Static passkey and MITM

[Dominik]

I am trying to add a static passkey to my peripheral and protect from MITM. I tried the example nRF51-ble-app-uart-static-passkey but it doesn't seem to work correctly.

I am using:

• PCA10001 board
• S110 v7.3.0
• nRF51 SDK 6.1
• nRF Master Control Panel

First, bonding the device still works without a passkey. I have set sec_param.io_caps = BLE_GAP_IO_CAPS_DISPLAY_ONLY and sec_param.mitm = 1. Looks like it is still using the Just Works, instead of the passkey authentication? What am I missing? Shouldn't I now have to enter the static passkey I set in my peripheral on the phone when I try to bond?

Second, I don't get any data on the characteristics. Only when I use BLE_GAP_CONN_SEC_MODE_SET_ENC_NO_MITM I can send and receive data. As long as I use BLE_GAP_CONN_SEC_MODE_SET_ENC_WITH_MITM I don't get anything, neither read nor write. I suppose this is because the bonding is still using the unauthenticated method instead of the authenticated?

[Ulrich Myhre]

What kind of I/O capabilities and flags are the peer setting? It must have something that lets you enter input.

[Dominik]

I am using an android phone with the nRF Master Control Panel on one side, and the PCA10001, which doesn't have I/O capabilities, as the device to bond with.

[Petter Myhre]

Seems to be working fine here. I'm using the unmodified project. I connect in nRF Master Control Panel and then press Bond in the options. Then I get a popup where I enter the passkey. Is this what you are doing as well? Could you do a sniffer trace with the nRF Sniffer?

[Dominik]

Yes that's what I am doing to, except I am not getting a popup for the passkey :( I am starting to wonder if the problem is on my phone. But thanks, I will try out the sniffer and see if I can find out what's going on.

[Dominik]

It seems the problem was indeed my phone and not the software. I was using an HTC M8, with stock rom, and apparently they botched up. I now tried it on two other phones and it is working properly, meaning I do get a popup where I have to enter the static pin, and only if I enter the correct pin bonding succeeds.

On the M8 on the other hand, bonding succeeds without any input ...