Connection Setup using Encryption and Bond Entry

[aglier]

Hello,

I'm using CYBT-343026 with EZSerial to communicate to a peripheral device over BLE.

I have a few questions regarding Bonding / Encryption.

I have a peripheral device, that allows Bonding only under certain circumstances (e.g. the charger was connected recently)

Now I setup a connection and pair to the device and I'm also using bonding to store the exchanged keys in the module.

After a certain amount of time, the peripheral device will not allow any more pairing but all bonded devices can still connect.

When I connect to the device, I can see all characteristics etc. but I'm not allowed to access them as they are protected by encryption.

So far so good.

By sniffing the Bluetooth traffic with Wireshark, I can see, that there is no encryption set up.

Even though a bonding entry exists (checked with command query bonds) , it seems as the CYBT module is not triggering the encyryption setup and therefor I won't be able to access the protected characteristics.

Is there a way to explicitely start encryption after a device is connected?

PS: attached you will find the wireshark log that shows the connection setup

Best regards

Alex

[BragadeeshV]

Hi @aglier,

Usually, it is the central device that sends the start encryption request incase if the peer peripheral device is bonded. Can you try sending smp_pair request after connection?

[aglier]

Hi,

the central device in this case should be the device that offers the GATT service right?

So my peripheral device is the Gatt central?

I just want to be sure 🙂

If I use smp_pair I will see a "Pairing not supported" entry in Wireshark which is correct as the device is only connectable and not bondable in this state.

So pairing again seems not to be a solution.

Best regards

Alex

[BragadeeshV]

Hi @aglier ,

GAP Central device is the master of the connection that sends the connection request, initiates a pairing procedure or starts encryption. Optionally the peripheral device (or slave) cam send a security request to the master.

GATT server and client depends on who has the data and who requests for data and it is irrespective of their GAP roles mentioned above.

If I use smp_pair I will see a "Pairing not supported" entry in Wireshark which is correct as the device is only connectable and not bondable in this state.

So pairing again seems not to be a solution.

-> I'm not sure if I understand this. Pairing is the process by which we can start encryption. 

Can you please explain your use case in more detail maybe with flowcharts or complete terminal logs? Also what is your peer central device?

[aglier]

Sorry for the confusion.

In our case we are developing a USB dongle that uses the CYBT-343026 to establish a connection to a device.

When the device is in a bondable state (e.g. after unplugging the charger) the dongle will connect to the device and pair afterwards (including bonding).

That all works just perfect. I can see the bonding list entry in the CYBT module.

Now if the device changes into "connectable state" it will refuse any pairing attempts as it will only allow connections to already known/paired devices.

Now when I try to connect to the device in this "connectable state" I should not need to pair again.

But what happens, is that I can not write to the GATT characteristics of the device due to "insufficient authentication". (gattc_write_response Result=0x605)

So I was wondering if this authentication will be sufficient if the encryption is enabled (e.g. by initiating it after connect).

So  as I am the GAP central device, I should be responsible for enabling the encryption right?

I was always assuming that this is done automatically when a bonding entry exists. But I can't see any encryption related packages in wireshark.

Is there a command that starts an encrypted connection by using the existing bond entries?

In another EZSerial document for another module (4830XX) I found that there is an sec_action_type parameter for the smp_pair command that encrypts the link using the current key. That sounds like what I'm looking for....however, there is no such parameter in my documentation.

Best regards

Alex

[BragadeeshV]

Hi @aglier , Thanks for the clarification. I don't see a command to start encryption from the central side for previously bonded devices. I'm checking with the FW team if this is possible. We appreciate your patience.

[BragadeeshV · Accepted solution]

Hi @aglier ,

This seems to be a limitation in the Ez serial FW that it can not start encryption for previously bonded devices. We highly recommend you to evaluate the AIROC BTSDK that has several APIs for supporting complete (or more) BT features

https://infineon.github.io/btsdk-docs/BT-SDK/index.html

Check out our examples at Github for getting started.

If you still want to use Ez serial FW on your product, we recommend you to contact your local sales representative for creating a FW enhancement request. Considering the RAM limitation on this product, it might be difficult to add new features to this FW. Therefore,  it maybe added based on priority.

[aglier]

Hi @BragadeeshV ,

thank you for answer.

It is sad to hear that it is not possible.

I wonder if this is not something rather standard to use the existing bonding for encryption....as this is the only reason for bonding, right?

Anyway, we will look into AIROC BTSDK.

Thanks again

Alex

[BragadeeshV]

Hi @aglier , Bonding in the Ez serial FW is implemented for the peripheral role and not for the central role. We recommend you to  evaluate BTSDK for more features.