Encryption problem using nRF52840 sniffing BLE air-log on wireshark

[ryuu-k]

I'm using dongle nRF52840 to sniff packets between earphone & iPhone.

I am facing the same problem: "Encrypted packet decrypted incorrectly (bad MIC)"

just after LL_ENC_REQ -> LL_ENC_RSP -> LL_START_ENC_REQ

I found that in No.16672(Sent Pairing REQ), Secure Connection Flag is True,

and Encryption Key (LTK) is True.

However, in No.16672(Sent Pairing RSP), the Encryption Key(LTK) is False.

Is this possible to sniff the encryption key in secure connection? in order to decrypt the payload.....

Please Help.

[Kenneth]

Are you using the latest nRF sniffer:
https://www.nordicsemi.com/Products/Development-tools/nRF-Sniffer-for-Bluetooth-LE

Have you followed the "LE secure connections in debug mode":
https://infocenter.nordicsemi.com/topic/ug_sniffer_ble/UG/sniffer_ble/action_paired.html

Kenneth

[ryuu-k]

I am using the latest one, nRF52840 Dongle and followed the "LE secure connections in debug mode".

Should I input any key in like SC LTK?

I got the link key which is generated when the earphone and iPhone are bonded, which is in length 0x10 (LINK_KEY_UNAUTHEN).

The BLE packets I want to sniff is those between the app and the earphone. 

[Kenneth]

Do you have access to the firmware of the earhphone? You will need to set the earphone in a LESC debug mode, in Nordic this is typically done by:

#define LESC_DEBUG_MODE 1 /**< Set to 1 to use LESC debug keys, allows you to use a sniffer to inspect traffic. */

[ryuu-k]

Thanks for the reply.

And I will let you know whether it works after I tried the method.