Date   

error while opening file (NFFS)

Vikrant More <vikrant8051@...>
 

Hello,

I upgrade to Zephyr v.1.11 & getting this error while opening file using NFFS

[general] [ERR] fs_open: fs_open:mount point not found!!
error -2 while opening test.txt

It was working perfectly fine with previous version.

Could anybody help me to solve this issue ?


about to use FOTA & Lightweight flash storage layer for constrained devices from v1.11.0

Vikrant More <vikrant8051@...>
 

Hello,

How to upgrade firmware on #nRF52840_PDK over Bluetooth Link using newly added FOTA feature in v1.11.0 ? Please provide in detail step wise solution if possible.


Where I will find demo example for "Lightweight flash storage layer for constrained devices" ?
Is it "$zephyr_base/samples/drivers/soc_flash_nrf5" ?

If we try to update value of variable stored on flash, then we have to erase complete page or driver should write down new value on new address location. Is newly added flash storage layer take care of that since in general SoC supports only 10K erase cycle ?

Thank You !!






Re: increasing nRF52 Bluetooth range

Chettimada, Vinayak Kariappa
 

Hi Vikrant,

 

I tried +8dBm settings and I simply see the increased RSSI value on my iPhone scanning for advertisements.

 

Regards,

Vinayak

 

From: Vikrant More [mailto:vikrant8051@...]
Sent: Thursday, March 08, 2018 11:46 AM
To: Chettimada, Vinayak Kariappa <vinayak.kariappa.chettimada@...>
Cc: zephyr-devel@...; zephyr-users@...; Cufi, Carles <Carles.Cufi@...>
Subject: Re: [Zephyr-users] increasing nRF52 Bluetooth range

 

Hello Vinayak,

I modified it at stack level so that TX power get set to +8 dBM.

For that, I edited

/home/vikrant/projects/zephyr/zephyr/subsys/bluetooth/controller/ll_sw/ll_test.c:189:    radio_tx_power_set(8);
/home/vikrant/projects/zephyr/zephyr/subsys/bluetooth/controller/ll_sw/ctrl.c:5902:    radio_tx_power_set(8);

these 2 files.

But unfortunately didn't found any difference in range.
 

Thank You !!

 

 

On Thu, Mar 8, 2018 at 3:47 PM, Chettimada, Vinayak Kariappa <vinayak.kariappa.chettimada@...> wrote:

Hi Vikrant,

 

As I said before:

«Feel free to supply the correct h/w Tx Power enumeration to callers of https://github.com/zephyrproject-rtos/zephyr/blob/master/subsys/bluetooth/controller/hal/nrf5/radio/radio.c#L112

 

Please review the callers of “radio_tx_power_set”

 

One for sure is https://github.com/zephyrproject-rtos/zephyr/blob/master/subsys/bluetooth/controller/ll_sw/ctrl.c#L5902

 

Supply 0x08 instead of 0 as the current param.

 

Regards,

Vinayak

 

 

From: Vikrant More [mailto:vikrant8051@...]
Sent: Thursday, March 08, 2018 9:56 AM
To: Chettimada, Vinayak Kariappa <vinayak.kariappa.chettimada@...>
Cc: zephyr-devel@...; zephyr-users@...; Cufi, Carles <Carles.Cufi@...>
Subject: Re: [Zephyr-users] increasing nRF52 Bluetooth range

 

Hello Vinayak,

    NRF_RADIO->TXPOWER = 0x8;  //+8dBm


    err = bt_enable(bt_ready);
    if (err) {
        printk("Bluetooth init failed (err %d)\n", err);
        return;
    }

    bt_conn_cb_register(&conn_callbacks);
    bt_conn_auth_cb_register(&auth_cb_display);

I modified power to +8 dBM as per your suggestion but didn't find any improvement in the range.

Am I missing something besides this ?

Thank You !!

 

On Thu, Mar 8, 2018 at 1:57 PM, Chettimada, Vinayak Kariappa <vinayak.kariappa.chettimada@...> wrote:

Hi Vikrant,

 

The Zephyr BLE controller does not implement the Tx power set interface in the upstream code, hence Zephyr controller operates with +0dBm transmit power.

Feel free to supply the correct h/w Tx Power enumeration to callers of https://github.com/zephyrproject-rtos/zephyr/blob/master/subsys/bluetooth/controller/hal/nrf5/radio/radio.c#L112

 

nRF52840 supports +8dBm and Zephyr controller supports external power amplifiers too using the PA/LNA GPIO lines, in case you want your h/w design to have external chips to get further tx power.

 

Regards,

Vinayak

 

From: zephyr-users-bounces@... [mailto:zephyr-users-bounces@...] On Behalf Of Vikrant More
Sent: Thursday, March 08, 2018 7:53 AM
To: zephyr-devel@...; zephyr-users@...; Cufi, Carles <Carles.Cufi@...>
Subject: [Zephyr-users] increasing nRF52 Bluetooth range

 

Hello,

Recently while doing demo test in my office, I found that

range of silicon labs SoC with max. +10dbm power = 2 * range of nRF52 with max. +8 dbm power

Silicon labs demo kit was executing own stack.

 

Is this because of only +2dbm difference ?

How to increase nRF52 range by configuring Zephyr ?

Thank You !!  

 

 

 


Re: increasing nRF52 Bluetooth range

Vikrant More <vikrant8051@...>
 

Hello Vinayak,

I modified it at stack level so that TX power get set to +8 dBM.

For that, I edited

/home/vikrant/projects/zephyr/zephyr/subsys/bluetooth/controller/ll_sw/ll_test.c:189:    radio_tx_power_set(8);
/home/vikrant/projects/zephyr/zephyr/subsys/bluetooth/controller/ll_sw/ctrl.c:5902:    radio_tx_power_set(8);

these 2 files.

But unfortunately didn't found any difference in range.
 
Thank You !!


On Thu, Mar 8, 2018 at 3:47 PM, Chettimada, Vinayak Kariappa <vinayak.kariappa.chettimada@...> wrote:

Hi Vikrant,

 

As I said before:

«Feel free to supply the correct h/w Tx Power enumeration to callers of https://github.com/zephyrproject-rtos/zephyr/blob/master/subsys/bluetooth/controller/hal/nrf5/radio/radio.c#L112

 

Please review the callers of “radio_tx_power_set”

 

One for sure is https://github.com/zephyrproject-rtos/zephyr/blob/master/subsys/bluetooth/controller/ll_sw/ctrl.c#L5902

 

Supply 0x08 instead of 0 as the current param.

 

Regards,

Vinayak

 

 

From: Vikrant More [mailto:vikrant8051@...]
Sent: Thursday, March 08, 2018 9:56 AM
To: Chettimada, Vinayak Kariappa <vinayak.kariappa.chettimada@nordicsemi.no>
Cc: zephyr-devel@lists.zephyrproject.org; zephyr-users@lists.zephyrproject.org; Cufi, Carles <Carles.Cufi@...>
Subject: Re: [Zephyr-users] increasing nRF52 Bluetooth range

 

Hello Vinayak,

    NRF_RADIO->TXPOWER = 0x8;  //+8dBm


    err = bt_enable(bt_ready);
    if (err) {
        printk("Bluetooth init failed (err %d)\n", err);
        return;
    }

    bt_conn_cb_register(&conn_callbacks);
    bt_conn_auth_cb_register(&auth_cb_display);


I modified power to +8 dBM as per your suggestion but didn't find any improvement in the range.

Am I missing something besides this ?

Thank You !!

 

On Thu, Mar 8, 2018 at 1:57 PM, Chettimada, Vinayak Kariappa <vinayak.kariappa.chettimada@nordicsemi.no> wrote:

Hi Vikrant,

 

The Zephyr BLE controller does not implement the Tx power set interface in the upstream code, hence Zephyr controller operates with +0dBm transmit power.

Feel free to supply the correct h/w Tx Power enumeration to callers of https://github.com/zephyrproject-rtos/zephyr/blob/master/subsys/bluetooth/controller/hal/nrf5/radio/radio.c#L112

 

nRF52840 supports +8dBm and Zephyr controller supports external power amplifiers too using the PA/LNA GPIO lines, in case you want your h/w design to have external chips to get further tx power.

 

Regards,

Vinayak

 

From: zephyr-users-bounces@lists.zephyrproject.org [mailto:zephyr-users-bounces@lists.zephyrproject.org] On Behalf Of Vikrant More
Sent: Thursday, March 08, 2018 7:53 AM
To: zephyr-devel@lists.zephyrproject.org; zephyr-users@lists.zephyrproject.org; Cufi, Carles <Carles.Cufi@...>
Subject: [Zephyr-users] increasing nRF52 Bluetooth range

 

Hello,

Recently while doing demo test in my office, I found that

range of silicon labs SoC with max. +10dbm power = 2 * range of nRF52 with max. +8 dbm power

Silicon labs demo kit was executing own stack.

 

Is this because of only +2dbm difference ?

How to increase nRF52 range by configuring Zephyr ?

Thank You !!  

 

 



Re: increasing nRF52 Bluetooth range

Chettimada, Vinayak Kariappa
 

Hi Vikrant,

 

As I said before:

«Feel free to supply the correct h/w Tx Power enumeration to callers of https://github.com/zephyrproject-rtos/zephyr/blob/master/subsys/bluetooth/controller/hal/nrf5/radio/radio.c#L112

 

Please review the callers of “radio_tx_power_set”

 

One for sure is https://github.com/zephyrproject-rtos/zephyr/blob/master/subsys/bluetooth/controller/ll_sw/ctrl.c#L5902

 

Supply 0x08 instead of 0 as the current param.

 

Regards,

Vinayak

 

 

From: Vikrant More [mailto:vikrant8051@...]
Sent: Thursday, March 08, 2018 9:56 AM
To: Chettimada, Vinayak Kariappa <vinayak.kariappa.chettimada@...>
Cc: zephyr-devel@...; zephyr-users@...; Cufi, Carles <Carles.Cufi@...>
Subject: Re: [Zephyr-users] increasing nRF52 Bluetooth range

 

Hello Vinayak,

    NRF_RADIO->TXPOWER = 0x8;  //+8dBm


    err = bt_enable(bt_ready);
    if (err) {
        printk("Bluetooth init failed (err %d)\n", err);
        return;
    }

    bt_conn_cb_register(&conn_callbacks);
    bt_conn_auth_cb_register(&auth_cb_display);


I modified power to +8 dBM as per your suggestion but didn't find any improvement in the range.

Am I missing something besides this ?

Thank You !!

 

On Thu, Mar 8, 2018 at 1:57 PM, Chettimada, Vinayak Kariappa <vinayak.kariappa.chettimada@...> wrote:

Hi Vikrant,

 

The Zephyr BLE controller does not implement the Tx power set interface in the upstream code, hence Zephyr controller operates with +0dBm transmit power.

Feel free to supply the correct h/w Tx Power enumeration to callers of https://github.com/zephyrproject-rtos/zephyr/blob/master/subsys/bluetooth/controller/hal/nrf5/radio/radio.c#L112

 

nRF52840 supports +8dBm and Zephyr controller supports external power amplifiers too using the PA/LNA GPIO lines, in case you want your h/w design to have external chips to get further tx power.

 

Regards,

Vinayak

 

From: zephyr-users-bounces@... [mailto:zephyr-users-bounces@...] On Behalf Of Vikrant More
Sent: Thursday, March 08, 2018 7:53 AM
To: zephyr-devel@...; zephyr-users@...; Cufi, Carles <Carles.Cufi@...>
Subject: [Zephyr-users] increasing nRF52 Bluetooth range

 

Hello,

Recently while doing demo test in my office, I found that

range of silicon labs SoC with max. +10dbm power = 2 * range of nRF52 with max. +8 dbm power

Silicon labs demo kit was executing own stack.

 

Is this because of only +2dbm difference ?

How to increase nRF52 range by configuring Zephyr ?

Thank You !!  

 

 


Re: increasing nRF52 Bluetooth range

Vikrant More <vikrant8051@...>
 

Hello Vinayak,

    NRF_RADIO->TXPOWER = 0x8;  //+8dBm

    err = bt_enable(bt_ready);
    if (err) {
        printk("Bluetooth init failed (err %d)\n", err);
        return;
    }

    bt_conn_cb_register(&conn_callbacks);
    bt_conn_auth_cb_register(&auth_cb_display);



I modified power to +8 dBM as per your suggestion but didn't find any improvement in the range.
Am I missing something besides this ?

Thank You !!

On Thu, Mar 8, 2018 at 1:57 PM, Chettimada, Vinayak Kariappa <vinayak.kariappa.chettimada@...> wrote:

Hi Vikrant,

 

The Zephyr BLE controller does not implement the Tx power set interface in the upstream code, hence Zephyr controller operates with +0dBm transmit power.

Feel free to supply the correct h/w Tx Power enumeration to callers of https://github.com/zephyrproject-rtos/zephyr/blob/master/subsys/bluetooth/controller/hal/nrf5/radio/radio.c#L112

 

nRF52840 supports +8dBm and Zephyr controller supports external power amplifiers too using the PA/LNA GPIO lines, in case you want your h/w design to have external chips to get further tx power.

 

Regards,

Vinayak

 

From: zephyr-users-bounces@lists.zephyrproject.org [mailto:zephyr-users-bounces@lists.zephyrproject.org] On Behalf Of Vikrant More
Sent: Thursday, March 08, 2018 7:53 AM
To: zephyr-devel@lists.zephyrproject.org; zephyr-users@lists.zephyrproject.org; Cufi, Carles <Carles.Cufi@...>
Subject: [Zephyr-users] increasing nRF52 Bluetooth range

 

Hello,

Recently while doing demo test in my office, I found that

range of silicon labs SoC with max. +10dbm power = 2 * range of nRF52 with max. +8 dbm power

Silicon labs demo kit was executing own stack.

 

Is this because of only +2dbm difference ?

How to increase nRF52 range by configuring Zephyr ?

Thank You !!  

 



Re: increasing nRF52 Bluetooth range

Chettimada, Vinayak Kariappa
 

Hi Vikrant,

 

The Zephyr BLE controller does not implement the Tx power set interface in the upstream code, hence Zephyr controller operates with +0dBm transmit power.

Feel free to supply the correct h/w Tx Power enumeration to callers of https://github.com/zephyrproject-rtos/zephyr/blob/master/subsys/bluetooth/controller/hal/nrf5/radio/radio.c#L112

 

nRF52840 supports +8dBm and Zephyr controller supports external power amplifiers too using the PA/LNA GPIO lines, in case you want your h/w design to have external chips to get further tx power.

 

Regards,

Vinayak

 

From: zephyr-users-bounces@... [mailto:zephyr-users-bounces@...] On Behalf Of Vikrant More
Sent: Thursday, March 08, 2018 7:53 AM
To: zephyr-devel@...; zephyr-users@...; Cufi, Carles <Carles.Cufi@...>
Subject: [Zephyr-users] increasing nRF52 Bluetooth range

 

Hello,

Recently while doing demo test in my office, I found that

range of silicon labs SoC with max. +10dbm power = 2 * range of nRF52 with max. +8 dbm power

Silicon labs demo kit was executing own stack.

 

Is this because of only +2dbm difference ?

How to increase nRF52 range by configuring Zephyr ?

Thank You !!  

 


increasing nRF52 Bluetooth range

Vikrant More <vikrant8051@...>
 

Hello,

Recently while doing demo test in my office, I found that

range of silicon labs SoC with max. +10dbm power = 2 * range of nRF52 with max. +8 dbm power


Silicon labs demo kit was executing own stack.

Is this because of only +2dbm difference ?

How to increase nRF52 range by configuring Zephyr ?

Thank You !!  


Re: Securing BLE device communication without OOB pairing (multiple devices)

Vikrant More <vikrant8051@...>
 

Awesome, thanks! 

>>If he/she clicks on "yes" then only process go ahead.
>>[ Here APP will only connect to Devices which are in vicinity by >>checking their signal strength (RSSI) ]
>>So I think, this method may solve the issue of Authentication. Am >>I right ?

But I'm waiting for solution for above mentioned query.

If am using Human to authenticate, his own device just before ECDH key agreement process, is that enough in case of no OOB channel?

As per my understanding, problem arises only when user click on "YES" even when he has not seen Blinking LED. That means user App is connected to attacker Device & it will share #CommonKey of his devices to attacker.

Are there any flaws in this mechanism besides this ?

------------------------------------------------------------------------------------


Have you seen, this video about #BluetoothMesh ? I think Bluetooth SIG has twitted about them sometimes before.

As per my understanding, they have not used input OOB, output OOB or static OOB for authentication.

On my inquiry, they reply as:


"The authentification is automatic, comming from the signal power measured by the smartphone. You have to go 15/20cm from the device you want to pair."


In this case, what is your opinion ?
------------------------------------------------------------------------

Alternate Way (which is final solution if there is no OOB channel for authentication):

Device after flashing firmware on it whenever get power will generate random no. & stored it on flash memory & will not create it again in future. 

Then after every reboot it will send that random no. on device UART terminal.

Based on that unique Random no. manufacturer has to create QR code & label it on that device.

This is most secured way but some people will not understand its importance since as company it will be burden for them. 

-----------------------------------------------------------------------------







On Mar 4, 2018 11:48 AM, "Johan Hedberg" <johan.hedberg@...> wrote:
Hi Vikrant,

Zephyr's Bluetooth stack exposes ECC as standard HCI commands & events
through subsys/bluetooth/host/hci_ecc.c. And you're right that it's the
FIPS P-256 curve that both LE Secure Connections (LE Security Manager
enhancement that debuted with Bluetooth 4.1) and Mesh Provisioning use.
The micro-ecc library that TinyCrypt has a copy of can be found here:

ext/lib/crypto/tinycrypt/source/ecc*.c

The main header file is here:

ext/lib/crypto/tinycrypt/include/tinycrypt/ecc.h

Johan

On Sun, Mar 04, 2018, Vikrant More wrote:
> Hi Johan,
>
> https://github.com/kmackay/micro-ecc has support for 5 standard curves:
> secp160r1, secp192r1, secp224r1, secp256r1, and secp256k1.
>
> Out of *secp256r1* and *secp256k1*, which one is used by Zephyr
> #BluetoothMesh ?
>
> As per #BluetoothMesh specs, it should be FIPS-P256 curve.
> Is Zephyr built in *micro*-*ecc* library different than what I am currently
> using ?
>
> Thank You!!
>
> On Sun, Mar 4, 2018 at 1:16 AM, Vikrant More <vikrant8051@...> wrote:
>
> > Hi Johan,
> >
> > Thanks for reply !!
> >
> > Ok, but I don't know how to integrate & use it in my current project since
> > there is no any documentation available about it.
> > So I chose alternate way but will figure out how to use Zephyr's library
> > in coming days.
> >
> > >>Before this, Admin will Blink LED on BLE Device before transferring
> > #CommonKey to it using Smartphone App.
> > >>Once user confirm it, then only #CommonKey get transfer as command to
> > 3rd characteristic & BLE device save it as #CommonKey.
> >
> > >>>>You can acheive confidentiality with the ECDH method, but without some
> > >>>>OOB mechanism you won't be able to securely authenticate the peer
> > you're
> > >>>>talking to. So I don't see this as any different than doing pairing
> > >>>>using NoInputNoOutput as the IO capability.
> >
> > Here, before initiating ECDH to generate share secret , Smartphone App
> > will send commands to LED lights that will blink it for while
> > & App will ask Admin User -> "Have you seen any Blinking LED ?"
> >
> > If he/she clicks on "yes" then only process go ahead.
> > [ Here APP will only connect to Devices which are in vicinity by checking
> > their signal strength (RSSI) ]
> > So I think, this method may solve the issue of Authentication. Am I right ?
> >
> > May be it is not enough....but I don't have any other option since LED
> > Lights generally does not have OOB channels.
> > I can't use NFC since not every phone have that feature. So ... ??
> >
> > Thank You !!
> >
> > On Sat, Mar 3, 2018 at 9:18 PM, Johan Hedberg <johan.hedberg@...>
> > wrote:
> >
> >> Hi Vikrant,
> >>
> >> micro-ecc is what the Zephyr TinyCrypt uses, and it is also what the
> >> Zephyr Bluetooth Security Manager (LE pairing) and mesh implementations
> >> use, so no need to start installing micro-ecc separately.
> >>
> >> You can acheive confidentiality with the ECDH method, but without some
> >> OOB mechanism you won't be able to securely authenticate the peer you're
> >> talking to. So I don't see this as any different than doing pairing
> >> using NoInputNoOutput as the IO capability.
> >>
> >> Johan
> >>
> >> On Sat, Mar 03, 2018, Vikrant More wrote:
> >> > Hello World !!
> >> >
> >> > I found solution as micro-ecc library -> https://github.com/kmackay/
> >> > micro-ecc
> >> > to generate #AdminKey or Master key on both sides without transferring
> >> > it on insecure Bluetooth Link.
> >> >
> >> > Thank You !!
> >> >
> >> > On Sat, Mar 3, 2018 at 12:57 PM, Vikrant More <vikrant8051@...>
> >> wrote:
> >> >
> >> > > Hello,
> >> > >
> >> > > How to use ECDH mechanism to establish common #AdminKey or Master Key,
> >> > > using functions defined in $zephyr_base/subsys/bluetooth/host/ecc.h
> >> for
> >> > > normal BLE devices ?
> >> > >
> >> > > We uses this concept, in Bluetooth Mesh where every time new
> >> > > Public-Private Key pair get generated on both sides,
> >> > > using which a Master key established after public keys get exchange
> >> over
> >> > > insecure channel.
> >> > >
> >> > > I think it will solve my issue. How to check this mechanism without
> >> > > Android/iOS App after implemented it on Device side ?
> >> > >
> >> > > Thank You !!
> >> > >
> >> > > On Fri, Mar 2, 2018 at 11:20 PM, Vikrant More <vikrant8051@...>
> >> > > wrote:
> >> > >
> >> > >> Hello,
> >> > >> If I enabled encryption or authentication to access BLE device
> >> > >> characteristic, we have to do OOB pairing.
> >> > >>
> >> > >> But in some cases, it is not possible like budget LED lights. In this
> >> > >> case, how to make secure communication at Zephyr App level using
> >> security
> >> > >> keys ?
> >> > >>
> >> > >> ------------------------------------------------------------
> >> > >> ----------------------------------------
> >> > >> This is my implementation where there are 3 characteristics:
> >> > >> 1) 1st (read) characteristic always generates 16 bytes of random data
> >> > >> 2) 2nd (write) characteristic used for authentication
> >> > >> 3) 3rd (write) characteristic which accepts commands
> >> > >>
> >> > >> When BLE device is in factory reset mode,
> >> > >> then Smartphone App read random data from 1st Characteristic & save
> >> it as
> >> > >> #AdminKey (AES-128) for that device.
> >> > >>
> >> > >> Then it again requests(read) another random data from 1st
> >> characteristic
> >> > >> , encrypt it using #AdminKey & send to 2nd characteristic.
> >> > >>
> >> > >> On BLE device side, it will decrypt data using #AdminKey & compare it
> >> > >> with recently send random data. If data matched then BLE device saves
> >> > >> #AdminKey on self flash memory.
> >> > >>
> >> > >> So every device will have unique #AdminKey.
> >> > >>
> >> > >> Now here after, Smartphone who send encrypted random data which is
> >> > >> encrypted using #AdminKey to 2nd characteristic will get #admin
> >> access.
> >> > >> (Random Data from 1st Characteristic)
> >> > >>
> >> > >> Now if I wanna give access to my guests or family members, then in
> >> that
> >> > >> case I have to set 16-bytes of #CommonKey (manually entered number)
> >> for all
> >> > >> BLE devices.
> >> > >>
> >> > >> Before this, Admin will Blink LED on BLE Device before transferring
> >> > >> #CommonKey to it using Smartphone App. Once user confirm it, then
> >> only
> >> > >> #CommonKey get transfer as command to 3rd characteristic & BLE
> >> device save
> >> > >> it as #CommonKey.
> >> > >>
> >> > >> As name suggest, #CommonKey is same for all devices. So here onward,
> >> > >> Smartphone who send encrypted random data using #CommonKey will get
> >> #guest
> >> > >> access of that BLE device. Using #guest access, in case of LED
> >> lights user
> >> > >> can only do On/Off & intensity control.
> >> > >>
> >> > >> So 3rd characteristic only accept commands when user authentic
> >> itself as
> >> > >> #admin or #guest.
> >> > >>
> >> > >> Can I go ahead with this method ?
> >> > >>
> >> > >> But I think it is not secure, since data is exchanged over
> >> unencrypted
> >> > >> link. Isn't it ?
> >> > >>
> >> > >> Is somebody has better robust secure solution as per my requirements
> >> ?
> >> > >>
> >> > >> Thank You !!
> >> > >>
> >> > >>
> >> > >>
> >> > >>
> >> > >>
> >> > >>
> >> > >>
> >> > >>
> >> > >>
> >> > >>
> >> > >>
> >> > >>
> >> > >>
> >> > >>
> >> > >
> >>
> >
> >


Re: Securing BLE device communication without OOB pairing (multiple devices)

Johan Hedberg
 

Hi Vikrant,

Zephyr's Bluetooth stack exposes ECC as standard HCI commands & events
through subsys/bluetooth/host/hci_ecc.c. And you're right that it's the
FIPS P-256 curve that both LE Secure Connections (LE Security Manager
enhancement that debuted with Bluetooth 4.1) and Mesh Provisioning use.
The micro-ecc library that TinyCrypt has a copy of can be found here:

ext/lib/crypto/tinycrypt/source/ecc*.c

The main header file is here:

ext/lib/crypto/tinycrypt/include/tinycrypt/ecc.h

Johan

On Sun, Mar 04, 2018, Vikrant More wrote:
Hi Johan,

https://github.com/kmackay/micro-ecc has support for 5 standard curves:
secp160r1, secp192r1, secp224r1, secp256r1, and secp256k1.

Out of *secp256r1* and *secp256k1*, which one is used by Zephyr
#BluetoothMesh ?

As per #BluetoothMesh specs, it should be FIPS-P256 curve.
Is Zephyr built in *micro*-*ecc* library different than what I am currently
using ?

Thank You!!

On Sun, Mar 4, 2018 at 1:16 AM, Vikrant More <vikrant8051@...> wrote:

Hi Johan,

Thanks for reply !!

Ok, but I don't know how to integrate & use it in my current project since
there is no any documentation available about it.
So I chose alternate way but will figure out how to use Zephyr's library
in coming days.

Before this, Admin will Blink LED on BLE Device before transferring
#CommonKey to it using Smartphone App.
Once user confirm it, then only #CommonKey get transfer as command to
3rd characteristic & BLE device save it as #CommonKey.

You can acheive confidentiality with the ECDH method, but without some
OOB mechanism you won't be able to securely authenticate the peer
you're
talking to. So I don't see this as any different than doing pairing
using NoInputNoOutput as the IO capability.
Here, before initiating ECDH to generate share secret , Smartphone App
will send commands to LED lights that will blink it for while
& App will ask Admin User -> "Have you seen any Blinking LED ?"

If he/she clicks on "yes" then only process go ahead.
[ Here APP will only connect to Devices which are in vicinity by checking
their signal strength (RSSI) ]
So I think, this method may solve the issue of Authentication. Am I right ?

May be it is not enough....but I don't have any other option since LED
Lights generally does not have OOB channels.
I can't use NFC since not every phone have that feature. So ... ??

Thank You !!

On Sat, Mar 3, 2018 at 9:18 PM, Johan Hedberg <johan.hedberg@...>
wrote:

Hi Vikrant,

micro-ecc is what the Zephyr TinyCrypt uses, and it is also what the
Zephyr Bluetooth Security Manager (LE pairing) and mesh implementations
use, so no need to start installing micro-ecc separately.

You can acheive confidentiality with the ECDH method, but without some
OOB mechanism you won't be able to securely authenticate the peer you're
talking to. So I don't see this as any different than doing pairing
using NoInputNoOutput as the IO capability.

Johan

On Sat, Mar 03, 2018, Vikrant More wrote:
Hello World !!

I found solution as micro-ecc library -> https://github.com/kmackay/
micro-ecc
to generate #AdminKey or Master key on both sides without transferring
it on insecure Bluetooth Link.

Thank You !!

On Sat, Mar 3, 2018 at 12:57 PM, Vikrant More <vikrant8051@...>
wrote:

Hello,

How to use ECDH mechanism to establish common #AdminKey or Master Key,
using functions defined in $zephyr_base/subsys/bluetooth/host/ecc.h
for
normal BLE devices ?

We uses this concept, in Bluetooth Mesh where every time new
Public-Private Key pair get generated on both sides,
using which a Master key established after public keys get exchange
over
insecure channel.

I think it will solve my issue. How to check this mechanism without
Android/iOS App after implemented it on Device side ?

Thank You !!

On Fri, Mar 2, 2018 at 11:20 PM, Vikrant More <vikrant8051@...>
wrote:

Hello,
If I enabled encryption or authentication to access BLE device
characteristic, we have to do OOB pairing.

But in some cases, it is not possible like budget LED lights. In this
case, how to make secure communication at Zephyr App level using
security
keys ?

------------------------------------------------------------
----------------------------------------
This is my implementation where there are 3 characteristics:
1) 1st (read) characteristic always generates 16 bytes of random data
2) 2nd (write) characteristic used for authentication
3) 3rd (write) characteristic which accepts commands

When BLE device is in factory reset mode,
then Smartphone App read random data from 1st Characteristic & save
it as
#AdminKey (AES-128) for that device.

Then it again requests(read) another random data from 1st
characteristic
, encrypt it using #AdminKey & send to 2nd characteristic.

On BLE device side, it will decrypt data using #AdminKey & compare it
with recently send random data. If data matched then BLE device saves
#AdminKey on self flash memory.

So every device will have unique #AdminKey.

Now here after, Smartphone who send encrypted random data which is
encrypted using #AdminKey to 2nd characteristic will get #admin
access.
(Random Data from 1st Characteristic)

Now if I wanna give access to my guests or family members, then in
that
case I have to set 16-bytes of #CommonKey (manually entered number)
for all
BLE devices.

Before this, Admin will Blink LED on BLE Device before transferring
#CommonKey to it using Smartphone App. Once user confirm it, then
only
#CommonKey get transfer as command to 3rd characteristic & BLE
device save
it as #CommonKey.

As name suggest, #CommonKey is same for all devices. So here onward,
Smartphone who send encrypted random data using #CommonKey will get
#guest
access of that BLE device. Using #guest access, in case of LED
lights user
can only do On/Off & intensity control.

So 3rd characteristic only accept commands when user authentic
itself as
#admin or #guest.

Can I go ahead with this method ?

But I think it is not secure, since data is exchanged over
unencrypted
link. Isn't it ?

Is somebody has better robust secure solution as per my requirements
?

Thank You !!














Re: Securing BLE device communication without OOB pairing (multiple devices)

Vikrant More <vikrant8051@...>
 

Hi Johan,

https://github.com/kmackay/micro-ecc has support for 5 standard curves: secp160r1, secp192r1, secp224r1, secp256r1, and secp256k1.

Out of secp256r1 and secp256k1, which one is used by Zephyr #BluetoothMesh ?

As per #BluetoothMesh specs, it should be FIPS-P256 curve.
Is Zephyr built in micro-ecc library different than what I am currently using ?

Thank You!!

On Sun, Mar 4, 2018 at 1:16 AM, Vikrant More <vikrant8051@...> wrote:
Hi Johan,

Thanks for reply !!

Ok, but I don't know how to integrate & use it in my current project since there is no any documentation available about it.
So I chose alternate way but will figure out how to use Zephyr's library in coming days.

>>Before this, Admin will Blink LED on BLE Device before transferring #CommonKey to it using Smartphone App.
>>Once user confirm it, then only #CommonKey get transfer as command to 3rd characteristic & BLE device save it as #CommonKey.

>>>>You can acheive confidentiality with the ECDH method, but without some
>>>>OOB mechanism you won't be able to securely authenticate the peer you're
>>>>talking to. So I don't see this as any different than doing pairing
>>>>using NoInputNoOutput as the IO capability.

Here, before initiating ECDH to generate share secret , Smartphone App will send commands to LED lights that will blink it for while
& App will ask Admin User -> "Have you seen any Blinking LED ?"

If he/she clicks on "yes" then only process go ahead.
[ Here APP will only connect to Devices which are in vicinity by checking their signal strength (RSSI) ]
So I think, this method may solve the issue of Authentication. Am I right ?

May be it is not enough....but I don't have any other option since LED Lights generally does not have OOB channels.
I can't use NFC since not every phone have that feature. So ... ??

Thank You !!

On Sat, Mar 3, 2018 at 9:18 PM, Johan Hedberg <johan.hedberg@...> wrote:
Hi Vikrant,

micro-ecc is what the Zephyr TinyCrypt uses, and it is also what the
Zephyr Bluetooth Security Manager (LE pairing) and mesh implementations
use, so no need to start installing micro-ecc separately.

You can acheive confidentiality with the ECDH method, but without some
OOB mechanism you won't be able to securely authenticate the peer you're
talking to. So I don't see this as any different than doing pairing
using NoInputNoOutput as the IO capability.

Johan

On Sat, Mar 03, 2018, Vikrant More wrote:
> Hello World !!
>
> I found solution as micro-ecc library -> https://github.com/kmackay/
> micro-ecc
> to generate #AdminKey or Master key on both sides without transferring
> it on insecure Bluetooth Link.
>
> Thank You !!
>
> On Sat, Mar 3, 2018 at 12:57 PM, Vikrant More <vikrant8051@...> wrote:
>
> > Hello,
> >
> > How to use ECDH mechanism to establish common #AdminKey or Master Key,
> > using functions defined in $zephyr_base/subsys/bluetooth/host/ecc.h for
> > normal BLE devices ?
> >
> > We uses this concept, in Bluetooth Mesh where every time new
> > Public-Private Key pair get generated on both sides,
> > using which a Master key established after public keys get exchange over
> > insecure channel.
> >
> > I think it will solve my issue. How to check this mechanism without
> > Android/iOS App after implemented it on Device side ?
> >
> > Thank You !!
> >
> > On Fri, Mar 2, 2018 at 11:20 PM, Vikrant More <vikrant8051@...>
> > wrote:
> >
> >> Hello,
> >> If I enabled encryption or authentication to access BLE device
> >> characteristic, we have to do OOB pairing.
> >>
> >> But in some cases, it is not possible like budget LED lights. In this
> >> case, how to make secure communication at Zephyr App level using security
> >> keys ?
> >>
> >> ------------------------------------------------------------
> >> ----------------------------------------
> >> This is my implementation where there are 3 characteristics:
> >> 1) 1st (read) characteristic always generates 16 bytes of random data
> >> 2) 2nd (write) characteristic used for authentication
> >> 3) 3rd (write) characteristic which accepts commands
> >>
> >> When BLE device is in factory reset mode,
> >> then Smartphone App read random data from 1st Characteristic & save it as
> >> #AdminKey (AES-128) for that device.
> >>
> >> Then it again requests(read) another random data from 1st characteristic
> >> , encrypt it using #AdminKey & send to 2nd characteristic.
> >>
> >> On BLE device side, it will decrypt data using #AdminKey & compare it
> >> with recently send random data. If data matched then BLE device saves
> >> #AdminKey on self flash memory.
> >>
> >> So every device will have unique #AdminKey.
> >>
> >> Now here after, Smartphone who send encrypted random data which is
> >> encrypted using #AdminKey to 2nd characteristic will get #admin access.
> >> (Random Data from 1st Characteristic)
> >>
> >> Now if I wanna give access to my guests or family members, then in that
> >> case I have to set 16-bytes of #CommonKey (manually entered number) for all
> >> BLE devices.
> >>
> >> Before this, Admin will Blink LED on BLE Device before transferring
> >> #CommonKey to it using Smartphone App. Once user confirm it, then only
> >> #CommonKey get transfer as command to 3rd characteristic & BLE device save
> >> it as #CommonKey.
> >>
> >> As name suggest, #CommonKey is same for all devices. So here onward,
> >> Smartphone who send encrypted random data using #CommonKey will get #guest
> >> access of that BLE device. Using #guest access, in case of LED lights user
> >> can only do On/Off & intensity control.
> >>
> >> So 3rd characteristic only accept commands when user authentic itself as
> >> #admin or #guest.
> >>
> >> Can I go ahead with this method ?
> >>
> >> But I think it is not secure, since data is exchanged over unencrypted
> >> link. Isn't it ?
> >>
> >> Is somebody has better robust secure solution as per my requirements ?
> >>
> >> Thank You !!
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >



Re: Securing BLE device communication without OOB pairing (multiple devices)

Vikrant More <vikrant8051@...>
 

Hi Johan,

Thanks for reply !!

Ok, but I don't know how to integrate & use it in my current project since there is no any documentation available about it.
So I chose alternate way but will figure out how to use Zephyr's library in coming days.

>>Before this, Admin will Blink LED on BLE Device before transferring #CommonKey to it using Smartphone App.
>>Once user confirm it, then only #CommonKey get transfer as command to 3rd characteristic & BLE device save it as #CommonKey.

>>>>You can acheive confidentiality with the ECDH method, but without some
>>>>OOB mechanism you won't be able to securely authenticate the peer you're
>>>>talking to. So I don't see this as any different than doing pairing
>>>>using NoInputNoOutput as the IO capability.

Here, before initiating ECDH to generate share secret , Smartphone App will send commands to LED lights that will blink it for while
& App will ask Admin User -> "Have you seen any Blinking LED ?"

If he/she clicks on "yes" then only process go ahead.
[ Here APP will only connect to Devices which are in vicinity by checking their signal strength (RSSI) ]
So I think, this method may solve the issue of Authentication. Am I right ?

May be it is not enough....but I don't have any other option since LED Lights generally does not have OOB channels.
I can't use NFC since not every phone have that feature. So ... ??

Thank You !!

On Sat, Mar 3, 2018 at 9:18 PM, Johan Hedberg <johan.hedberg@...> wrote:
Hi Vikrant,

micro-ecc is what the Zephyr TinyCrypt uses, and it is also what the
Zephyr Bluetooth Security Manager (LE pairing) and mesh implementations
use, so no need to start installing micro-ecc separately.

You can acheive confidentiality with the ECDH method, but without some
OOB mechanism you won't be able to securely authenticate the peer you're
talking to. So I don't see this as any different than doing pairing
using NoInputNoOutput as the IO capability.

Johan

On Sat, Mar 03, 2018, Vikrant More wrote:
> Hello World !!
>
> I found solution as micro-ecc library -> https://github.com/kmackay/
> micro-ecc
> to generate #AdminKey or Master key on both sides without transferring
> it on insecure Bluetooth Link.
>
> Thank You !!
>
> On Sat, Mar 3, 2018 at 12:57 PM, Vikrant More <vikrant8051@...> wrote:
>
> > Hello,
> >
> > How to use ECDH mechanism to establish common #AdminKey or Master Key,
> > using functions defined in $zephyr_base/subsys/bluetooth/host/ecc.h for
> > normal BLE devices ?
> >
> > We uses this concept, in Bluetooth Mesh where every time new
> > Public-Private Key pair get generated on both sides,
> > using which a Master key established after public keys get exchange over
> > insecure channel.
> >
> > I think it will solve my issue. How to check this mechanism without
> > Android/iOS App after implemented it on Device side ?
> >
> > Thank You !!
> >
> > On Fri, Mar 2, 2018 at 11:20 PM, Vikrant More <vikrant8051@...>
> > wrote:
> >
> >> Hello,
> >> If I enabled encryption or authentication to access BLE device
> >> characteristic, we have to do OOB pairing.
> >>
> >> But in some cases, it is not possible like budget LED lights. In this
> >> case, how to make secure communication at Zephyr App level using security
> >> keys ?
> >>
> >> ------------------------------------------------------------
> >> ----------------------------------------
> >> This is my implementation where there are 3 characteristics:
> >> 1) 1st (read) characteristic always generates 16 bytes of random data
> >> 2) 2nd (write) characteristic used for authentication
> >> 3) 3rd (write) characteristic which accepts commands
> >>
> >> When BLE device is in factory reset mode,
> >> then Smartphone App read random data from 1st Characteristic & save it as
> >> #AdminKey (AES-128) for that device.
> >>
> >> Then it again requests(read) another random data from 1st characteristic
> >> , encrypt it using #AdminKey & send to 2nd characteristic.
> >>
> >> On BLE device side, it will decrypt data using #AdminKey & compare it
> >> with recently send random data. If data matched then BLE device saves
> >> #AdminKey on self flash memory.
> >>
> >> So every device will have unique #AdminKey.
> >>
> >> Now here after, Smartphone who send encrypted random data which is
> >> encrypted using #AdminKey to 2nd characteristic will get #admin access.
> >> (Random Data from 1st Characteristic)
> >>
> >> Now if I wanna give access to my guests or family members, then in that
> >> case I have to set 16-bytes of #CommonKey (manually entered number) for all
> >> BLE devices.
> >>
> >> Before this, Admin will Blink LED on BLE Device before transferring
> >> #CommonKey to it using Smartphone App. Once user confirm it, then only
> >> #CommonKey get transfer as command to 3rd characteristic & BLE device save
> >> it as #CommonKey.
> >>
> >> As name suggest, #CommonKey is same for all devices. So here onward,
> >> Smartphone who send encrypted random data using #CommonKey will get #guest
> >> access of that BLE device. Using #guest access, in case of LED lights user
> >> can only do On/Off & intensity control.
> >>
> >> So 3rd characteristic only accept commands when user authentic itself as
> >> #admin or #guest.
> >>
> >> Can I go ahead with this method ?
> >>
> >> But I think it is not secure, since data is exchanged over unencrypted
> >> link. Isn't it ?
> >>
> >> Is somebody has better robust secure solution as per my requirements ?
> >>
> >> Thank You !!
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >


Re: Securing BLE device communication without OOB pairing (multiple devices)

Johan Hedberg
 

Hi Vikrant,

micro-ecc is what the Zephyr TinyCrypt uses, and it is also what the
Zephyr Bluetooth Security Manager (LE pairing) and mesh implementations
use, so no need to start installing micro-ecc separately.

You can acheive confidentiality with the ECDH method, but without some
OOB mechanism you won't be able to securely authenticate the peer you're
talking to. So I don't see this as any different than doing pairing
using NoInputNoOutput as the IO capability.

Johan

On Sat, Mar 03, 2018, Vikrant More wrote:
Hello World !!

I found solution as micro-ecc library -> https://github.com/kmackay/
micro-ecc
to generate #AdminKey or Master key on both sides without transferring
it on insecure Bluetooth Link.

Thank You !!

On Sat, Mar 3, 2018 at 12:57 PM, Vikrant More <vikrant8051@...> wrote:

Hello,

How to use ECDH mechanism to establish common #AdminKey or Master Key,
using functions defined in $zephyr_base/subsys/bluetooth/host/ecc.h for
normal BLE devices ?

We uses this concept, in Bluetooth Mesh where every time new
Public-Private Key pair get generated on both sides,
using which a Master key established after public keys get exchange over
insecure channel.

I think it will solve my issue. How to check this mechanism without
Android/iOS App after implemented it on Device side ?

Thank You !!

On Fri, Mar 2, 2018 at 11:20 PM, Vikrant More <vikrant8051@...>
wrote:

Hello,
If I enabled encryption or authentication to access BLE device
characteristic, we have to do OOB pairing.

But in some cases, it is not possible like budget LED lights. In this
case, how to make secure communication at Zephyr App level using security
keys ?

------------------------------------------------------------
----------------------------------------
This is my implementation where there are 3 characteristics:
1) 1st (read) characteristic always generates 16 bytes of random data
2) 2nd (write) characteristic used for authentication
3) 3rd (write) characteristic which accepts commands

When BLE device is in factory reset mode,
then Smartphone App read random data from 1st Characteristic & save it as
#AdminKey (AES-128) for that device.

Then it again requests(read) another random data from 1st characteristic
, encrypt it using #AdminKey & send to 2nd characteristic.

On BLE device side, it will decrypt data using #AdminKey & compare it
with recently send random data. If data matched then BLE device saves
#AdminKey on self flash memory.

So every device will have unique #AdminKey.

Now here after, Smartphone who send encrypted random data which is
encrypted using #AdminKey to 2nd characteristic will get #admin access.
(Random Data from 1st Characteristic)

Now if I wanna give access to my guests or family members, then in that
case I have to set 16-bytes of #CommonKey (manually entered number) for all
BLE devices.

Before this, Admin will Blink LED on BLE Device before transferring
#CommonKey to it using Smartphone App. Once user confirm it, then only
#CommonKey get transfer as command to 3rd characteristic & BLE device save
it as #CommonKey.

As name suggest, #CommonKey is same for all devices. So here onward,
Smartphone who send encrypted random data using #CommonKey will get #guest
access of that BLE device. Using #guest access, in case of LED lights user
can only do On/Off & intensity control.

So 3rd characteristic only accept commands when user authentic itself as
#admin or #guest.

Can I go ahead with this method ?

But I think it is not secure, since data is exchanged over unencrypted
link. Isn't it ?

Is somebody has better robust secure solution as per my requirements ?

Thank You !!














Re: Securing BLE device communication without OOB pairing (multiple devices)

Vikrant More <vikrant8051@...>
 

Hello World !!

I found solution as micro-ecc library -> https://github.com/kmackay/micro-ecc
to generate #AdminKey or Master key on both sides without transferring
it on insecure Bluetooth Link.

Thank You !! 

On Sat, Mar 3, 2018 at 12:57 PM, Vikrant More <vikrant8051@...> wrote:
Hello,

How to use ECDH mechanism to establish common #AdminKey or Master Key,
using functions defined in $zephyr_base/subsys/bluetooth/host/ecc.h for normal BLE devices ?

We uses this concept, in Bluetooth Mesh where every time new Public-Private Key pair get generated on both sides,
using which a Master key established after public keys get exchange over insecure channel.

I think it will solve my issue. How to check this mechanism without Android/iOS App after implemented it on Device side ?

Thank You !!

On Fri, Mar 2, 2018 at 11:20 PM, Vikrant More <vikrant8051@...> wrote:
Hello,
If I enabled encryption or authentication to access BLE device characteristic, we have to do OOB pairing.

But in some cases, it is not possible like budget LED lights. In this case, how to make secure communication at Zephyr App level using security keys ?

----------------------------------------------------------------------------------------------------
This is my implementation where there are 3 characteristics:
1) 1st (read) characteristic always generates 16 bytes of random data
2) 2nd (write) characteristic used for authentication
3) 3rd (write) characteristic which accepts commands

When BLE device is in factory reset mode, 
then Smartphone App read random data from 1st Characteristic & save it as #AdminKey (AES-128) for that device.

Then it again requests(read) another random data from 1st characteristic , encrypt it using #AdminKey & send to 2nd characteristic.

On BLE device side, it will decrypt data using #AdminKey & compare it with recently send random data. If data matched then BLE device saves #AdminKey on self flash memory.

So every device will have unique #AdminKey.

Now here after, Smartphone who send encrypted random data which is encrypted using #AdminKey to 2nd characteristic will get #admin access. (Random Data from 1st Characteristic)

Now if I wanna give access to my guests or family members, then in that case I have to set 16-bytes of #CommonKey (manually entered number) for all BLE devices.

Before this, Admin will Blink LED on BLE Device before transferring #CommonKey to it using Smartphone App. Once user confirm it, then only #CommonKey get transfer as command to 3rd characteristic & BLE device save it as #CommonKey.

As name suggest, #CommonKey is same for all devices. So here onward, Smartphone who send encrypted random data using #CommonKey will get #guest access of that BLE device. Using #guest access, in case of LED lights user can only do On/Off & intensity control.

So 3rd characteristic only accept commands when user authentic itself as #admin or #guest.

Can I go ahead with this method ?

But I think it is not secure, since data is exchanged over unencrypted link. Isn't it ?

Is somebody has better robust secure solution as per my requirements ?

Thank You !!
















Re: Securing BLE device communication without OOB pairing (multiple devices)

Vikrant More <vikrant8051@...>
 

Hello,

How to use ECDH mechanism to establish common #AdminKey or Master Key,
using functions defined in $zephyr_base/subsys/bluetooth/host/ecc.h for normal BLE devices ?

We uses this concept, in Bluetooth Mesh where every time new Public-Private Key pair get generated on both sides,
using which a Master key established after public keys get exchange over insecure channel.

I think it will solve my issue. How to check this mechanism without Android/iOS App after implemented it on Device side ?

Thank You !!

On Fri, Mar 2, 2018 at 11:20 PM, Vikrant More <vikrant8051@...> wrote:
Hello,
If I enabled encryption or authentication to access BLE device characteristic, we have to do OOB pairing.

But in some cases, it is not possible like budget LED lights. In this case, how to make secure communication at Zephyr App level using security keys ?

----------------------------------------------------------------------------------------------------
This is my implementation where there are 3 characteristics:
1) 1st (read) characteristic always generates 16 bytes of random data
2) 2nd (write) characteristic used for authentication
3) 3rd (write) characteristic which accepts commands

When BLE device is in factory reset mode, 
then Smartphone App read random data from 1st Characteristic & save it as #AdminKey (AES-128) for that device.

Then it again requests(read) another random data from 1st characteristic , encrypt it using #AdminKey & send to 2nd characteristic.

On BLE device side, it will decrypt data using #AdminKey & compare it with recently send random data. If data matched then BLE device saves #AdminKey on self flash memory.

So every device will have unique #AdminKey.

Now here after, Smartphone who send encrypted random data which is encrypted using #AdminKey to 2nd characteristic will get #admin access. (Random Data from 1st Characteristic)

Now if I wanna give access to my guests or family members, then in that case I have to set 16-bytes of #CommonKey (manually entered number) for all BLE devices.

Before this, Admin will Blink LED on BLE Device before transferring #CommonKey to it using Smartphone App. Once user confirm it, then only #CommonKey get transfer as command to 3rd characteristic & BLE device save it as #CommonKey.

As name suggest, #CommonKey is same for all devices. So here onward, Smartphone who send encrypted random data using #CommonKey will get #guest access of that BLE device. Using #guest access, in case of LED lights user can only do On/Off & intensity control.

So 3rd characteristic only accept commands when user authentic itself as #admin or #guest.

Can I go ahead with this method ?

But I think it is not secure, since data is exchanged over unencrypted link. Isn't it ?

Is somebody has better robust secure solution as per my requirements ?

Thank You !!















Securing BLE device communication without OOB pairing (multiple devices)

Vikrant More <vikrant8051@...>
 

Hello,
If I enabled encryption or authentication to access BLE device characteristic, we have to do OOB pairing.

But in some cases, it is not possible like budget LED lights. In this case, how to make secure communication at Zephyr App level using security keys ?

----------------------------------------------------------------------------------------------------
This is my implementation where there are 3 characteristics:
1) 1st (read) characteristic always generates 16 bytes of random data
2) 2nd (write) characteristic used for authentication
3) 3rd (write) characteristic which accepts commands

When BLE device is in factory reset mode, 
then Smartphone App read random data from 1st Characteristic & save it as #AdminKey (AES-128) for that device.

Then it again requests(read) another random data from 1st characteristic , encrypt it using #AdminKey & send to 2nd characteristic.

On BLE device side, it will decrypt data using #AdminKey & compare it with recently send random data. If data matched then BLE device saves #AdminKey on self flash memory.

So every device will have unique #AdminKey.

Now here after, Smartphone who send encrypted random data which is encrypted using #AdminKey to 2nd characteristic will get #admin access. (Random Data from 1st Characteristic)

Now if I wanna give access to my guests or family members, then in that case I have to set 16-bytes of #CommonKey (manually entered number) for all BLE devices.

Before this, Admin will Blink LED on BLE Device before transferring #CommonKey to it using Smartphone App. Once user confirm it, then only #CommonKey get transfer as command to 3rd characteristic & BLE device save it as #CommonKey.

As name suggest, #CommonKey is same for all devices. So here onward, Smartphone who send encrypted random data using #CommonKey will get #guest access of that BLE device. Using #guest access, in case of LED lights user can only do On/Off & intensity control.

So 3rd characteristic only accept commands when user authentic itself as #admin or #guest.

Can I go ahead with this method ?

But I think it is not secure, since data is exchanged over unencrypted link. Isn't it ?

Is somebody has better robust secure solution as per my requirements ?

Thank You !!














Re: bt_mesh_init error codes

Martin Woolley <mwoolley@...>
 

Johan, thanks a bunch for your comprehensive reply. You're correct that I started with the mesh_demo configuration and probably "borrowed" code from elsewhere as well, so that explains how I arrived here. The information on POSIX error numbers really helps... as I get more familiar with the code, hopefully I too will now be able to find where errors are being generated and deduce the reason.

I'll give this another try shortly!

-----Original Message-----
From: Johan Hedberg [mailto:johan.hedberg@...]
Sent: 23 February 2018 19:00
To: Martin Woolley <mwoolley@...>
Cc: zephyr-users@...
Subject: Re: [Zephyr-users] bt_mesh_init error codes

Hi Martin,

On Fri, Feb 23, 2018, Martin Woolley wrote:
Hi, where can I find return codes for bt_mesh_init (and other
functions for that matter). I know a negative value means it failed
but I was hoping for some thing that provides a description of
specific return codes. I’m getting -35 from bt_mesh_init. It could be
because it’s Friday and been a long week but there may be a better
explanation 😊

bt_mesh_init failed with err -35
Negative 'int' type errors in Zephyr generally map to POSIX error numbers. E.g. 35 is the same as ENOTSUP. Looking through the possible code paths that bt_mesh_init() triggers, it seems likely that the following snippet in bt_pub_key_gen() (in hci_core.c) is at fault:

/*
* We check for both "LE Read Local P-256 Public Key" and
* "LE Generate DH Key" support here since both commands are needed for
* ECC support. If "LE Generate DH Key" is not supported then there
* is no point in reading local public key.
*/
if (!(bt_dev.supported_commands[34] & 0x02) ||
!(bt_dev.supported_commands[34] & 0x04)) {
BT_WARN("ECC HCI commands not available");
return -ENOTSUP;
}

Btw, you should enable CONFIG_BT_DEBUG_LOG=y since that would have given you the error message above (assuming this code path is at fault).
Adding the following to your configuration should make the issue go
away:

CONFIG_BT_TINYCRYPT_ECC=y

I suspect you arrived here because you started off with the mesh_demo configuration. The mesh_demo app does self-provisioning and as such doesn't need ECDH. Now you've apparently enabled the provisioning protocol, but not made sure that you have ECDH available. This needs to be explicitly enabled, since in split host & controller situations (where the controller is on a separate core) the controller may be providing the ECDH HCI commands, in which case ECDH support on the host side is not needed (beyond being able to send these HCI commands).

Johan


Re: bt_mesh_init error codes

Johan Hedberg
 

Hi Martin,

On Fri, Feb 23, 2018, Martin Woolley wrote:
Hi, where can I find return codes for bt_mesh_init (and other
functions for that matter). I know a negative value means it failed
but I was hoping for some thing that provides a description of
specific return codes. I’m getting -35 from bt_mesh_init. It could be
because it’s Friday and been a long week but there may be a better
explanation 😊

bt_mesh_init failed with err -35
Negative 'int' type errors in Zephyr generally map to POSIX error
numbers. E.g. 35 is the same as ENOTSUP. Looking through the possible
code paths that bt_mesh_init() triggers, it seems likely that the
following snippet in bt_pub_key_gen() (in hci_core.c) is at fault:

/*
* We check for both "LE Read Local P-256 Public Key" and
* "LE Generate DH Key" support here since both commands are needed for
* ECC support. If "LE Generate DH Key" is not supported then there
* is no point in reading local public key.
*/
if (!(bt_dev.supported_commands[34] & 0x02) ||
!(bt_dev.supported_commands[34] & 0x04)) {
BT_WARN("ECC HCI commands not available");
return -ENOTSUP;
}

Btw, you should enable CONFIG_BT_DEBUG_LOG=y since that would have given
you the error message above (assuming this code path is at fault).
Adding the following to your configuration should make the issue go
away:

CONFIG_BT_TINYCRYPT_ECC=y

I suspect you arrived here because you started off with the mesh_demo
configuration. The mesh_demo app does self-provisioning and as such
doesn't need ECDH. Now you've apparently enabled the provisioning
protocol, but not made sure that you have ECDH available. This needs to
be explicitly enabled, since in split host & controller situations
(where the controller is on a separate core) the controller may be
providing the ECDH HCI commands, in which case ECDH support on the host
side is not needed (beyond being able to send these HCI commands).

Johan


bt_mesh_init error codes

Martin Woolley <mwoolley@...>
 

Hi, where can I find return codes for bt_mesh_init (and other functions for that matter). I know a negative value means it failed but I was hoping for some thing that provides a description of specific return codes. I’m getting -35 from bt_mesh_init. It could be because it’s Friday and been a long week but there may be a better explanation 😊

 

bt_mesh_init failed with err -35

 

Thanks

 

Martin


Re: Data channels as ADV channel in #BluetoothMesh ? #bluetoothmesh

Johan Hedberg
 

Hi Vikrant,

On Thu, Feb 22, 2018, Vikrant More wrote:
In older version of Bluetooth, only 3 channels are used for advertising.
But in Bluetooth 5 we can use data channels for advertising.

Can we use data channels as ADV channel by configuring Zephyr
#BluetoothMesh stack ?

If this possible then, that could increase efficiency of Mesh performance.
Agreed, but unfortunately it's not possible with Bluetooth Mesh 1.0.
That said, it's possible we'll see a future Mesh specification version
that allows taking advantage of Bluetooth 5.0 features.

Johan

2481 - 2500 of 3078