Cannot set bt_conn_set_security to BT_SECURITY_L4

[Xeenych]

I'm evaluating nRF52840 DK.

Currently running peripheral_lbs example.

I'm trying to set security level to BT_SECURITY_L4

static void connected(struct bt_conn *conn, uint8_t err)
{
	if (err) {
		printk("Connection failed (err %u)\n", err);
		return;
	}

	printk("Connected\n");

    int sec_result = bt_conn_set_security(conn, BT_SECURITY_L4);
    printk("Cannot set security level, err %d\n", sec_result);
          
	dk_set_led_on(CON_STATUS_LED);
}

I'm connecting to nRF52840DK with via smartphone nRFConnect app, then I enter pin code, but connection fails.

bt_conn_set_security returns 0 (SUCCESS)

These lines are output to console:

Passkey for d0:1d:c1:85:77:9b (random): 786779
[00:00:12.933,227] [1;31m<err> bt_hci_core: Failed to set required security level
[00:00:12.941,314] [1;31m<err> bt_conn: not connected
[00:00:12.946,960] [1;31m<err> bt_conn: not connected
Security changed: d0:1d:c1:85:77:9b (random) level 3
Disconnected (reason 22)

Setting security levels to BT_SECURITY_L2 or BT_SECURITY_L3 works.

[Vidar Berg]

Hi,

I got level 4 with peripheral_lbs example in NCS 1.4.1. Is it possible that you phone may not be supporting LESC pairing and only legacy pairing? LESC is required to reach level 4. If you are not sure, you could capture a sniffer trace (nRF Sniffer for Bluetooth LE) to confirm whether it is supported or not.

Connected
Passkey for 4d:92:d5:4b:82:2a (random): 792560
Security changed: 4d:92:d5:4b:82:2a (random) level 4
Pairing completed: 6c:dd:bc:29:d8:8e (public), bonded: 1

Best regards,

Vidar

[Xeenych]

Looks like that is sthe case. I have Samsung Galaxy J2, whis has only bluetooth 4.1

I tried with another android phone and it connected succesfully,

Then, there is another question:

The "secuirity_changed" callback, which is called. Then immediately "disconnected" callback.

But callbacks from "bt_conn_auth_cb" are not executed.

Shouldn't the bt_conn_auth_cb.cancel or bt_conn_auth_cb.pairing_failed callbacks be executed?

[Vidar Berg]

It looks like the authentication callback is not invoked because the link is terminated first. Assume it works if you remove the call to bt_conn_set_security() on connection?

[Xeenych]

Yes it is, but on default BT_SECURITY_L1 (L2-L3) aslo work

[Vidar Berg]

So you want to require L4 for all devices? In that case, I would suggest you use the CONFIG_BT_SMP_SC_ONLY=y  setting, and then increase the security level on your BT characteristics to the same. I would also remove the bt_conn_set_security() from the connect event to allow the central to initiate the security request first.

[Xeenych]

I've set CONFIG_BT_SMP_SC_ONLY=y  

My smartphone (Galaxy J1, BLE 4.1 only) successfully pairs with DevKit but security level is set to L1.

[Vidar Berg]

Did you make sure to erase the existing bond from the device and phone before you tried this again?