow for MITM attacks? Is this any safer than implementation 2?

2: LESC with JUST WORKS (mode 1 level 2) : This is basically what we will use if your answers to my questions above are level 2 security.

Lastly, with bonding, MITM attacks can only occur if the attacker is present during pairing. How would this attack work if we use implementation 1 with the half numeric comparison authentication.

Thanks in advanced,

Bloq

RE: INVALID PARAMS when migrating to security mode 1 level 4

Dmitry — Wed, 09 Dec 2020 09:31:57 GMT

Hi,

as Amanda has pointed out, your link is considered as SM1 level 2 - if you would like to keep these settings, you shouldn't pass a secutity mode parameter (ble_gap_conn_sec_mode_t) higher than sm=1,lv=2 to any softdevice function.

RE: INVALID PARAMS when migrating to security mode 1 level 4

Amanda Hsieh — Wed, 09 Dec 2020 07:44:51 GMT

Hi Bloq,

If it's done using just work mode, the level of security is considered level 2. You should use MITM to get to level 4 and that is when the lesc bit can be 1.

Also, check out some links put in this thread:

https://devzone.nordicsemi.com/f/nordic-q-a/49674/le-secure-connections-when-there-is-no-io-capability/198279#198279

-Amanda H.

RE: INVALID PARAMS when migrating to security mode 1 level 4

Bloq — Tue, 08 Dec 2020 14:44:10 GMT

Thank you very much for your response Amanda,

I would like to clarify that I am working with the nRF52840-DK. We would like to use ECDH and bonding under security level mode 1 level 4 with "Just Works". Can you please clarify if this is possible to achieve.

Thank you for your help,

-Bloq

RE: INVALID PARAMS when migrating to security mode 1 level 4

Amanda Hsieh — Tue, 08 Dec 2020 12:35:50 GMT

Hi Bloq,

No, the setting is the LESC with Just Work, the security level will be considered Mode 1 level 2. See this post.

If you use MITM to get to level 4 and that is when the lesc bit can be 1. See Glucose Application.

[quote user=""]I get [NRF ERROR INVALID PARAM] errors when adding my second service and even when trying to sd_ble_gap_device_name_set.[/quote]

You have to debug and find out which function returns the error. Are you able to provide the debug log?

Which SDK and DK are you using?

-Amanda H.