How to exact Link Keys from Nordic nRF5340 Audio EDK?

[Ottowei]

Our BQTF wishes to sniff LC3 packages, however without linkkeys, packages cannot be decrypted.

Any ideas on how to obtain link keys while debugging with a nRF5340 EDK attached or where to obtain them?

How are Link Keys extracted from the Nordic nRF5340 audio EDK?

Note the LC3 packages are visible in BIS mode, but they are encrypted in CIS mode.

[Elfving]

Hello Otto,

Have a look at the response from Jowan below, which 100% correct.

If you go for the first option you can find the long term key in the log in the log 

which you can then post in the Ellisys sniffer security panel.

 

Regards,

Elfving

[Ottowei]

Hi Elfving,

I appreciate your comments.

Few more questions:

What are the roles you use? In both termnial and Ellisys Sniffer, the bluetooth address does not appear to be the same.

Does your Pixel 7 series phone serve as the gateway (source) for connecting two headsets (nRF5340 audio Board)?

Or do you use only one nRF5340 audio gateway to connect another nRF5340 audio headset?

As a side note, this experiment is only intended to evaluate LC3 package quality.

[Tommy_Li]

Hi Ottowei:

Could you please provide some ellisys .btt files which contain broadcast audio or unicast audio for study.

We are a small company, we cant afford the ellisys sniffer, but we still want to the see the air packet of le audio.

Thanks in advance.