BLE encryption with Zephyr

[Earthworn]

Hi,

I'm using nRF Connect SDK v1.7.1 with two nrf5430 DK. My goal is to evaluate the different security levels. For testing i send messages with the Nordic Uart service between those two boards. I used bt_conn_set_security() to increase the security level. This works fine and i can reach all 4 levels and the keys are distributed. Now my question is, if level 2, 3 or 4 is activated, does Zephyr automaticly encrypt the messages befor sending them or do i need to do this with bt_encrypt_le()  or bt_ccm_encrypt()  in my application? I thought bt_ccm_encrypt should be the right function because it uses AES-CCM which is defined in the BLE specification. But i can't find this function in any file. And what about security Mode 2 data signing. Is it enough to set CONFIG_BT_SIGNING or do i also have to implement bt_smp_sign() bevor calling the NUS send function? Through debugging I came to the result, that i have to implement it by myself but i  can not find any example where someone else did that. Did i miss something or am i on the right track?

Hope someone can clarify that for me.

[Edvin]

Hello,

That is correct. It is not the individual messages that are encrypted, but the entire connection. So if you encrypt the link/connection, then all messages are "automatically" encrypted. The reason you can't see where this encryption happens is because it is done in the Softdevice Controller (in the Link Layer), which is not open source.

I am not sure about the details, but perhaps the Softdevice Controller uses bt_ccm_encrypt(), or something similar, but I haven't seen the source code. 

Best regards,

Edvin