nrF52840 is not decrypting packets when using LE secure connections with passkey entry and debug keys

[Eric Larson]

I followed all the steps that are documented. Below is a screen capture of WireShark. 

/resized-image/__size/320x240/__key/communityserver-discussions-components-files/4/pastedimage1632853085483v1.png

One device is the Central which generates a passkey that's scrolled across its screen. The other device is a peripheral that's linked by a iOS device to transfer the key. The setup has been tested and works on a Ellisys analyzer. So what am I missing? thanks.

notDecrypting.pcapng

[Kenneth]

It looks like lesc is not actually used here, since the central have the lesc flag set to false.

So in this case you need to input the legacy passkey as described in the User Guide: "For connections that use legacy pairing with a passkey".

Kenneth

[Eric Larson]

Hi Kenneth,

Thanks for the reply. 

Where in the capture are you seeing the lesc flag?

Is it the highlighted line in the attached screenshot?

/resized-image/__size/320x240/__key/communityserver-discussions-components-files/4/pastedimage1632945676071v1.png

You are right that worked!

Eric

[Eric Larson]

Sorry, I don't think I sent the right capture. Please see attached. Thanks.notDecrypting_3.pcapng

[Kenneth]

And you can confirm this new log is still decrypted by Ellisys? Just to confirm that the debug keys are used.

Kenneth

[Eric Larson]

The only difference is the connection flag is changed from NONE to ALLOW. Both modes are using the debug keys (cc2640 TI stack) and the passkey which is hardcoded to 123456.

[Kenneth]

Hi, before I start asking the team I need you to confirm that the notDecrypting_3.pcapng log is decoded correctly in Ellisys, since this confirm that the debug keys are applied. Can you do that?

Also, please confirm that one of the peers are Nordic device.

Thanks,
Kenneth

[Eric Larson]

EllisysDecrypted.btt

Here is the original Ellisys file. You can view by downloading their app. At the time of this scan the Peripheral which is controlled by our integration partner had the debug keys turned on. I have spent countless hours at trying to figure out why the Nordic sniffer wouldn't work. I tried every configuration possible and the only thing that I found works is turning off security and using legacy passcode. I can't afford to spend anymore time trying to prove to you that this product isn't working. 

I currently am working with the TI cc2640 on both the peripheral and central devices. We do have a Nordic radio that's slated for development with the same integration partner for an alternative offering. 

Best regards,

Eric Larson

[Kenneth]

I will pass you sniffer logs to the team to get their feedback. 

Kenneth

[Kenneth]

From the logs the ellisys capture has the peripheral using the Debug keys.

In notDecrypting_3.pcapng none of the devices are using the debug key. The data of the L2CAP fragment start should look like: 41 00 06 00 0c e6 9d 35 .....

You should do the ellisys and nrf sniffer in parallell, to ensure that you are comparing apples and apples.

Best regards,
Kenneth

[Eric Larson]

Now it's working. When you pointed out that the notDecrypting_3.pcapng wasn't using the debug keys I went back to the TI stack and checked were the keys are enabled. The default setting for the triggering the key use needs to be set to TRUE when in SC_HOST_DEBUG mode. I've documented for anyone who may have similar problem.

Thanks for your patience with me in helping me solve this problem.