Passing Out-of-Band key to Peer Manager?

[Elias]

I'm trying to add authentication with a key acquired Out-of-Band to a Peripheral BLE device in which I already have non-MITM bonding working. I'm using the Peer Manager module with the s132 SoftDevice. I'm not sure how I provide the OOB key as the Temporary Key to the Peer Manager for the authentication process.

I've tried to follow the "Bonding: Out of Band" MSC but I'm stumped as to what to do for the DHKey calculation. It's apparently supposed to be done by the application, and the Peer Manager (I guess) is already doing this since I have an encrypted connection working, but I can't find some kind of pm_dhkey_get() function. Am I instead supposed to use sd_ble_gap_auth_key_reply() as mentioned in this question? I think that function is only mentioned in MSC's for Central devices, and the answer doesn't directly address the Peer Manager.

To expand a bit on the use case, the OOB key is from a codebook that our peripheral is programmed with in the factory. The keys will be periodically stepped through throughout the life of the device. The app that implements the central will also have a copy of the codebook.

edit (after Petter's comment): After looking further into the distinction, my understanding is that LESC uses a more sophisticated key generation algorithm than Legacy. Since security is a priority in my application, I want to use LESC. I also realize that since I imitated the Glucose Monitor example, the Peer Manager in my code might be not actually be doing the DHKey generation like I assumed it was, since it doesn't use LESC.

[Petter Myhre]

Do you want LESC pairing or Legacy pairing?

[Elias]

edit: Now that I look it over again, is the difference between those two just the strength of the key generation algorithm? I assume the tradeoff between the two pairing methods is strength of security vs. power consumption, so since I want my connections to be bulletproof, I want to use LESC.

[Petter Myhre]

Yes. Both LESC and Legacy end up with 128-bit encryption keys, and these are equally secure. The power consumption will be the same after pairing is done. LESC uses a more complex algorithm so it will use more power during the pairing process. The difference is in the key generation algorithm. It depends on what kind of attacks you want to protect against. If you do OOB with legacy and you are sure that the attacker can't get the OOB data, you are secure. If the attacker can get this data, you should go for LESC. What kind of central device are you connecting to? Does it support OOB and/or LESC?