Cannot set bt_conn_set_security to BT_SECURITY_L4

[Xeenych]

I'm evaluating nRF52840 DK.

Currently running peripheral_lbs example.

I'm trying to set security level to BT_SECURITY_L4

static void connected(struct bt_conn *conn, uint8_t err)
{
	if (err) {
		printk("Connection failed (err %u)\n", err);
		return;
	}

	printk("Connected\n");

    int sec_result = bt_conn_set_security(conn, BT_SECURITY_L4);
    printk("Cannot set security level, err %d\n", sec_result);
          
	dk_set_led_on(CON_STATUS_LED);
}

I'm connecting to nRF52840DK with via smartphone nRFConnect app, then I enter pin code, but connection fails.

bt_conn_set_security returns 0 (SUCCESS)

These lines are output to console:

Passkey for d0:1d:c1:85:77:9b (random): 786779
[00:00:12.933,227] [1;31m<err> bt_hci_core: Failed to set required security level
[00:00:12.941,314] [1;31m<err> bt_conn: not connected
[00:00:12.946,960] [1;31m<err> bt_conn: not connected
Security changed: d0:1d:c1:85:77:9b (random) level 3
Disconnected (reason 22)

Setting security levels to BT_SECURITY_L2 or BT_SECURITY_L3 works.

[Vidar Berg]

So you want to require L4 for all devices? In that case, I would suggest you use the CONFIG_BT_SMP_SC_ONLY=y  setting, and then increase the security level on your BT characteristics to the same. I would also remove the bt_conn_set_security() from the connect event to allow the central to initiate the security request first.

[Xeenych]

I've set CONFIG_BT_SMP_SC_ONLY=y  

My smartphone (Galaxy J1, BLE 4.1 only) successfully pairs with DevKit but security level is set to L1.

[Vidar Berg]

Did you make sure to erase the existing bond from the device and phone before you tried this again? 

[Xeenych]

Checked this again. Yes, I am sure.

[Vidar Berg]

Assuming there may be other changes in your project, could you please try to repeat this test again with the original example, but with CONFIG_BT_SMP_SC_ONLY=y. Because pairing is always rejected (as expected) when I try to replicate it here.