Issues with Zephyr Peripheral NFC Pairing Example

[andreribeiro423]

Hi! I'm using the nRF52-DK development kit to implement secure communications via Bluetooth Low Energy (BLE) on Zephyr. For that I'm using the "Peripheral NFC Pairing" example from the nRF Connect SDK (https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrf/samples/bluetooth/peripheral_nfc_pairing/README.html) for pairing in LE Secure Connections with Out Of Band (OOB) mode. In this example I'm using the nRF52-DK board with NFC antenna (NFC Forum Tag) and my smartphone (Huawei P30 Lite) as the NFC Poller Device. To verify the exchanged BLE packets I'm using an nRF Dongle with Wireshark as a BLE Sniffer.

However, I'm having problems with this example on verifying the packets exchanged since as soon as I touch the NFC antenna with my smartphone I cannot see any Security Manager Protocol (SMP) packet exchanged in Wireshark. I needed to visualize these packets to ensure that Pairing Feature Exchange and next pairing steps (key exchange) are occurring as intended (LE Secure Connections OOB pairing).

Another problem that I also detected is that after a first pairing of my smartphone with the board (accepting the pairing request announced in the pop-up window displayed on the smartphone), in subsequent pairings the pop-up window does not appear again (even when cleaning the bonds of the nRF52-DK board), so in these cases the pairing does not work with the intended security level. The only solution found for this problem was to clear the cache of the smartphone's Bluetooth application. However, this situation proves to be quite uncomfortable since it is necessary to restart the smartphone whenever the application's cache is cleared. I would like to know if there is another option to clear all BLE bonds from android smartphones.

I also leave the prj.conf file below.

CONFIG_NCS_SAMPLES_DEFAULTS=y

CONFIG_DK_LIBRARY=y

CONFIG_NFC_T4T_NRFXLIB=y

CONFIG_NFC_NDEF=y
CONFIG_NFC_NDEF_MSG=y
CONFIG_NFC_NDEF_RECORD=y
CONFIG_NFC_NDEF_LE_OOB_REC=y
CONFIG_NFC_NDEF_CH_MSG=y

CONFIG_NFC_NDEF_TNEP_RECORD=y
CONFIG_NFC_TNEP_TAG=y
CONFIG_NFC_NDEF_PARSER=y
CONFIG_NFC_NDEF_CH_PARSER=y
CONFIG_NFC_NDEF_LE_OOB_REC_PARSER=y
CONFIG_NFC_TNEP_CH=y

CONFIG_BT=y
CONFIG_BT_SMP=y
CONFIG_BT_SMP_APP_PAIRING_ACCEPT=y

# Added
# enable the possibility of LE Secure Connections
CONFIG_BT_TINYCRYPT_ECC=y
# specify Secure Connections Only mode
CONFIG_BT_SMP_SC_ONLY=y

CONFIG_BT_PERIPHERAL=y
CONFIG_BT_DEVICE_NAME="Nordic_NFC_pairing"

CONFIG_BT_DIS=y
CONFIG_BT_DIS_PNP=y
CONFIG_BT_DIS_MANUF="NordicSemiconductor"
CONFIG_BT_DIS_PNP_VID_SRC=2
CONFIG_BT_DIS_PNP_VID=0x1915
CONFIG_BT_DIS_PNP_PID=0xEEEB
CONFIG_BT_DIS_PNP_VER=0x0100

CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=2048
CONFIG_MAIN_STACK_SIZE=3072

CONFIG_BT_SETTINGS=y
CONFIG_FLASH=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_FLASH_MAP=y
CONFIG_NVS=y
CONFIG_SETTINGS=y

CONFIG_DK_LIBRARY=y

CONFIG_POLL=y

I look forward to any help, thank you!

[Simonr]

Hi

I cannot see any Security Manager Protocol (SMP) packet exchanged in Wireshark

This is the intended behavior, as a sniffer shouldn't be able to join in on the OOB pairing without having any of the OOB data on the sniffer side as well. You can check out the Sniffing the pairing procedure of a connection in the nRF Sniffer user guide.

(even when cleaning the bonds of the nRF52-DK board)

Do you erase the bond on both ends here though? When the devices have paired (and then bonded) once, they won't have to pair again on subsequent connections as they have already found a LTK (long term key) to start encrypted communication upon connection. If you erase bonding info on both devices, you should be able to see the same pairing info as you did initially.

Best regards,

Simon

[andreribeiro423]

I checked out the Sniffing the pairing procedure of a connection in the nRF Sniffer user guide. Since I am using LE Secure Connections I had to enable Secure Connections Debug Mode on the device. So, for that I added the CONFIG_BT_USE_DEBUG_KEYS=y on the prj.conf. However, after this I continued not to see any Security Manager Protocol (SMP) packet exchanged in Wireshark during the pairing procedure. I also checked out the menuconfig for exploring the available Kconfig options and ensure that the Secure Connections Debug Mode option is enabled.
Thank you for your help!

[Simonr]

Sorry about the late reply. I've been out of office travelling for the last week.

I think the reason you're not seeing this data on Wireshark is because the OOB pairing share encryption keys/authentication data over the "alternative" communication channel, in this case being NFC.

Wireshark won't be able to sniff any data transferred over NFC as it's a completely different protocol and frequency than BLE.

Best regards,

Simon