Enabling BLE security mode 4 only on BLE and not on BLE-Mesh

RE: Enabling BLE security mode 4 only on BLE and not on BLE-Mesh

Hieu — Wed, 15 Feb 2023 09:02:28 GMT

Hi Hitesh,

My apology, last time I misunderstood your code as the code of the central for some reasons, and missed something obvious.

On the peripheral, your code effectively trigger a security request right after connection is established.
On the other hand, the provisioning using the nRF Mesh app is done via a (BLE) GATT connection (using the GATT Bearer, PB-GATT).
As such, when provisioning starts, the GATT connection is established, then your peripheral/provisionee device requests security, and finally the central device accepts by starting the pairing process.

So, this is normal behavior.

If you want to see that the pairing did not become "tangled" with mesh operation, you provision the device using the Advertising Bearer (PB-ADV), there would be no GATT connection, and you would see that there is no pairing involved.
The Bluetooth: Mesh Provisioner sample does provisioning using PB-ADV if you wish to try it.

You can read more about peripheral requesting security in this DevZone answer by my colleague Vidar. There he also explains that if you wish, you can setup your GATT Profile so that security is only request when certain Characteristics or Descriptors are accessed by the Central, which will remove this behavior.

Hieu

RE: Enabling BLE security mode 4 only on BLE and not on BLE-Mesh

hiteshk014 — Tue, 14 Feb 2023 12:27:31 GMT

Hi Hieu,

When we enabled this security layer,

Prior to provisioning, when we select the respective device for provisioning from the list, pairing happens in nRF Mesh app, during that time it ask for passkey (as mentioned in attached screenshot)
this passkey mechanism is enabled from smp.c from nRF Connect SDK.

RE: Enabling BLE security mode 4 only on BLE and not on BLE-Mesh

Hieu — Tue, 14 Feb 2023 11:57:23 GMT

Hi Hitesh,

Could you please provide more details on
- What is prompting you to enter the key?
- What exact steps were you doing when the key was requested?
- What key was requested?

Passkey is not a Bluetooth Mesh feature and is not a part of any Bluetooth Mesh procedures.
In BLE, passkey prompts should only happen during pairing.
During Bluetooth Mesh provisioning, the network key will be required, this is normal.

Best regards,

Hieu