No input and output capabilities, possible security

[chinargor]

Hi BLE Developers,

I'm developing a BLE peripheral device using S110 softdevice which doesn't have any input or output capabilities and will communicate with smartphone. Just works pairing method doesn't satisfy for my project requirements. I don't want to use white list as well. (MITM protection) I read in other forums that OOB pairing method doesn't supported for many central devices.

I'm thinking about to use static key in peripheral side and confirmation of that static key in a central side. Is it possible? If no, can you please give me advise how can I protect my device from MITM ?

Thanks in advance for your help, and looking forward to your answers.

[chinargor]

@Hung Bui: Thank you very much for your help.

I still cannot compile the example you gave me.

Currently I'm using (Keil5.14 version), (s110_nrf51822_7.0.0 softdevice), (nrf51_SDK_7.0.1 SDK) and (nrf51_SDK_7.0.1_packs packs).

I tried ble_app_hrs example project to set a static passkey. I have added and modified the following lines.

define STATIC_PASSKEY "123456"
define SEC_PARAM_MITM 1
define SEC_PARAM_IO_CAPABILITIES BLE_GAP_IO_CAPS_DISPLAY_ONLY

static ble_opt_t m_static_pin_option;

In the end of the gap_params_init() function I added the following lines.

// Add static pin:

uint8_t passkey[] = STATIC_PASSKEY;
m_static_pin_option.gap.passkey.p_passkey = passkey;
err_code =  sd_ble_opt_set(BLE_GAP_OPT_PASSKEY, &m_static_pin_option);
APP_ERROR_CHECK(err_code);

Than I'm trying to connect to my smartphone, it connects without asking a static passkey.

Can you please help me and tell me where I'm worong?

[Hung Bui]

@Chinargor: Which issue do you have when compiling the github example ? Please be noted that the SDK was made with SDK v6.1 and you should copy the example to Board/pca10001/s110/experimental/ folder. I tested here and it worked fine.

[chinargor]

@Hung Bui: Thanks a lot for your help, I was able to compile and run it on Nordic Evaluation board. For static passkey we are setting that the peripheral device has output capabilities (display), but in my case the final product wouldn't have any output capabilities. I wonder, is it a violation of the Bluetooth LE specification or no?

[Hung Bui]

@Chinargor: As long as you have a way to display or tell the user on the peer device the passkey, you are not violating the Bluetooth spec. In your case it could be the sticker with the code on the device, or the code in the userguide of the device.

[chinargor]

Thanks a lot for your help. Your advices were really helpful for me.

[Hung Bui]

@Chinargor: I'm happy to help. Could you mark the question as correct and we can close the case ?