Cant pair bluetooth peripheral with Secure connection and static passkey (Connect SDK)

RE: Cant pair bluetooth peripheral with Secure connection and static passkey (Connect SDK)

Emil Lenngren — Mon, 29 Aug 2022 21:59:19 GMT

Yes that is a simple way to solve the security problem unwanted access to the peripheral, but will not prevent for example subsequent passive eavesdropping.

If you actually have a way to generate a random passkey, derived from external inputs, then security wise that will work just as good as an ordinary random passkey. The important thing here is that the 6 digit passkey is never reused.

RE: Cant pair bluetooth peripheral with Secure connection and static passkey (Connect SDK)

vcbz — Mon, 29 Aug 2022 21:48:22 GMT

Thanks for the information, I will check it out.

RE: Cant pair bluetooth peripheral with Secure connection and static passkey (Connect SDK)

vcbz — Mon, 29 Aug 2022 21:40:03 GMT

Yes I saw that article and that is the reason I thought of generating a passkey that only the central and peripheral know how to generate depending on external inputs which are not static.

The other route as you say instead I use another characteristic that allows me to unblock the functionality of the device. E.g. Peripheral generates a random value, central must write a secret passkey dependent on this value (e.g. encryption with AES256 with a secret salt), and as Peripheral knows this salt it can check if the central encrypted the value correctly.

RE: Cant pair bluetooth peripheral with Secure connection and static passkey (Connect SDK)

Emil Lenngren — Mon, 29 Aug 2022 21:23:53 GMT

You say that you are aware that using a static passkey is discouraged, but did you know that the protocol is kind of broken when static passkeys are used? Static passkeys can be brute forced in on average 10 attempts. See insinuator.net/.../ for more info.

Since you don't follow the standard if static passkeys are used, I suggest you to switch to Just Works method. You can add some other kind of security if you like on top of GATT, which will be more secure. The absolutely simplest would be to write your "dynamically generated secret" to some characteristic.

RE: Cant pair bluetooth peripheral with Secure connection and static passkey (Connect SDK)

Kenneth — Mon, 29 Aug 2022 09:46:48 GMT

I made this 2 years back, hopefully it haven't changed too much:
Zephyr BLE static passkey between central and peripheral on two nrf52840s

Kenneth