Feedback

Exercise 1 – Add pairing support to a Bluetooth LE application

In this exercise, we will start with a version of the Bluetooth Peripheral LBS sample that does not have any security support. This is similar to the application we created in Lesson 4 Exercises 1 and 2, where we created our own custom LED Button Service. All characteristics of the service are open and anyone can read and write to them without any encryption. This also means anyone with a sniffer can follow the connection and read the exchanged data.

We will start by adding the encryption requirement to a LED characteristic’s write permission. Then, we will add pairing support to the application and practice encrypting the link to be able to write to the LED characteristic.

The second part of the exercise focuses on increasing the security level to have man-in-the-middle protection, i.e security level 3 and 4. We will add a display callback to display the passkey in the log output so that we can see the passkey and enter the key to the phone. This way, the end user can ensure that they are pairing to the correct device.

Exercise steps

In the GitHub repository for this course, go to the base code for this exercise, found in l5/l5_e1.

This is a slightly modified version of the Peripheral LBS sample in nRF Connect SDK. lbs.c and lbs.h have been moved from the original SDK folder into the applications src folder.

1. Add a security requirement to the LED characteristic

1.1 Change the LED characteristic permission to require encryption

In the declaration of the LED characteristic, add encryption requirement by changing BT_GATT_PERM_WRITE to BT_GATT_PERM_WRITE_ENCRYPT.

This will change the security level requirement from level 1 (no security) to level 2 (unauthenticated encryption) as covered in Security Models topic earlier.

Change the following code in lbs.c

BT_GATT_CHARACTERISTIC(BT_UUID_LBS_LED,
			       BT_GATT_CHRC_WRITE,
			       BT_GATT_PERM_WRITE_ENCRYPT,
			       NULL, write_led, NULL),

Copy

BT_GATT_CHARACTERISTIC(BT_UUID_LBS_LED,
			       BT_GATT_CHRC_WRITE,
			       BT_GATT_PERM_WRITE_ENCRYPT,
			       NULL, write_led, NULL),

2. Build and flash the application to the board.

3. Try to write to the LED characteristic.

In nRF Connect for Mobile, connect to the device Nordic_LBS. Try to write to the LED characteristic to turn it on, as we have done in previous exercises. Notice that the LED3 (LED2 on nRF54L Series DK) on the board does not react. This is because the characteristic now requires encryption, but the firmware does not have pairing support. The phone may terminate the connection because of this.

Let’s add pairing support to the firmware.

4. Add the Security Management Protocol layer to the Bluetooth LE stack.

The Kconfig symbol CONFIG_BT_SMP will add the Security manager Protocol to the Bluetooth LE stack, which is the layer that makes it possible to pair devices over Bluetooth LE.

Add the following line to the prj.conf file

CONFIG_BT_SMP=y

Copy

CONFIG_BT_SMP=y

Kconfig

5. Add a callback function for when the security level of the connection has changed.

Recall the connection callback structure struct bt_conn_cb that we used in the previous exercises. Let’s add a callback for the security_changed event as well.

5.1 Add the security_changed member to the callback structure

Add the following line in main.c

.security_changed = on_security_changed,

Copy

.security_changed = on_security_changed,

5.2 Define the callback function on_security_changed().

We want this callback function to display the current security level of the connection and inform if the link has been encrypted successfully or not.

Add the following code in main.c

static void on_security_changed(struct bt_conn *conn, bt_security_t level,
			     enum bt_security_err err)
{
	char addr[BT_ADDR_LE_STR_LEN];

	bt_addr_le_to_str(bt_conn_get_dst(conn), addr, sizeof(addr));

	if (!err) {
		LOG_INF("Security changed: %s level %u\n", addr, level);
	} else {
		LOG_INF("Security failed: %s level %u err %d\n", addr, level,
			err);
	}
}

Copy

static void on_security_changed(struct bt_conn *conn, bt_security_t level,
			     enum bt_security_err err)
{
	char addr[BT_ADDR_LE_STR_LEN];

	bt_addr_le_to_str(bt_conn_get_dst(conn), addr, sizeof(addr));

	if (!err) {
		LOG_INF("Security changed: %s level %u\n", addr, level);
	} else {
		LOG_INF("Security failed: %s level %u err %d\n", addr, level,
			err);
	}
}

6. Build and flash the application to the board.

Open up a terminal to see the log output from the application, which we will need to get the passkey.

Just like in previous exercises, you can go to Visual Studio Code and select the COM port for the device.

7. Try to write to the LED characteristic.

In nRF Connect for Mobile, connect to the device Nordic_LBS. Try to write to the LED characteristic to turn it on.

Verify that a pairing pop-up appears after you click Write. What happens here is that the phone automatically sends a pairing request after it get rejected when it try to write to the characteristic due to insufficient authentication.

Note

Depending on your notification configurations, the pairing request may not pop up, but remain as a tiny icon in the notification bar, which makes it easy to ignore until the connection times out.

Android
iOS

Select Pair to accept the pairing and the LED characteristic should now be possible to control. The Bluetooth LE link is now encrypted.

In the log, you should see the security level updated to level 2 in the UART log:

*** Booting nRF Connect SDK ***
Starting Lesson 5 - Exercise 1
Bluetooth initialized
Advertising successfully started
Connected
Security changed 7B:9E:28:DB:38:7A (random) level 2

Terminal

8. Change the LED characteristic permission to require pairing with authentication

In the declaration of the LED characteristic, add the authentication requirement by changing BT_GATT_PERM_WRITE_ENCRYPT to BT_GATT_PERM_WRITE_AUTHEN.

Change the following code in lbs.c

BT_GATT_CHARACTERISTIC(BT_UUID_LBS_LED,
			       BT_GATT_CHRC_WRITE,
			       BT_GATT_PERM_WRITE_AUTHEN,
			       NULL, write_led, NULL),

Copy

BT_GATT_CHARACTERISTIC(BT_UUID_LBS_LED,
			       BT_GATT_CHRC_WRITE,
			       BT_GATT_PERM_WRITE_AUTHEN,
			       NULL, write_led, NULL),

This will increase the security level of the write permission of this characteristic from level 2 to level 3 or 4, depending in whether you are using legacy pairing or LE Secure Connections.

At this stage, even though you would still be able to pair with the board, the phone wouldn’t be able to control the LED. This is because the security level of the application doesn’t meet the requirement of the characteristic permission.

9. Define authentication callback functions

We have the authenticated pairing callback structure struct bt_conn_auth_cb with numerous members. In our case, we will only add two.

9.1 Define the callback function auth_passkey_display

Let’s define a function for the passkey_display event, which has the following signature

This will print the passkey needed for the central (your phone) to pair with the peripheral (the board).

Add the following code in main.c

static void auth_passkey_display(struct bt_conn *conn, unsigned int passkey)
{
	char addr[BT_ADDR_LE_STR_LEN];
	bt_addr_le_to_str(bt_conn_get_dst(conn), addr, sizeof(addr));
	LOG_INF("Passkey for %s: %06u\n", addr, passkey);
}

Copy

static void auth_passkey_display(struct bt_conn *conn, unsigned int passkey)
{
	char addr[BT_ADDR_LE_STR_LEN];
	bt_addr_le_to_str(bt_conn_get_dst(conn), addr, sizeof(addr));
	LOG_INF("Passkey for %s: %06u\n", addr, passkey);
}

9.2 Define the callback function auth_cancel

Let’s define a function for the cancel event, which has the following signature

This will let us know when the pairing has been cancelled.

Add the following code in main.c

static void auth_cancel(struct bt_conn *conn)
{
	char addr[BT_ADDR_LE_STR_LEN];
	bt_addr_le_to_str(bt_conn_get_dst(conn), addr, sizeof(addr));
	LOG_INF("Pairing cancelled: %s\n", addr);
}

Copy

static void auth_cancel(struct bt_conn *conn)
{
	char addr[BT_ADDR_LE_STR_LEN];
	bt_addr_le_to_str(bt_conn_get_dst(conn), addr, sizeof(addr));
	LOG_INF("Pairing cancelled: %s\n", addr);
}

9.3 Declare the authenticated pairing callback structure struct bt_conn_auth_cb.

Let’s now declare the callback structure with the two member functions that we created in the previous steps.

Add the following code to main.c

static struct bt_conn_auth_cb conn_auth_callbacks = {
	.passkey_display = auth_passkey_display,
	.cancel = auth_cancel,
};

Copy

static struct bt_conn_auth_cb conn_auth_callbacks = {
	.passkey_display = auth_passkey_display,
	.cancel = auth_cancel,
};

10. Register the authentication callbacks.

Add the following code in main.c

err = bt_conn_auth_cb_register(&conn_auth_callbacks);
if (err) {
	LOG_INF("Failed to register authorization callbacks.\n");
	return -1;
}

Copy

err = bt_conn_auth_cb_register(&conn_auth_callbacks);
if (err) {
	LOG_INF("Failed to register authorization callbacks.\n");
	return -1;
}

The application now fulfills the requirements of pairing with MITM authentication needed for security level 3 or level 4.

11. Build and flash the application on the board.

11.1 Make sure you select Erase And Flash To Board, to remove the previous bonding information.

11.2 Remove the bond information from your phone.

On the phone, you would need to remove the bond information of the device as well.

Android
iOS

Android

Go to your Bluetooth settings, find the device and select the pin wheel next to it. Then select Unpair.

iOS

Go to your Bluetooth settings, find the device and select the information icon next to it. Then select Forget This Device.

12. Use your phone to connect the device and prompt the pairing request by writing to the LED characteristic.

As we have done previously, use nRF Connect for Mobile to connect to the device. Then try to write to the LED characteristic and the pairing pop-up window should appear, now with a PIN request.

Note

Depending on your notification configurations, the pairing request may not pop up, but remain as a tiny icon in the notification bar, which makes it easy to ignore until the connection times out.

Android
iOS

Android

iOS

The passkey, a 6-digit randomly generated number, will be in the log output from the device. You will need to type this passkey to the pop-up window on the phone.

In the log output below, the passkey is 043166.

*** Booting nRF Connect SDK ***
Starting Lesson 5 - Exercise 1
Bluetooth initialized
Advertising successfully started
Connected
Passkey for 48:18:67:01:CC:A8 (random): 043166

Terminal

If you enter the passkey correctly, the phone and the device will pair successfully and you will be able to control the LED.

Verify in the log output that you now have security level 3 (for legacy pairing) or 4 (for LE Secure Connections).

Connected
Passkey for 48:18:67:01:CC:A8 (random): 043166
Security changed 48:18:67:01:CC:A8 (random) level 4

Terminal

Nordic Developer Academy Terms of Service

1. Introduction

‍These terms and conditions (“Terms of Use”) apply to the use of the Nordic Developer Academy, provided by Nordic Semiconductor ASA, org. nr. 966 011 726, a public limited liability company registered in Norway (“Nordic Semiconductor”). ‍

Nordic Developer Academy allows the user to take technical courses related to Nordic Semiconductor products, software and services, and obtain a certificate certifying completion of these courses. By completing the registration process for the Nordic Developer Academy, you are agreeing to be bound by these Terms of Use.

These Terms of Use are applicable as long as you have a user account giving you access to Nordic Developer Academy.‍

‍2. Access to and use of Nordic Developer Academy

‍‍Upon acceptance of these Terms of Use you are granted a non-exclusive right of access to, and use of Nordic Developer Academy, as it is provided to you at any time. Nordic Semiconductor provides Nordic Developer Academy to you free of charge, subject to the provisions of these Terms of Use and the Nordic Developer Academy Privacy Policy.

To access select features of Nordic Developer Academy, you need to create a user account. You are solely responsible for the security associated with your user account, including always keeping your login details safe.

You will able to receive an electronic certificate from Nordic Developer Academy upon completion of courses. By issuing you such a certificate, Nordic Semiconductor certifies that you have completed the applicable course, but does not provide any further warrants or endorsements for any particular skills or professional qualifications.

Nordic Semiconductor will continuously develop Nordic Developer Academy with new features and functionality, but reserves the right to remove or alter any existing functions without notice.

‍3. Acceptable use

You undertake that you will use Nordic Developer Academy in accordance with applicable law and regulations, and in accordance with these Terms of Use.‍ You must not modify, adapt, or hack Nordic Developer Academy or modify another website so as to falsely imply that it is associated with Nordic Developer Academy, Nordic Semiconductor, or any other Nordic Semiconductor product, software or service.

You agree not to reproduce, duplicate, copy, sell, resell or in any other way exploit any portion of Nordic Developer Academy, use of Nordic Developer Academy, or access to Nordic Developer Academy without the express written permission by Nordic Semiconductor. You must not upload, post, host, or transmit unsolicited email, SMS, or \”spam\” messages.

You are responsible for ensuring that the information you post and the content you share does not;

contain false, misleading or otherwise erroneous information
infringe someone else’s copyrights or other intellectual property rights
contain sensitive personal data or
contain information that might be received as offensive or insulting.
Such information may be removed without prior notice.

‍Nordic Semiconductor reserves the right to at any time determine whether a use of Nordic Developer Academy is in violation of its requirements for acceptable use.

Violation of the at any time applicable requirements for acceptable use may result in termination of your account. We will take reasonable steps to notify you and state the reason for termination in such cases.

‍4. Routines for planned maintenance

‍Certain types of maintenance may imply a stop or reduction in availability of Nordic Developer Academy. Nordic Semiconductor does not warrant any level of service availability but will provide its best effort to limit the impact of any planned maintenance on the availability of Nordic Developer Academy.

5. Intellectual property rights

‍Nordic Semiconductor retains all rights to all elements of Nordic Developer Academy. This includes, but is not limited to, the concept, design, trademarks, know-how, trade secrets, copyrights and all other intellectual property rights.

Nordic Semiconductor receives all rights to all content uploaded or created in Nordic Developer Academy. You do not receive any license or usage rights to Nordic Developer Academy beyond what is explicitly stated in this Agreement.

‍6. Liability and damages

‍Nothing within these Terms of Use is intended to limit your statutory data privacy rights as a data subject, as described in the Nordic Developer Academy Privacy Policy. ‍You acknowledge that errors might occur from time to time and waive any right to claim for compensation as a result of errors in Nordic Developer Academy. When an error occurs, you shall notify Nordic Semiconductor of the error and provide a description of the error situation.

You agree to indemnify Nordic Semiconductor for any loss, including indirect loss, arising out of or in connection with your use of Nordic Developer Academy or violations of these Terms of Use. ‍Nordic Semiconductor shall not be held liable for, and does not warrant that (i) Nordic Developer Academy will meet your specific requirements, (ii) Nordic Developer Academy will be uninterrupted, timely, secure, or error-free, (iii) the results that may be obtained from the use of Nordic Developer Academy will be accurate or reliable, (iv) the quality of any products, services, information, or other material purchased or obtained by you through Nordic Developer Academy will meet your expectations, or that (v) any errors in Nordic Developer Academy will be corrected.

You accept that this is a service provided to you without any payment and hence you accept that Nordic Semiconductor will not be held responsible, or liable, for any breaches of these Terms of Use or any loss connected to your use of Nordic Developer Academy. Unless otherwise follows from mandatory law, Nordic Semiconductor will not accept any such responsibility or liability.

‍7. Change of terms

‍Nordic Semiconductor may update and change the Terms of Use from time to time. Nordic Semiconductor will seek to notify you about significant changes before such changes come into force and give you a possibility to evaluate the effects of proposed changes. Continued use of Nordic Developer Academy after any such changes shall constitute your acceptance of such changes. You can review the current version of the Terms of Use at any time at https://academy.nordicsemi.com/terms-of-service/

‍8. Transfer of rights

‍Nordic Semiconductor is entitled to transfer its rights and obligation pursuant to these Terms of Use to a third party as part of a merger or acquisition process, or as a result of other organizational changes.

‍9. Third Party Services

‍‍To the extent Nordic Developer Academy facilitates access to services provided by a third party, you agree to comply with the terms governing such third party services. Nordic Semiconductor shall not be held liable for any errors, omissions, inaccuracies, etc. related to such third party services.

‍10. Dispute resolution

‍‍The Terms of Use and any other legally binding agreement between yourself and Nordic Semiconductor shall be subject to Norwegian law and Norwegian courts’ exclusive jurisdiction.

Bluetooth Low Energy Fundamentals

Exercise 1 – Add pairing support to a Bluetooth LE application

Exercise steps

Note

Note

Switch language?

Change summary

What's new in the latest version

General updates

Bluetooth LE updates

MCUboot & Partition Manager