CC2640R2F: Retrieve Blueooth LTK?

Hester Corne

Part Number: CC2640R2F

Is it possible to retrieve the LTK from the device via the debugger? I'm using the SimplePeripheral example from the latest SDK and want to be able to observe the packets using a Bluetooth sniffer. I don't want to turn on debug keys but rather retrieve somehow the LTK being used. Does the LTK always go to a particular place in memory that I could perhaps read out via the debugger?

over 3 years ago

0 Ammar N over 3 years ago

TI__Mastermind 25810 points

Hey Hester,

I've assigned your post to a colleague to help with. Which SDK are you using currently?

0 Jan over 3 years ago

TI__Mastermind 42320 points

Hi Hester,

It is possible to extract the LTK used in a connection. Are you on the BLE or BLE5 stack? I would recommend referencing the GAP Bond Manager and LE Secure Connections (BLE | BLE5) section of the User's Guide. There are some instructions on how to do this on the CC13XX/CC26XX SDK BLE5-Stack User's Guide in the Extract Bonding Information section. Due to the code being written in a different SDK, some changes may be necessary. If you need any additional details, then please let me know.

Best Regards,

Jan

0 Hester Corne over 3 years ago in reply to Jan

Intellectual 790 points

Hi Jan,

I'm using BLE5 stack 5.30.00.03. I was hoping to be able to access the key without having to add any more code as my application is already being used. Could I perhaps read it out from the SNV?

Thanks,

Hester

0 Jan over 3 years ago in reply to Hester Corne

TI__Mastermind 42320 points

Hi Hester,

Accessing the LTK through SNV, may be possible. I would suggest referencing the following E2E thread for some additional details:

https://e2e.ti.com/f/1/t/671390

I would also suggest looking into the gapbongmgr.c file. The LTK is generated and stored in that file, so some minimal logic can be added to that file to retrieve the LTK during bonding.

Best Regards,

Jan

Bluetooth®︎

Bluetooth forum

CC2640R2F: Retrieve Blueooth LTK?