LESC JustWorks Sniffer Key

[JeffW]

Hello,

I'm using the peer_manager library with nrf_crypto CC310 backend to generate LESC keys for JustWorks. (BLE Security Mode 1 - Level 2)
I was wondering how to get a DEBUG key to put into my x240 BLE sniffer to de-encrypt the link from the analyzer's perspective.

Back in older SDK's there was a LESC_DEBUG_MODE, that would spit out the link key. I understand this functionality was removed to avoid accidentally going to production with debug keys.

However, I'm trying to find a way to edit the cc310 backend to try to get the debug key.

Any help would be appreciated,
Jeff

[run_ar]

Hi,

Did you try to retrieve the bonding keys using the pm_peer_data_bonding_load function?

[JeffW]

Thanks for the response.

I'm only pairing for LESC encrpytion without bonding.
Since there is no LTK exchanged, I'm trying to figure out which key (STK?) I need to find and output to decrypt the conversation. 

[run_ar]

Hi,

Why do you need to sniff the link with LESC enabled? In most cases I would recommend to just disabling this until you are done checking what you want to check using the sniffer. However, if you need to sniff the LESC part itself, you could follow the recommendations in this thread: https://devzone.nordicsemi.com/f/nordic-q-a/37078/lesc_debug_mode-define-in-ble_app_multirole_lesc-nrf5-sdk-15-0-0

[JeffW]

I want to sniff the link with LESC enabled to verify my security before going to market.

I had came across this post, but was unsure/unsuccessful porting this logic to the CC310 backend files instead of the Oberon Backend demonstrated. It is however the desired result I want to achieve.

[run_ar]

I think that instead of letting nrf_crypto_ecc_key_pair_generate make the keys, you just set it using the debug key as described in the post. Unfortunately I never got around to actually testing this. That's in nrf_ble_lesc_keypair_generate in SDK 17.0.2.