pairing procedure "authentication requirement"

[Stayhungry]

Thank you for reading my question.

peripheral project :ble_app_hrs_rscs_relay，SDK14.1 ,S132

client project: another manufacturer's soc

I set peripheral peer manager to MITM = 1, IO cap = BLE_GAP_IO_CAPS_KEYBOARD_DISPLAY

client's MITM = 0, IO cap = BLE_GAP_IO_CAPS_NONE

Through sniffer capture packets found that pairing procedure can be normal, and finally used should be Just work way to generate STK.

BLUETOOTH SPECIFICATION Version 5.0 | Vol 3, Part H page 2315

"If the key generation method does not result in a key that provides sufficient security properties then the device shall send the Pairing Failed command with the error code "Authentication Requirements."

Question 1: Is "sufficient security properties" here referring to the MITM field in the pairing request / pairing response? Just work generated STK is not satisfied with the safety requirements of peripheral?

BLUETOOTH SPECIFICATION Version 5.0 | Vol 3, Part H page 2346

"value: 0x03

Name: Authentication Requirements

Description: The pairing procedure can not be performed as authentication requirements can not be met due to IO capabilities of one or both devices "

Question 2: If my understanding of Question 1 is correct, why does peripheral not send Pairing Failed with "Authentication Requirements"? Or is my understanding of Question 1 wrong?

[David Edwin]

Can you post the pcap file as an attachment ?

[Stayhungry]

Sorry, I do not know what pcap file mean?Did you mean sniffer's captured image?

The reason why I am very confused because:

If I make central's MITM = 1, IO cap = BLE_GAP_IO_CAPS_KEYBOARD_DISPLAY, peripheral's MITM = 0, IO cap = BLE_GAP_IO_CAPS_NONE

central will send Pairing Failed command with the error code "Authentication Requirements." These are all the information I get from sniffer

[Petter Myhre]

My understanding is that "sufficient security properties" is defined by the application.

When a peripheral gets a pairing request (BLE_GAP_EVT_SEC_PARAMS_REQUEST) it can call:

sd_ble_gap_sec_params_reply(conn_handle, BLE_GAP_SEC_STATUS_AUTH_REQ,...,...) if it doesn't like the IO capabilities of the central. See this MSC.

When a central gets a pairing response (BLE_GAP_EVT_SEC_PARAMS_REQUEST) it can call:

sd_ble_gap_sec_params_reply(conn_handle, BLE_GAP_SEC_STATUS_AUTH_REQ,...,...) if it doesn't like the IO capabilities of the peripheral. See this MSC.

At first look it doesn't seem like this is supported by the Peer Manager.

[Stayhungry]

Thank you very much for your reply.

If I want to follow my BLUETOOTH SPECIFICATION Version 5.0 | Vol 3, Part H page 2346 to write my program.

When IO cap is found insufficient Pairing Failed, then I can only give up peer manager, using the original BLE_GAP_EVT_SEC_PARAMS_REQUEST?

Device manager to meet my needs? Or I can only write one to manage peer address, LTK, etc.?

[Petter Myhre]

Give up Peer Manager? Do you mean to still use Peer Manager, but replying to the BLE_GAP_EVT_SEC_PARAMS_REQUEST directly yourself? Then you must at least be sure not to forward the BLE_GAP_EVT_SEC_PARAMS_REQUEST event to the Peer Manager, and still it might be complications, I'm not sure. Haven't tested.