How to initiate BLE pairing manually

RE: How to initiate BLE pairing manually

Vidar Berg — Fri, 06 May 2022 13:19:32 GMT

The MIC failures occur because the sniffer does not have the encryption key to decrypt the payload. To be able to sniff LESC pairing you need to enable the debug DH keys: https://developer.nordicsemi.com/nRF_Connect_SDK/doc/1.9.1/kconfig/CONFIG_BT_USE_DEBUG_KEYS.html

RE: How to initiate BLE pairing manually

ealtan — Thu, 05 May 2022 22:11:51 GMT

I was using one Nordic nRF52840-DK in Peripheral mode and the other unit was another nRF52840-based module DK from another company. So, I switched to two Nordic DKs and connection problems went away, so that's good. But pairing failures are still here, so I've put Nordic nRF52840 dongle with Wireshark capture in between.

It seems like all is going well till when Slave responds with LL_START_ENC_REQ and then I see all packets that are not empty PDU having "Encrypted packet decrypted incorrectly (bad MIC) " error.

Any idea why these bad MIC errors might be happening ?

RE: How to initiate BLE pairing manually

Vidar Berg — Fri, 29 Apr 2022 15:24:09 GMT

I don't think there is much you can do in FW to improve chances for a connection attempt to succeed except for increasing the Radio's TX output power ( example ). Default is 0 dBm and radio is supporting up to +8 dBm. But I'm surprised you don't see this with the other board. Maybe the other board automatically repeats the connection attempt if it fails the first time? A Bluetooth sniffer trace may help show what the problem is.

You are still using 2 Nordic DKs for this test?

RE: How to initiate BLE pairing manually

ealtan — Fri, 29 Apr 2022 14:56:19 GMT

Yes, it is possible, however, I repeat the test with another MCU vendor and I don't have these connection and pairing issues. So, my question is, what can I change to create a more robust connection and pairing operation ? For example, is there more info on these parameters ? How do they affect connections ? :

/** Connection parameters for LE connections */

struct bt_le_conn_param {

uint16_t interval_min;

uint16_t interval_max;

uint16_t latency;

uint16_t timeout;

};

.options = (_options), \

.interval = (_interval), \

.window = (_window), \

.interval_coded = 0, \

.window_coded = 0, \

.timeout = 0, \

RE: How to initiate BLE pairing manually

Vidar Berg — Fri, 29 Apr 2022 12:22:50 GMT

Hi,

Could it be the environment you are testing this in? BT_HCI_ERR_CONN_FAIL_TO_ESTABLISH will happen from time to time. It means the peripheral did not respond to the connect request (only one request is sent per connect attempt) and that the central have to retry. It is normal for this error to happen from time time, but it can also occur quite frequently if there is lots of noise or interference from other nearby sources, for instance, active scanning from other BLE devices.

RE: How to initiate BLE pairing manually

ealtan — Thu, 28 Apr 2022 12:17:34 GMT

Thank you, I did that, but overall pairing seems to be very unreliable. Many times it fails with unspecified reason.

But before that getting into details with pairing, connections have been pretty undeterministic, too. I have a Central which issues a connect to a Peripheral, many times Central comes back with disconnected callback with reason BT_HCI_ERR_CONN_FAIL_TO_ESTAB. So, do you have any recommendations to make connections more reliable ? Any parameters to tweak ? Why would it keep disconnecting with BT_HCI_ERR_CONN_FAIL_TO_ESTAB reason ?

RE: How to initiate BLE pairing manually

Vidar Berg — Wed, 27 Apr 2022 06:53:40 GMT

I see. In that case you can add CONFIG_BT_BONDABLE=n to your project, or call bt_set_bondable('false') on startup.

RE: How to initiate BLE pairing manually

ealtan — Tue, 26 Apr 2022 21:21:52 GMT

[quote userid="4240" url="~/f/nordic-q-a/86794/how-to-initiate-ble-pairing-manually/364605#364605"]The other connections will be secured with the encryption key that was exchanged during pairing.[/quote]

Is that because these two devices are bonded ? I don't want them to be bonded, I want to trigger and restart pairing process every time . Is there a way of doing this ?

RE: How to initiate BLE pairing manually

Vidar Berg — Mon, 25 Apr 2022 07:29:06 GMT

Thanks for the clarification and sorry for delayed response. The reason you are not getting the pairing_complete callback on the subsequent connections is that the pairing procedure is only performed in the first connection. The other connections will be secured with the encryption key that was exchanged during pairing.

You can register the "security changed" callback if you want to monitor when the link becomes secured in both cases (i.e. after pairing or encryption with existing keys):

https://developer.nordicsemi.com/nRF_Connect_SDK/doc/1.9.1/zephyr/reference/bluetooth/connection_mgmt.html#c.bt_conn_cb.security_changed

Here is how the callback is used in our central uart sample for reference: https://github.com/nrfconnect/sdk-nrf/blob/7848293244a0904cb401f13f420bf610d7aa8e91/samples/bluetooth/central_uart/src/main.c#L425

RE: How to initiate BLE pairing manually

ealtan — Thu, 21 Apr 2022 03:17:55 GMT

Thank you, Vidar, just one clarification, I initiate pairing from Central to Peripheral. By using bt_conn_set_security() I can upgrade the security level and that causes pairing_complete callback to be called. So, that's good, thank you.

But I have a new issue. I have a test suite that I'm running in a loop : Central connects to a Peripheral, Central initiates pairing, pairing successfully completes, Central does some characteristics read/write and then disconnects. This process is run in a loop. My problem is, after the first run, pairing never completes, ie I never see pairing_complete callback being called. So I'm guessing that I need to do something else to clear old pairing info. Any idea how I can do that ?

Many thanks,

RE: How to initiate BLE pairing manually

Vidar Berg — Mon, 11 Apr 2022 11:49:12 GMT

Hello,

It is generally recommended to let the central initiate the pairing request, or at least, give it a chance to send it first. From the "Accessory Design
Guidelines for Apple Devices" document:

40.10 Pairing
The accessory should not request pairing until an ATT request is rejected using the Insufficient
Authentication error code. See the Bluetooth 4.0 specification, Volume 3, Part F, Section 4 for details.

If, for security reasons, the accessory requires a bonded relationship with the Central, the Peripheral
should reject the ATT request using the Insufficient Authentication error code, as appropriate. As a
result, the device may proceed with the necessary security procedures.

Similarly, if the device acts as a Central and a GATT server, it may reject an ATT request using the
Insufficient Authentication error code. The accessory should initiate the security procedure for pairing
in response.

Pairing may require user authorization depending on device. Once an accessory is paired with a device,
it shall retain the distributed keys of both central and peripheral for future use. If the pairing is no longer
required, the accessory shall delete both sets of keys.

The Insufficient Authentication error code is returned when the GATT client tries to read a characteristic that has the security level set to a level that requires authentication. The user will automatically get a pairing popup if they use iOS.

Characteristic read and write permissions (i.e. security level) is configured when you initialize the service. Like here for the HIDS service: https://github.com/nrfconnect/sdk-nrf/blob/35f91d3151abfaddf60d826ed87c91cfa81773a5/subsys/bluetooth/services/hids.c#L751

But to answer your question, it should be possible to issue a security request from the peripheral by calling the bt_conn_set_security() function, or by enabling the CONFIG_BT_GATT_AUTO_SEC_REQ option.

Best regards,

Vidar