NFC and enforcing L4 security

[Caycee]

I want to get the peripheral side of my dual-role gateway device to accept ONLY NFC (LESC) pairing from my Android phone.

I have had NFC working but it seems I keep breaking it with configurations for other things.

The issue seems to come and go, so I've gone back to the original peripheral_nfc_pairing example, but now even that fails the pairing connection.  It apparently tries 3-times as the nRF Connect app shows the "NOT BONDED"  text change quickly 3-times and then fails pairing.  It's as if the keys don't match.

Q:How can I debug this.  I can't seem to find what configuration to enable to debug the NFC/TNEP/OOB.

When it WAS working, the app was able to discover services during the time it was waiting for confirmation of whether to try pairing. Another BLE Scanner will discover and populate all the services during that same period. I had been testing where to place bt_conn_disconnect(conn, BT_HCI_ERR_AUTH_FAIL); calls to more quickly avoid that discovery. Calling it from the security_changed and the pairing_failed callbacks.  
Is this correct?

Q: Is there a way to force NFC-ONLY pairing?  It seems the default security level is 1 when the connect callback occurs, at which point I set_security to L4, but that still leaves the connection active for a time in low security such that it allows discovery to happen.

Q: Is there a way to force the connection to only use high-security and to allow connections if-and-only-if NFC has succeeded? 

[Caycee]

REPEAT
Q: Is there a way to force NFC-ONLY pairing?  It seems the default security level is 1 when the connect callback occurs, at which point I set_security to L4, but that still leaves the connection active for a time in low security such that it allows discovery to happen. Is there a way to force the connection to only use high-security and to allow connections if-and-only-if NFC has succeeded? 

[Sigurd]

Hi,

Sorry for the late reply, looks like this one slipped through the cracks and was not answered.

All connections initially start it's lifetime in security level 1, and then the link needs to be encrypted. But, the sample does what's called directed advertising to the central it has received bond information for(over NFC), so other centrals are not connecting to your device.(It's also possible to use whitelist/filter accept list). Also, when creating your characteristic using BT_GATT_CHARACTERISTIC() you can set the Characteristic Attribute access permissions. Here you can set it to BT_GATT_PERM_READ_LESC(If set, requires that LE Secure Connections is used for read access).