nrF52840 is not decrypting packets when using LE secure connections with passkey entry and debug keys

RE: nrF52840 is not decrypting packets when using LE secure connections with passkey entry and debug keys

Eric Larson — Thu, 07 Oct 2021 12:56:41 GMT

Now it's working. When you pointed out that the notDecrypting_3.pcapng wasn't using the debug keys I went back to the TI stack and checked were the keys are enabled. The default setting for the triggering the key use needs to be set to TRUE when in SC_HOST_DEBUG mode. I've documented for anyone who may have similar problem.

Thanks for your patience with me in helping me solve this problem.

RE: nrF52840 is not decrypting packets when using LE secure connections with passkey entry and debug keys

Kenneth — Wed, 06 Oct 2021 12:44:20 GMT

From the logs the ellisys capture has the peripheral using the Debug keys.

In notDecrypting_3.pcapng none of the devices are using the debug key. The data of the L2CAP fragment start should look like: 41 00 06 00 0c e6 9d 35 .....

You should do the ellisys and nrf sniffer in parallell, to ensure that you are comparing apples and apples.

Best regards,
Kenneth

RE: nrF52840 is not decrypting packets when using LE secure connections with passkey entry and debug keys

Kenneth — Tue, 05 Oct 2021 14:01:00 GMT

I will pass you sniffer logs to the team to get their feedback.

Kenneth

RE: nrF52840 is not decrypting packets when using LE secure connections with passkey entry and debug keys

Eric Larson — Tue, 05 Oct 2021 13:47:45 GMT

devzone.nordicsemi.com/.../EllisysDecrypted.btt

Here is the original Ellisys file. You can view by downloading their app. At the time of this scan the Peripheral which is controlled by our integration partner had the debug keys turned on. I have spent countless hours at trying to figure out why the Nordic sniffer wouldn't work. I tried every configuration possible and the only thing that I found works is turning off security and using legacy passcode. I can't afford to spend anymore time trying to prove to you that this product isn't working.

I currently am working with the TI cc2640 on both the peripheral and central devices. We do have a Nordic radio that's slated for development with the same integration partner for an alternative offering.

Best regards,

Eric Larson

RE: nrF52840 is not decrypting packets when using LE secure connections with passkey entry and debug keys

Kenneth — Tue, 05 Oct 2021 13:21:34 GMT

Hi, before I start asking the team I need you to confirm that the notDecrypting_3.pcapng log is decoded correctly in Ellisys, since this confirm that the debug keys are applied. Can you do that?

Also, please confirm that one of the peers are Nordic device.

Thanks,
Kenneth

RE: nrF52840 is not decrypting packets when using LE secure connections with passkey entry and debug keys

Eric Larson — Tue, 05 Oct 2021 11:33:38 GMT

The only difference is the connection flag is changed from NONE to ALLOW. Both modes are using the debug keys (cc2640 TI stack) and the passkey which is hardcoded to 123456.

RE: nrF52840 is not decrypting packets when using LE secure connections with passkey entry and debug keys

Kenneth — Tue, 05 Oct 2021 07:47:28 GMT

And you can confirm this new log is still decrypted by Ellisys? Just to confirm that the debug keys are used.

Kenneth

RE: nrF52840 is not decrypting packets when using LE secure connections with passkey entry and debug keys

Eric Larson — Mon, 04 Oct 2021 12:06:37 GMT

Sorry, I don't think I sent the right capture. Please see attached. Thanks.devzone.nordicsemi.com/.../notDecrypting_5F00_3.pcapng

RE: nrF52840 is not decrypting packets when using LE secure connections with passkey entry and debug keys

Kenneth — Mon, 04 Oct 2021 08:33:41 GMT

It seems to be decrypted here?

RE: nrF52840 is not decrypting packets when using LE secure connections with passkey entry and debug keys

Eric Larson — Thu, 30 Sep 2021 19:42:05 GMT

devzone.nordicsemi.com/.../notDecrypting_5F00_2.pcapng

Working on this a little more I found I was able to get the Secure Connection Flag to set to true after I increased the MAX_PDU_SIZE from 50 to 69. I was thinking at the time I might have a heap problem.

At this point I am back to not being able to decrypt the packets any more.

RE: nrF52840 is not decrypting packets when using LE secure connections with passkey entry and debug keys

Kenneth — Thu, 30 Sep 2021 07:43:35 GMT

For some reason you picture is really small, so difficult to see what you show, but you can see in this picture that the Secure Connection Flag: False:

RE: nrF52840 is not decrypting packets when using LE secure connections with passkey entry and debug keys

Eric Larson — Wed, 29 Sep 2021 19:49:10 GMT

Hi Kenneth,

Thanks for the reply.

Where in the capture are you seeing the lesc flag?

Is it the highlighted line in the attached screenshot?

/resized-image/__size/320x240/__key/communityserver-discussions-components-files/4/pastedimage1632945676071v1.png

You are right that worked!

Eric

RE: nrF52840 is not decrypting packets when using LE secure connections with passkey entry and debug keys

Kenneth — Wed, 29 Sep 2021 19:41:36 GMT

It looks like lesc is not actually used here, since the central have the lesc flag set to false.

So in this case you need to input the legacy passkey as described in the User Guide: "For connections that use legacy pairing with a passkey".

Kenneth