This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

TI SDK 1.40.00.45 : Crash when re-pairing with a peer device that lost or removed its bonding keys still exists

Other Parts Discussed in Thread: BLE-STACK, CC2640R2F

Hello,

I am using BLE Stack 3.1.1 with CC2640R2 SDK 1.40.00.45 in my project.

As per the fixed issues in release notes of TI BLE-Stack 3.01.00.45 (http://dev.ti.com/tirex/content/simplelink_cc2640r2_sdk_1_40_00_45/docs/blestack/release_notes_blestack_3_01_00_45.html#fixed-issues,

"Crash when re-pairing with a peer device that lost or removed its bonding keys" has been fixed.

Tested if the same has been fixed from my end.

When bond information is deleted from central (iPhone has been used) but not from peripheral ( CC2640R2 hardware), then re-pairing is requested and functionality works fine.

But, when bond information is deleted from peripheral by mass erase but not from central, then re-pairing is not done successfully.

Connection is done but services and characteristics are not displayed. Discovery happens only when bond information is deleted from central and re-tried for connection.

A query regarding this has already been posted :

https://e2e.ti.com/support/wireless_connectivity/bluetooth_low_energy/f/538/p/591082/2257931#2257931  

as part of which this issue should be solved with BLE Stack 3.1.0

Kindly provide your inputs.

Many Thanks,

Krithiga.

  • Hi Krithiga,

    Do you have a sniffer capture of the failure to start encryption? If you use Simple Central and Simple Peripheral instead of the iPhone does the same crash occur?
  • Hi Rachel,

    As discussed in the previous thread
    e2e.ti.com/.../2257931
    we have given all the proof for the issue.looks one side the issue got resolved
    could you please check and confirm the same at your end ?
  • Hello Krithiga,

    What you describe is not a "crash" but a potential issue on your central device. As Rachel requested, please kindly capture and attach a BLE air sniffer trace showing 1) the peripheral sending a "PIN or Key Missing" error code in response to an Encryption Request and 2) the central initiating a Pairing Request.

    In reference to the above, please see "10.3 AUTHENTICATION PROCEDURE" in the BT 4.2 core specification, Vol 3, Part C.

    Best wishes

  • Hello JXS and Rachel,

    I have collected the sniffer data.

    .zip files contains following two data :

    1. Sniffer Data when Bonding is deleted from Central (Android phone) but not on the peripheral (CC2640R2F hardware)

    2. Sniffer Data when Bonding is deleted from Peripheral(CC2640R2F hardware) but not on the central(Android phone)

    RE-pairing analysis.zip

     

     

     


    Kindly provide your inputs.

    Thanks,

    Krithiga

  • Hello,

    Kindly analyze the sniffer log attached when pairing is deleted from either central or peripheral end and provide your inputs.

    Thanks,

    Krithiga.

  • Hello Krithiga,

    As suspected, in the PeripheralDeleteData capture, the master is not re-initiating pairing in response to the Peripheral sending the Error code: PIN or Key Missing (0x06) in the LL_REJECT_IND. You may try to change the GapBond pairing mode to GAPBOND_PAIRING_MODE_WAIT_FOR_REQ as some smartphones do not work well when the slave sends the security request with GAPBOND_PAIRING_MODE_INITIATE. If that doesn't work, you'll need to manually delete the keys on the Central side.

    Best wishes

  • Hello JXS,

    By using GAPBOND_PAIRING_MODE_WAIT_FOR_REQ , I am able to bond and discover services successfully when bond information has been deleted either from Central or peripheral side. This successful execution has been tested with Android mobile.

    But the same is not possible using iPhone. Is there any other way rather than deleting bond information from iPhone end ?

    Please reply.

    Thanks,

    Krithiga.

  • Hello Krithiga,

    That's good to hear that you have a solution for Android.

    For iOS, unfortunately, I'm not aware of any way to programmatically make it re-pair if the peripheral lost its key but the bond info still resides on the phone (central). It used to be that you could send Error Code: Insufficient Authorization in response to a ATT Read/Write request and it would re-pair. I tried this on iOS11 / iPhone 8, and while it does prompt for and perform the (re)pairing, the phase bonding fails with the phone sending Pairing Failed: Unspecified Reason as shown in the sniffer capture:

    At this point, my recommendation is to update your customer documentation with procedural steps on how to forget the bonded device from the iOS Settings > Bluetooth menu.

    I hope this helps.

    Best wishes

  • Hello JXS,

    Thank you for your reply. This clears up the problem on iPhone end.

    As in iPhone, BLED112 dongle also does not ask for re-pair when bond information is deleted from Peripheral.

    Any input on is it possible from Dongle end and if so, how ?

    Many thanks,

    Krithiga.

  • Hello Krithiga,

    Although I can't comment on the BLED112 dongle as this is not a TI firmware product, I do have some good news of sorts to share. After further consolation with L2 support, I can confirm that the iOS device, even said iPhone 8, will re-pair/bond successfully if you send Insufficient Authorization (ATT_ERR_INSUFFICIENT_AUTHOR) to a GATT Read/Write provided you do not change your IRK. Previously, I was erasing the SNV page which not only erased the bond but also erased the IRK. Instead, if you call GAPBondMgr_SetParameter(GAPBOND_ERASE_ALLBONDS, 0, NULL) to clear the previous bonding(s) and send Insufficient Authorization as mentioned above, you will be able to re-pair/bond with iOS without having to visit the BT settings menu.

    How to know if you are bonded (encrypted)? You can use a global variable that gets updated when GAPBOND_PAIRING_STATE_COMPLETE or BOND_PAIRING_STATE_BONDED events are received with status=success. Then check your global variable in your Read/Write Attribute callback functions for the characteristics you want to protect.

    Best wishes

  • Hello JXS.

    Do you mean to say that SNV should not be erased ? Because, When Mass Erase is done on CC2640R2F, all pages including SNV will be erased.

    Also, call to GAPBondMgr_SetParameter(GAPBOND_ERASE_ALLBONDS, 0, NULL) cannot be placed on software end as it is not possible to know when peripheral end will lose the bond information and central would not.

    Kindly clarify if what you mentioned the call to GAPBondMgr_SetParameter(GAPBOND_ERASE_ALLBONDS, 0, NULL) and sending Insufficient Authorization is to *replace* deleting SNV page.

    Is my understanding correct ?

    Thanks,
    Krithiga.
  • Hello Krithiga,

    If the SNV erased this will also erase the peripheral's IRK. When the IRK is erased/re-generated, it appears iOS will require you to manually "Forget this device" from the BT Settings menu. It's likely a defensive measure to prevent spoofing the peripheral, although I can't say for sure.

    So yes, GAPBondMgr_SetParameter(GAPBOND_ERASE_ALLBONDS, 0, NULL) and sending Insufficient Authorization would be performed in lieu of deleting the SNV page (or doing a mass erase).

    Best wishes