How to enable encrypted link in nRF52832 firmware?

RE: How to enable encrypted link in nRF52832 firmware?

Edvin — Fri, 22 Jul 2022 07:00:49 GMT

[quote user="Edvin Holmseth"]

in SDK17.1.0, you can see how the ble_app_hrs example calls pm_conn_secure() in the BLE_GAP_EVT_CONNECTED event in ble_evt_handler() in main.c.

[/quote]

RE: How to enable encrypted link in nRF52832 firmware?

snowuyl — Fri, 22 Jul 2022 02:28:18 GMT

devzone.nordicsemi.com/.../8204.security.c devzone.nordicsemi.com/.../4503.gap.h devzone.nordicsemi.com/.../6622.gap.c

RE: How to enable encrypted link in nRF52832 firmware?

snowuyl — Fri, 22 Jul 2022 02:26:28 GMT

RE: How to enable encrypted link in nRF52832 firmware?

snowuyl — Fri, 22 Jul 2022 02:25:50 GMT

Besides, I have implemented static passkey and ble_evt_handler() as follows. From log message, "Connection secured" is printed. And nRF connect shows "authenticated encrypted link". Do I still need to call pm_conn_secure() in ble_evt_handler()?

static void ble_evt_handler(ble_evt_t const* pBleEvt, void* pContext)
{
    ret_code_t errCode = NRF_SUCCESS;

    switch (pBleEvt->header.evt_id)
    {
        case BLE_GAP_EVT_CONNECTED:
        {
            NRF_LOG_INFO("Connected.");
            BLE_UART_SetState(BLE_NUS_STATE_CONNECT);
            errCode = bsp_indication_set(BSP_INDICATE_CONNECTED);
            if (errCode != NRF_SUCCESS) {
                NRF_LOG_WARNING("bsp_indication_set() failed, errCode=0x%x\n", errCode);
                return;
            }

            m_cur_conn_handle = pBleEvt->evt.gap_evt.conn_handle;

            errCode = nrf_ble_qwr_conn_handle_assign(&m_qwr, m_cur_conn_handle);
            if (errCode != NRF_SUCCESS) {
                NRF_LOG_WARNING("nrf_ble_qwr_conn_handle_assign() failed, errCode=0x%x\n", errCode);
                return;
            }

#if PASSKEY_ENABLED
            ble_gap_sec_params_t secParam;
            securityParametersGet(&secParam);
            //secParam.bond           = SEC_PARAM_BOND;
            //secParam.mitm           = SEC_PARAM_MITM;
            errCode = sd_ble_gap_authenticate(m_cur_conn_handle, &secParam);
            if (errCode != NRF_SUCCESS) {
                NRF_LOG_WARNING("sd_ble_gap_authenticate() failed, errCode=0x%x\n", errCode);
                return;
            }
#endif
        }
        break;

        case BLE_GAP_EVT_DISCONNECTED:
            if (fstorageGetState() == FSTORAGE_STATE_ERASED) {
                fstorageWaitUpdateRecordFinish();
            }
            NRF_LOG_INFO("Disconnected.");
            BLE_UART_SetState(BLE_NUS_STATE_DISCONNECT);
            m_cur_conn_handle = BLE_CONN_HANDLE_INVALID;
            break;

        case BLE_GAP_EVT_SEC_PARAMS_REQUEST:
        {
            NRF_LOG_INFO("BLE_GAP_EVT_SEC_PARAMS_REQUEST\n");
#if PASSKEY_ENABLED
            ble_gap_sec_params_t secParam;
            securityParametersGet(&secParam);
            errCode = sd_ble_gap_sec_params_reply(m_cur_conn_handle,
                                                  BLE_GAP_SEC_STATUS_SUCCESS,
                                                  &secParam,
                                                  NULL);
            if (errCode != NRF_SUCCESS) {
                NRF_LOG_WARNING("sd_ble_gap_sec_params_reply() failed, errCode=0x%x\n", errCode);
                return;
            }
#endif
        }
        break;

        case BLE_GAP_EVT_AUTH_STATUS:
            NRF_LOG_INFO("BLE_GAP_EVT_AUTH_STATUS\n");
#if PASSKEY_ENABLED
            if (pBleEvt->evt.gap_evt.params.auth_status.auth_status != BLE_GAP_SEC_STATUS_SUCCESS) {
                errCode = sd_ble_gap_disconnect(m_cur_conn_handle,
                                                BLE_HCI_REMOTE_USER_TERMINATED_CONNECTION);
                if (errCode != NRF_SUCCESS) {
                    NRF_LOG_WARNING("sd_ble_gap_disconnect() failed, errCode=0x%x\n", errCode);
                    return;
                }
            }
#endif
            break;

        case BLE_GAP_EVT_PHY_UPDATE_REQUEST:
        {
            NRF_LOG_INFO("PHY update request.");
            ble_gap_phys_t const phys =
            {
                .rx_phys = BLE_GAP_PHY_AUTO,
                .tx_phys = BLE_GAP_PHY_AUTO,
            };
            errCode = sd_ble_gap_phy_update(pBleEvt->evt.gap_evt.conn_handle, &phys);
            APP_ERROR_CHECK(errCode);
        } break;

        default:
            // No implementation needed.
            break;
    }
}

static void _pmEvtHandler(pm_evt_t const * pEvt) {
    ret_code_t errCode;

    switch (pEvt->evt_id) {

        case PM_EVT_CONN_SEC_SUCCEEDED:
        {
            NRF_LOG_INFO("Connection secured: role: %d, conn_handle: 0x%x, procedure: %d.",
                         ble_conn_state_role(pEvt->conn_handle),
                         pEvt->conn_handle,
                         pEvt->params.conn_sec_succeeded.procedure);
        } break;

...

}

RE: How to enable encrypted link in nRF52832 firmware?

snowuyl — Fri, 22 Jul 2022 02:07:05 GMT

D:\nRF5_SDK_17.0.2\examples\ble_peripheral\ble_app_hrs\main.c

RE: How to enable encrypted link in nRF52832 firmware?

snowuyl — Fri, 22 Jul 2022 02:05:42 GMT

devzone.nordicsemi.com/.../52855.main.c

RE: How to enable encrypted link in nRF52832 firmware?

snowuyl — Fri, 22 Jul 2022 02:05:04 GMT

Thanks for your reply! I have checked the ble_app_hrs example SDK17.0.2. But I can find pm_conn_secure() is called.

static void ble_evt_handler(ble_evt_t const * p_ble_evt, void * p_context)
{
    ret_code_t err_code;

    switch (p_ble_evt->header.evt_id)
    {
        case BLE_GAP_EVT_CONNECTED:
            NRF_LOG_INFO("Connected.");
            err_code = bsp_indication_set(BSP_INDICATE_CONNECTED);
            APP_ERROR_CHECK(err_code);
            m_conn_handle = p_ble_evt->evt.gap_evt.conn_handle;
            err_code = nrf_ble_qwr_conn_handle_assign(&m_qwr, m_conn_handle);
            APP_ERROR_CHECK(err_code);
            break;

        case BLE_GAP_EVT_DISCONNECTED:
            NRF_LOG_INFO("Disconnected, reason %d.",
                          p_ble_evt->evt.gap_evt.params.disconnected.reason);
            m_conn_handle = BLE_CONN_HANDLE_INVALID;
            break;

        case BLE_GAP_EVT_PHY_UPDATE_REQUEST:
        {
            NRF_LOG_DEBUG("PHY update request.");
            ble_gap_phys_t const phys =
            {
                .rx_phys = BLE_GAP_PHY_AUTO,
                .tx_phys = BLE_GAP_PHY_AUTO,
            };
            err_code = sd_ble_gap_phy_update(p_ble_evt->evt.gap_evt.conn_handle, &phys);
            APP_ERROR_CHECK(err_code);
        } break;

        case BLE_GATTC_EVT_TIMEOUT:
            // Disconnect on GATT Client timeout event.
            NRF_LOG_DEBUG("GATT Client Timeout.");
            err_code = sd_ble_gap_disconnect(p_ble_evt->evt.gattc_evt.conn_handle,
                                             BLE_HCI_REMOTE_USER_TERMINATED_CONNECTION);
            APP_ERROR_CHECK(err_code);
            break;

        case BLE_GATTS_EVT_TIMEOUT:
            // Disconnect on GATT Server timeout event.
            NRF_LOG_DEBUG("GATT Server Timeout.");
            err_code = sd_ble_gap_disconnect(p_ble_evt->evt.gatts_evt.conn_handle,
                                             BLE_HCI_REMOTE_USER_TERMINATED_CONNECTION);
            APP_ERROR_CHECK(err_code);
            break;

        case BLE_GAP_EVT_SEC_PARAMS_REQUEST:
            NRF_LOG_DEBUG("BLE_GAP_EVT_SEC_PARAMS_REQUEST");
            break;

        case BLE_GAP_EVT_AUTH_KEY_REQUEST:
            NRF_LOG_INFO("BLE_GAP_EVT_AUTH_KEY_REQUEST");
            break;

        case BLE_GAP_EVT_LESC_DHKEY_REQUEST:
            NRF_LOG_INFO("BLE_GAP_EVT_LESC_DHKEY_REQUEST");
            break;

         case BLE_GAP_EVT_AUTH_STATUS:
             NRF_LOG_INFO("BLE_GAP_EVT_AUTH_STATUS: status=0x%x bond=0x%x lv4: %d kdist_own:0x%x kdist_peer:0x%x",
                          p_ble_evt->evt.gap_evt.params.auth_status.auth_status,
                          p_ble_evt->evt.gap_evt.params.auth_status.bonded,
                          p_ble_evt->evt.gap_evt.params.auth_status.sm1_levels.lv4,
                          *((uint8_t *)&p_ble_evt->evt.gap_evt.params.auth_status.kdist_own),
                          *((uint8_t *)&p_ble_evt->evt.gap_evt.params.auth_status.kdist_peer));
            break;

        default:
            // No implementation needed.
            break;
    }
}

/**@brief Function for initializing the BLE stack.
*
* @details Initializes the SoftDevice and the BLE event interrupt.
*/
static void ble_stack_init(void)
{
    ret_code_t err_code;

    err_code = nrf_sdh_enable_request();
    APP_ERROR_CHECK(err_code);

    // Configure the BLE stack using the default settings.
    // Fetch the start address of the application RAM.
    uint32_t ram_start = 0;
    err_code = nrf_sdh_ble_default_cfg_set(APP_BLE_CONN_CFG_TAG, &ram_start);
    APP_ERROR_CHECK(err_code);

    // Enable BLE stack.
    err_code = nrf_sdh_ble_enable(&ram_start);
    APP_ERROR_CHECK(err_code);

    // Register a handler for BLE events.
    NRF_SDH_BLE_OBSERVER(m_ble_observer, APP_BLE_OBSERVER_PRIO, ble_evt_handler, NULL);
}

RE: How to enable encrypted link in nRF52832 firmware?

snowuyl — Thu, 21 Jul 2022 14:03:55 GMT

I am using SDK 16.0.0. Does SDK 16.0.0 has example for enabling encrypted link?

RE: How to enable encrypted link in nRF52832 firmware?

Edvin — Thu, 21 Jul 2022 14:02:01 GMT

Hello,

Initializing the peer manager is not enough to encrypt the link. I don't know what SDK version you are using, but in SDK17.1.0, you can see how the ble_app_hrs example calls pm_conn_secure() in the BLE_GAP_EVT_CONNECTED event in ble_evt_handler() in main.c.

BR,

Edvin

RE: How to enable encrypted link in nRF52832 firmware?

snowuyl — Thu, 21 Jul 2022 01:56:38 GMT

RE: How to enable encrypted link in nRF52832 firmware?

snowuyl — Thu, 21 Jul 2022 01:56:00 GMT

devzone.nordicsemi.com/.../3554.security.c devzone.nordicsemi.com/.../8345.gap.c devzone.nordicsemi.com/.../2577.gap.h devzone.nordicsemi.com/.../2072.security.h