Encryption at connection level?

[andrewhodel]

I know ble works by broadcasting and that methods like ccm are available.

In cryptography, a cipher block chaining message authentication code (CBC-MAC) is a technique for constructing a message authentication code from a block cipher. The message is encrypted with some block cipher algorithm in CBC mode to create a chain of blocks such that each block depends on the proper encryption of the previous block. This interdependence ensures that a change to any of the plaintext bits will cause the final encrypted block to change in a way that cannot be predicted or counteracted without knowing the key to the block cipher.

The trouble with that is that anyone could publish a message and it would mess up the next block process of decryption, effectively rendering the encryption and communication useless and still be legal as defined by fcc part 15.

Doesn’t this practically make ble useless as a protocol if there is no connection state tracking and layered encryption?

[sandeepmistry]

Hi @andrewhodel,

At a later date, this library will add support for SMP/pairing/encryption: https://community.nxp.com/thread/332191

I believe this will address your concern.

[andrewhodel]

Wouldn’t that mean that you need to pair the devices in a faraday cage, haha? With that the devices setup the link without user defined keys, which means if I have a $2 device sitting nearby it is always insecure and I can have my air conditioner think it is -10° in the house!

…

On Mon, Oct 7, 2019 at 8:44 AM Sandeep Mistry ***@***.***> wrote: Hi @andrewhodel <https://github.com/andrewhodel>, At a later date, this library will add support for SMP/pairing/encryption: https://community.nxp.com/thread/332191 I believe this will address your concern. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#36?email_source=notifications&email_token=AAFVCSPI674YG5YL6T3QILDQNM4LTA5CNFSM4I574VHKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEAQMHEI#issuecomment-539018129>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAFVCSO6TU66K55F34CFBBDQNM4LTANCNFSM4I574VHA> .

[gianmarcov]

Hi @sandeepmistry
I'm looking for the feature too.
When will the pairing with static passkey be implemented?

I soldered the SWD Pins on my BLE Nano 33 and and get the NRF52 SDK with Softdevice working with JLink on the nano, but is a workaround outside of the arduino ecosystem. For that what i want todo is a real overhead. I learned alot about the chip, but i think for a newcomer is it to complicated and time consuming.

The ESP32 (WLAN & BLE) has the pairing implemented with the passkey, but it consumes alot of battery capacity, so it's not an option for me.

[alexisicte]

Hi @sandeepmistry
I'm looking for the feature too.
When will the pairing with static passkey be implemented?

I soldered the SWD Pins on my BLE Nano 33 and and get the NRF52 SDK with Softdevice working with JLink on the nano, but is a workaround outside of the arduino ecosystem. For that what i want todo is a real overhead. I learned alot about the chip, but i think for a newcomer is it to complicated and time consuming.

The ESP32 (WLAN & BLE) has the pairing implemented with the passkey, but it consumes alot of battery capacity, so it's not an option for me.

In my opinion, this is the way to take advantage all of nRF52480 resources and create a efficient-code project. It has nothing to do with arduino ecosystem regarding software development, but arduino also offers the hardware, which a very cool way to create a prototype, avoiding designing a pcb with the ublox module in the first place.
Do you think is it possible to program nano without jlink programmer? I want to try with a simple ftdi. And why to use SWD pins and not the USB port directly?
Sorry for the irrelevant comment but i am seeking to program the arduino with nrf sdk.

[gianmarcov]

I readed in the mbed forum that is possible on windows or mac to create with mbed studio compiled version of the project as hex file for the Target NANO_BLE_33 and flash the hex over commandline tool like arduino ide does. (I'm waiting for notebook extension to boot Windows for getting more supported, it's seems that Linux is not friendly supported from companies that creates embedded stuff.)

The flashing over USB only possible if you use the Arduino Bootloader (on the board is not a programmer soldered), when the bootloader is not on the device, you need to flash it via SWD header or work over SWD-flasher (j-link or st-link) to bring your code on the device.

[gianmarcov]

I have interessant findings:
This library is only a compatibility layer providing for all Arduino Boards with differtent bluetooth chip to have an unique API, using an own implemented or adapted HCI Driver.

So we Arduino Nano BLE 33 owners don't need to use this library, when we plan to stay on mbed based arduinos.

We also already have a full working BLE API implementation that gets included and compiled in the final binary, take a look in the ArduinoCore-nRF528x-mbedos repo, we only need to use the mbed:: namespace mentioned in the README. (thanks to the mbed team and @facchinm)

BLE API:
https://os.mbed.com/docs/mbed-os/v5.14/apis/ble.html

@sandeepmistry
It would be nice if somewhere on the Arduino Website or in the ArduinoCore-nRF528x-mbedos or here, this information is made visible for all users with a little example, not wasting time to find any solutions, because they are alot on the www for the nordic chips.

[DerrickLau]

Ummm....Arduino is open source, right? I think we are expected to implement BLE security ourselves.

[exvisory]

Hiya - any idea when pairing will be supported by ArduinoBLE? I'm using a Nano 33 BLE as a Central but the peripheral (an app on an Android phone) requires pairing (bonding - is that the same thing?).

[aasodisen]

Pairing feature would be a big help for my application

[ebarnette-ms]

@sandeepmistry any chance you have an ETA on when pairing will be available?

[rmlearney-digicatapult]

From #36 (comment):

if I have a $2 device sitting nearby it is always insecure

All depends on your security model. Those $2 devices do exist, but they don't exist in my house right now when I'm doing the pairing. We can't let perfect be the enemy of good.

[nicolas-f]

Hello,

Pairing could be done using the microphone (ble v5 is 200m range in sight, data over sound is same room and < 5m range). So you could transfer the authentication passkey or full 128 bit key over audio (2 seconds tone) ?