CC2640R2F: Secured connection: Print key on devices -> OOB?

Part Number: CC2640R2F
Other Parts Discussed in Thread: BLE-STACK

Hy,

my devices act as peripheral and have no user input or output. Communication must be secured (encrypted and authentication necessary), we plan to generate a random key during production and print this key on the housing. Every user that holds the device in his hands and can read the code (either hexified or coded to a QR code) is allowed to connect, read and write characteristics, every other user who can not see the device shall not be able to connect, read or write.

What is the correct pairing mode? OOB?

Where can I find descriptions about enabling OOB in a peripheral device?

The examples do not cover OOB.

I used simple peripheral to try. I set

#define DEFAULT_PAIRING_MODE                  GAPBOND_PAIRING_MODE_INITIATE
// in simple_peripheral_init(void)

  GAPBondMgr_SetParameter( GAPBOND_ERASE_ALLBONDS, 0, NULL );
  // Setup the GAP Bond Manager
  {
    uint8_t pairMode = DEFAULT_PAIRING_MODE;
    uint8_t mitm = FALSE;
    uint8_t ioCap = GAPBOND_IO_CAP_DISPLAY_ONLY;
    uint8_t bonding = TRUE;
    uint8_t scMode = GAPBOND_SECURE_CONNECTION_ONLY;
    uint8_t scEnabled = TRUE;
    // will be written during production into ext flash and read out here
    uint8_t myoobdata[KEYLEN] = {0,1,2,3,4,5,6,7,8,9,0x0a, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F};

    GAPBondMgr_SetParameter(GAPBOND_PAIRING_MODE, sizeof(uint8_t), &pairMode);
    GAPBondMgr_SetParameter(GAPBOND_MITM_PROTECTION, sizeof(uint8_t), &mitm);
    GAPBondMgr_SetParameter(GAPBOND_IO_CAPABILITIES, sizeof(uint8_t), &ioCap);
    GAPBondMgr_SetParameter(GAPBOND_BONDING_ENABLED, sizeof(uint8_t), &bonding);
    GAPBondMgr_SetParameter(GAPBOND_SECURE_CONNECTION, sizeof(uint8_t), &scMode);
    GAPBondMgr_SetParameter(GAPBOND_LOCAL_OOB_SC_DATA, KEYLEN, myoobdata);
    GAPBondMgr_SetParameter(GAPBOND_LOCAL_OOB_SC_ENABLED, sizeof(uint8_t), &scEnabled);
  }

Still, I can simply connect to the device with the BTool, no entering of the OOD data required.

Am I going the correct way? What is the correct way of securing connection? How do I implement this?

Regards

Harald