NCS: Get Public Keys during OOB pairing procedure

[tkirschner]

Hello,

We've been currently working on securely connecting a peripheral with no display and no keyboard, to a central with a display and keyboard.
We need to make sure that there can be no MITM.

We've decided that we want to implement authentication through OOB-Pairing, as passkey entry with a fixed key is unsecure.
One implementation, with legacy OOB, works already. But we wanted to use LE Secure Connection for the pairing process (I've seen that it's possible to raise the security level after connecting, but we want to make our devices as secure as feasible)

Now, to make that work, we need to resolve this Formula to get the Commitment value from the peripheral:

Cb=f1(PKbx,PKbx,rb,0)

rb will be a fixed value.
So the only missing factor is the public key from the peripheral side.

Going through the source code, at least the public key from the central side is being used inside zephyr/subsys/bluetooth/host/smp.c
We need to get the public key from the peripheral side to the central side though.

Are the public keys from peers saved anywhere, where they're accessible through the SDK?

Are the public keys from the local device saved anywhere, where they're accesible through the SDK?

Is it possible to extract them during the connection procedure?

[Hieu]

Hi tkirschner,

I will support you with this question. However, I need more time to look into Zephyr's implementation to answer you.

Unless someone from the community already helped you, I will be back with the answer latest by the end of Tue Jan 17.

Hieu

[Susheel Nuguru]

tkirschner,

Are the public keys from peers saved anywhere, where they're accessible through the SDK?

The keys are available in the same smp.c file in sc_public_key for the peripheral. But .these wont work when you have  CONFIG_BT_SMP_OOB_LEGACY_PAIR_ONLY defined in your project. You need to somehow expose sc_public_key to your application (as opposed to this variable being static). I do not think trying to get the memory location of where this is saved is not fail safe idea to get this data as the memory locations might change per device and there is no proper way to get the memory address through pointers other than trying to exposing sc_public_key or pub_key in zephyr\subsys\bluetooth\host\ecc.c

[Susheel Nuguru]

maybe you can edit bt_hci_evt_le_pkey_complete to make it call your application callback handler to copy the pub_key in your app memory area?

[tkirschner]

This idea uses LESC, so CONFIG_BT_SMP_OOB_LEGACY_PAIR_ONLY is not enabled. Thanks for pointing me into the right direction. I'll look into the options you've listed.