Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

Simonr — Wed, 24 Feb 2021 12:41:57 GMT

Hi Antoine

No, not forgotten, but I assumed you were content with the replies from Thomas and David here.

From our expert: "As far as I know the only OOB supported in Android is over NFC, for providing PIN/passcode, you'll need to use a different pairing method. The nRFConnect app just prints events from the system, so if it receives state BONDED, that means the system finished bonding, but perhaps some lower security with OOB requirements fail. The PAIRING_VARIANT_CONSENT should mean that the user needs to accept the pairing process, so it seems like the Android device is waiting for that from the other side".

Best regards,

Simon

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

Beldramma — Wed, 24 Feb 2021 08:26:32 GMT

Hi Simon, have you forgotten me ? :P

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

daviddedwin — Fri, 12 Feb 2021 17:02:05 GMT

I thought it would be possible to pair to the android phone using NFC without involving the createBondOutOfBand( ) function, so the NFC and the Android OS should get paired without the intervention from the App.
Directly calling createBondOutOfBand( ) from the app may not work. Has android 9 lost this capability as well ?? That would be odd.

Tap NFC -> Get the Pairing dialog on Android -> Tap yes and that should trigger the pairing sequence with the device.

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

Tom_H — Thu, 11 Feb 2021 15:22:29 GMT

I came across the same problem and I think the issue is raleted to the Android API. The Android API function creatBondOutOfBand() has a private scope and private API functions cannot be called with reflections since Android version 9 (see this Link). It should work on older devices as aspected.

Best regards,

Thomas

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

Simonr — Mon, 18 Jan 2021 13:45:39 GMT

Hi Antoine

The Android expert has not come back to me as of yet, I have pinged them again. I'll update you as soon as they get back to me. Very sorry about the delay.

Thank you for confirming this issue is not only in the nRFConnect app. I will forward this info to our expert as well.

Best regards,

Simon

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

Beldramma — Mon, 18 Jan 2021 11:15:34 GMT

Btw Simonr, have you discussed with your Android Expert ?

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

Beldramma — Mon, 18 Jan 2021 11:13:06 GMT

Ok, so just for tests, i have added the discoverable flag and the appearance in my advertising frame. So i could connect with my device without NRF connect, but same problem. My phone asks me if i want to pair, i accept and that's it, no notification to enter the oob key.

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

Simonr — Mon, 18 Jan 2021 07:01:25 GMT

[quote user="Beldramma"]Maybe the reason is because I have not put any flags in my advertising frame[/quote]

That seems likely. The phone OS'es (Android and iOS) won't "detect" devices that don't add the general discoverable flag and/or include appearance in the advertising_init() function like below:

init.advdata.include_appearance = true;

Best regards,

Simon

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

Beldramma — Fri, 15 Jan 2021 09:59:04 GMT

[quote userid="84049" url="~/f/nordic-q-a/70383/pair-device-with-legacy-connection-oob-preshared-key-using-android-nrf-connect/289166#289166"]You can also try to get the development working with JUSTWORKS/PASSKEY and then focus on the OOB issue after that so that there are no other issues complicating the development.[/quote]

For now, i deactivate the security part to test others parts.

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

Beldramma — Fri, 15 Jan 2021 09:57:08 GMT

Hi Simonr,

[quote userid="75734" url="~/f/nordic-q-a/70383/pair-device-with-legacy-connection-oob-preshared-key-using-android-nrf-connect/289347#289347"]That depends on what kind of device is advertising. The Bluetooth settings will be able to find some advertising devices, like HID devices, headphones, heart rate measurers, etc. So it depends on what your device advertises as, while the nRFConnect app has no filter by default, and will show any device advertising over BLE.[/quote]

I have changed the GAP appearance, but my device is not detected. Maybe the reason is because I have not put any flags in my advertising frame. I have removed them because in my case the data in Manufacturer data and the one from the Name already reach 31 bytes, the maximum Advertising length.

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

Simonr — Fri, 15 Jan 2021 08:35:24 GMT

[quote user="Beldramma"]is it normal that i can see my device with NRF COnnect but not with the Bluetooth Common Settings[/quote]

That depends on what kind of device is advertising. The Bluetooth settings will be able to find some advertising devices, like HID devices, headphones, heart rate measurers, etc. So it depends on what your device advertises as, while the nRFConnect app has no filter by default, and will show any device advertising over BLE.

Best regards,

Simon

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

daviddedwin — Thu, 14 Jan 2021 11:34:43 GMT

nRF Connect Desktop on the PC is Nordicsemi controlled software infrastructure so all the BLE capability should be available for development and test, however BLE apps on Android will have to use the Android Bluetooth API and its restrictions.
You can also try to get the development working with JUSTWORKS/PASSKEY and then focus on the OOB issue after that so that there are no other issues complicating the development.

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

Beldramma — Thu, 14 Jan 2021 11:21:15 GMT

Hi Simonr, is it normal that i can see my device with NRF COnnect but not with the Bluetooth Common Settings ? Is there something missing in my code ?

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

Beldramma — Thu, 14 Jan 2021 11:17:32 GMT

Hi daviddedwin,

[quote userid="84049" url="~/f/nordic-q-a/70383/pair-device-with-legacy-connection-oob-preshared-key-using-android-nrf-connect/289153#289153"]I thought that the Android OOB was accessible only over NFC. I also suspect that the Android OOB API is a private API in Android which complicates things a bit (not 100% sure but this was what I remember).
Adding NFC is a possible solution, will that work for you ?[/quote]

Pairing mode with OOB without NFC works with NRF Connect Desktop, so I am not sure that it is the problem.

When i did the researches to choose the security process ( Just Works, OOB, Passkey), it seemed to me that we can implement OOB without NFC.

By the way, the board is already made, we cannot add NFC inside.

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

daviddedwin — Thu, 14 Jan 2021 11:10:49 GMT

I thought that the Android OOB was accessible only over NFC. I also suspect that the Android OOB API is a private API in Android which complicates things a bit (not 100% sure but this was what I remember).
Adding NFC is a possible solution, will that work for you ?

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

Beldramma — Thu, 14 Jan 2021 10:52:39 GMT

Hi Simonr,

[quote userid="75734" url="~/f/nordic-q-a/70383/pair-device-with-legacy-connection-oob-preshared-key-using-android-nrf-connect/289126#289126"]Yes, try to connect to your device without using nRFConnect. If you go into the settings on the phone, you should have a "Bluetooth menu" where you can scan for, connect, and pair to Bluetooth devices.[/quote]

With my phone, when i scan Bluetooth devices without NRF Connect, I don't see my BLE device.

[quote userid="75734" url="~/f/nordic-q-a/70383/pair-device-with-legacy-connection-oob-preshared-key-using-android-nrf-connect/289126#289126"]The three dots next to the DEBUG tab in the nRFConnect app for Android should have a "share" or "copy to clipboard" button function depending on the nRFConnect version.[/quote]

Ok, here is the logs

nRF Connect, 2021-01-14
123456789ab (D7:6A:98:57:39:7F)
V 11:48:43.051 Connecting to D7:6A:98:57:39:7F...
D 11:48:43.051 gatt = device.connectGatt(autoConnect = false, TRANSPORT_LE, preferred PHY = LE 1M)
D 11:48:50.565 [Callback] Connection state changed with status: 0 and new state: CONNECTED (2)
I 11:48:50.565 Connected to D7:6A:98:57:39:7F
D 11:48:50.567 [Broadcast] Action received: android.bluetooth.device.action.ACL_CONNECTED
V 11:48:50.651 Discovering services...
D 11:48:50.651 gatt.discoverServices()
D 11:48:50.689 [Broadcast] Action received: android.bluetooth.device.action.BOND_STATE_CHANGED, bond state changed to: BOND_BONDING (11)
D 11:48:50.722 [Broadcast] Action received: android.bluetooth.device.action.PAIRING_REQUEST, pairing variant: PAIRING_VARIANT_CONSENT (3)
I 11:48:51.188 Connection parameters updated (interval: 7.5ms, latency: 0, timeout: 5000ms)
D 11:48:52.498 [Callback] Services discovered with status: 0
I 11:48:52.498 Services discovered
V 11:48:52.659 Generic Access (0x1800)
... 
I 11:48:52.677 Connection parameters updated (interval: 45.0ms, latency: 0, timeout: 5000ms)
D 11:48:54.475 [Broadcast] Action received: android.bluetooth.device.action.PAIRING_REQUEST, pairing variant: PAIRING_VARIANT_CONSENT (3)
I 11:48:56.672 Connection parameters updated (interval: 75.0ms, latency: 0, timeout: 4000ms)
D 11:48:57.496 [Broadcast] Action received: android.bluetooth.device.action.BOND_STATE_CHANGED, bond state changed to: BOND_BONDED (12)
I 11:48:57.496 Device bonded
V 11:49:37.379 Reading characteristic 00002a29-0000-1000-8000-00805f9b34fb
D 11:49:37.379 gatt.readCharacteristic(00002a29-0000-1000-8000-00805f9b34fb)
E 11:49:38.395 Error 137 (0x89): GATT AUTH FAIL

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

Simonr — Thu, 14 Jan 2021 10:20:44 GMT

Hi Antoine

Yes, try to connect to your device without using nRFConnect. If you go into the settings on the phone, you should have a "Bluetooth menu" where you can scan for, connect, and pair to Bluetooth devices.

The three dots next to the DEBUG tab in the nRFConnect app for Android should have a "share" or "copy to clipboard" button function depending on the nRFConnect version.

If you have an extra nRF51 or nRF52 Development Kit/Dongle you can use the nRF Sniffer for BLE to take a sniffer trace of the connection.

Best regards,

Simon

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

Beldramma — Wed, 13 Jan 2021 15:58:46 GMT

[quote userid="75734" url="~/f/nordic-q-a/70383/pair-device-with-legacy-connection-oob-preshared-key-using-android-nrf-connect/288940#288940"]In the meantime, can you try connecting and pairing in the standard Bluetooth settings on the phone in order to see if you get prompted with a passkey window that way? You can also try to set SEC_PARAM_BOND =1 in your security parameters to enable bonding and see if that makes a difference (this is somewhat of a shot in the dark though).[/quote]

I am not sure to understand what you mean by "standard Bluetooth settings on the phone"... Do you mean trying to connect to my device without using NRF Connect ?

Also, when i carried out these tests, the Bonding mode was enabled, so i had these parameters :

sec_param.bond = true;
sec_param.kdist_own.enc = 1;
sec_param.kdist_own.id = 1;
sec_param.kdist_peer.enc = 1;
sec_param.kdist_peer.id = 1;

[quote userid="75734" url="~/f/nordic-q-a/70383/pair-device-with-legacy-connection-oob-preshared-key-using-android-nrf-connect/288940#288940"]It would also be great if you could export and upload the full log from Android, and if possible, take a sniffer trace so we can get a more detailed look at what exactly is going on in the connection.[/quote]

Where can I finf the full log ? About the sniffer, for now i don't have one.

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

Simonr — Wed, 13 Jan 2021 13:36:24 GMT

The Android app should provide a prompt for entering the passkey/OOB key after pressing the "Bond" button in the app, but for some reason that doesn't seem to happen in this case. Our Android expert will be back in office next week so we might have to wait for them to get back to get to the bottom of this.

In the meantime, can you try connecting and pairing in the standard Bluetooth settings on the phone in order to see if you get prompted with a passkey window that way? You can also try to set SEC_PARAM_BOND =1 in your security parameters to enable bonding and see if that makes a difference (this is somewhat of a shot in the dark though).

It would also be great if you could export and upload the full log from Android, and if possible, take a sniffer trace so we can get a more detailed look at what exactly is going on in the connection.

Best regards,

Simon

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

Beldramma — Wed, 13 Jan 2021 10:46:44 GMT

[quote userid="75734" url="~/f/nordic-q-a/70383/pair-device-with-legacy-connection-oob-preshared-key-using-android-nrf-connect/288811#288811"]Can you provide the log you see in the Android nRFConnect app when you try bonding to the peripheral? We should be able to see an error code of some kind I think. Also, what Android device are you using when seeing this issue?[/quote]

Here are the logs :

I have removed the logs about the services discovered.

So it seems that the bonding succeeded, but the Android app haven't asked me the Key, and after I have tried to read my characteristic and it failed, of course because my characteristic is protected and no pairing key was asked.

My Android phone is an Oppo A5 with Android 10 version (Android Q) and Oppo custom version ColorOS 7.1

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

Beldramma — Wed, 13 Jan 2021 10:24:25 GMT

Hi Simonr,

[quote userid="75734" url="~/f/nordic-q-a/70383/pair-device-with-legacy-connection-oob-preshared-key-using-android-nrf-connect/288811#288811"]Please also provide some information of how the pairing is done in your application.[/quote]

The pairing is done like that :

So i have enabled these parameters in sdk_config file :

PEER_MANAGER_ENABLED 1, FDS_ENABLED 1 and NRF_FSTORAGE_ENABLED 1.

Here is the peer_manager_init and its handler :

/**@brief Function for handling Peer Manager events.
 *
 * @param[in] p_evt  Peer Manager event.
 */
static void pm_evt_handler(pm_evt_t const * p_evt)
{
    pm_handler_on_pm_evt(p_evt);
    pm_handler_disconnect_on_sec_failure(p_evt);
    pm_handler_flash_clean(p_evt);

    switch (p_evt->evt_id)
    {
        case PM_EVT_PEERS_DELETE_SUCCEEDED:
        {
            advertising_start();
        }
        break;

        default:
        {
            //Others events are handled by the peer manager
        }
        break;
    }
}

/**@brief Function for the Peer Manager initialization.
 */
static void peer_manager_init(void)
{
    ble_gap_sec_params_t sec_param;
    ret_code_t           err_code;

    err_code = pm_init();
    APP_ERROR_CHECK(err_code);

    memset(&sec_param, 0, sizeof(ble_gap_sec_params_t));

    // Security parameters to be used for all security procedures.
    sec_param.bond           = SEC_PARAM_BOND;
    sec_param.mitm           = SEC_PARAM_MITM;
    sec_param.lesc           = SEC_PARAM_LESC;
    sec_param.keypress       = SEC_PARAM_KEYPRESS;
    sec_param.io_caps        = SEC_PARAM_IO_CAPABILITIES;
    sec_param.oob            = SEC_PARAM_OOB;
    sec_param.min_key_size   = SEC_PARAM_MIN_KEY_SIZE;
    sec_param.max_key_size   = SEC_PARAM_MAX_KEY_SIZE;
    sec_param.kdist_own.enc  = 0; //no long term key
    sec_param.kdist_own.id   = 0; // no resolvable address irk
    sec_param.kdist_peer.enc = 0; //no long term key
    sec_param.kdist_peer.id  = 0; // no resolvable address irk

    err_code = pm_sec_params_set(&sec_param);
    APP_ERROR_CHECK(err_code);

    err_code = pm_register(pm_evt_handler);
    APP_ERROR_CHECK(err_code);
}

Here are the Peer manager parameters :

/* ----Security parameters for Peer Manager--------- */
#define SEC_PARAM_BOND                  0                                       /**< No perform bonding. */
#define SEC_PARAM_MITM                  1                                       /**< Man In The Middle protection required for OOB to work */
#define SEC_PARAM_LESC                  0                                       /**< LE Secure Connections not enabled. */
#define SEC_PARAM_KEYPRESS              0                                       /**< Keypress notifications not enabled. */
#define SEC_PARAM_IO_CAPABILITIES       BLE_GAP_IO_CAPS_NONE                    /**< No I/O capabilities. */
#define SEC_PARAM_OOB                   1                                       /**< Out Of Band data available. */ //AKR
#define SEC_PARAM_MIN_KEY_SIZE          7                                       /**< Minimum encryption key size. */
#define SEC_PARAM_MAX_KEY_SIZE          16                                      /**< Maximum encryption key size. */

The key is shared when the BLE_GAP_EVT_AUTH_KEY_REQUEST event occurs :

        // Upon authentication key request, reply with the preshared key in the device.
        case BLE_GAP_EVT_AUTH_KEY_REQUEST:
        {

            NRF_LOG_INFO("BLE_GAP_EVT_AUTH_KEY_REQUEST");

            //Need to obtain the pre shared key sending a request to the host
            /*
            *
            *
            */

            err_code = sd_ble_gap_auth_key_reply(p_ble_evt->evt.gatts_evt.conn_handle,
                                                 BLE_GAP_AUTH_KEY_TYPE_OOB,
                                                 key_auth);
            APP_ERROR_CHECK(err_code);
        }

When i switch in bonding mode i change these parameters :

sec_param.bond = true;
sec_param.kdist_own.enc = 1;
sec_param.kdist_own.id = 1;
sec_param.kdist_peer.enc = 1;
sec_param.kdist_peer.id = 1;

RE: Pair Device with Legacy Connection OOB preshared key, using Android NRF connect

Simonr — Wed, 13 Jan 2021 07:17:10 GMT

Can you provide the log you see in the Android nRFConnect app when you try bonding to the peripheral? We should be able to see an error code of some kind I think. Also, what Android device are you using when seeing this issue?

Please also provide some information of how the pairing is done in your application.

Best regards,

Simon