xref: /btstack/src/ble/sm.c (revision 4cd5c7b426eb1b40cfe1fbefdeb839e5cb3e9c63)
13deb3ec6SMatthias Ringwald /*
23deb3ec6SMatthias Ringwald  * Copyright (C) 2014 BlueKitchen GmbH
33deb3ec6SMatthias Ringwald  *
43deb3ec6SMatthias Ringwald  * Redistribution and use in source and binary forms, with or without
53deb3ec6SMatthias Ringwald  * modification, are permitted provided that the following conditions
63deb3ec6SMatthias Ringwald  * are met:
73deb3ec6SMatthias Ringwald  *
83deb3ec6SMatthias Ringwald  * 1. Redistributions of source code must retain the above copyright
93deb3ec6SMatthias Ringwald  *    notice, this list of conditions and the following disclaimer.
103deb3ec6SMatthias Ringwald  * 2. Redistributions in binary form must reproduce the above copyright
113deb3ec6SMatthias Ringwald  *    notice, this list of conditions and the following disclaimer in the
123deb3ec6SMatthias Ringwald  *    documentation and/or other materials provided with the distribution.
133deb3ec6SMatthias Ringwald  * 3. Neither the name of the copyright holders nor the names of
143deb3ec6SMatthias Ringwald  *    contributors may be used to endorse or promote products derived
153deb3ec6SMatthias Ringwald  *    from this software without specific prior written permission.
163deb3ec6SMatthias Ringwald  * 4. Any redistribution, use, or modification is done solely for
173deb3ec6SMatthias Ringwald  *    personal benefit and not for any commercial purpose or for
183deb3ec6SMatthias Ringwald  *    monetary gain.
193deb3ec6SMatthias Ringwald  *
203deb3ec6SMatthias Ringwald  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
213deb3ec6SMatthias Ringwald  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
223deb3ec6SMatthias Ringwald  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
233deb3ec6SMatthias Ringwald  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
243deb3ec6SMatthias Ringwald  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
253deb3ec6SMatthias Ringwald  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
263deb3ec6SMatthias Ringwald  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
273deb3ec6SMatthias Ringwald  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
283deb3ec6SMatthias Ringwald  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
293deb3ec6SMatthias Ringwald  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
303deb3ec6SMatthias Ringwald  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
313deb3ec6SMatthias Ringwald  * SUCH DAMAGE.
323deb3ec6SMatthias Ringwald  *
333deb3ec6SMatthias Ringwald  * Please inquire about commercial licensing options at
343deb3ec6SMatthias Ringwald  * [email protected]
353deb3ec6SMatthias Ringwald  *
363deb3ec6SMatthias Ringwald  */
37ab2c6ae4SMatthias Ringwald 
38ab2c6ae4SMatthias Ringwald #define __BTSTACK_FILE__ "sm.c"
393deb3ec6SMatthias Ringwald 
403deb3ec6SMatthias Ringwald #include <stdio.h>
413deb3ec6SMatthias Ringwald #include <string.h>
423deb3ec6SMatthias Ringwald #include <inttypes.h>
433deb3ec6SMatthias Ringwald 
443edc84c5SMatthias Ringwald #include "ble/le_device_db.h"
4559c6af15SMatthias Ringwald #include "ble/core.h"
463edc84c5SMatthias Ringwald #include "ble/sm.h"
4761f37892SMatthias Ringwald #include "bluetooth_company_id.h"
480e2df43fSMatthias Ringwald #include "btstack_debug.h"
490e2df43fSMatthias Ringwald #include "btstack_event.h"
500e2df43fSMatthias Ringwald #include "btstack_linked_list.h"
510e2df43fSMatthias Ringwald #include "btstack_memory.h"
52f7a05cdaSMatthias Ringwald #include "gap.h"
530e2df43fSMatthias Ringwald #include "hci.h"
5413377825SMatthias Ringwald #include "hci_dump.h"
550e2df43fSMatthias Ringwald #include "l2cap.h"
563deb3ec6SMatthias Ringwald 
571a682202SMatthias Ringwald #if !defined(ENABLE_LE_PERIPHERAL) && !defined(ENABLE_LE_CENTRAL)
581a682202SMatthias Ringwald #error "LE Security Manager used, but neither ENABLE_LE_PERIPHERAL nor ENABLE_LE_CENTRAL defined. Please add at least one to btstack_config.h."
591a682202SMatthias Ringwald #endif
601a682202SMatthias Ringwald 
6142134bc6SMatthias Ringwald #if defined(ENABLE_LE_PERIPHERAL) && defined(ENABLE_LE_CENTRAL)
6242134bc6SMatthias Ringwald #define IS_RESPONDER(role) (role)
6342134bc6SMatthias Ringwald #else
6442134bc6SMatthias Ringwald #ifdef ENABLE_LE_CENTRAL
6542134bc6SMatthias Ringwald // only central - never responder (avoid 'unused variable' warnings)
6642134bc6SMatthias Ringwald #define IS_RESPONDER(role) (0 && role)
6742134bc6SMatthias Ringwald #else
6842134bc6SMatthias Ringwald // only peripheral - always responder (avoid 'unused variable' warnings)
6942134bc6SMatthias Ringwald #define IS_RESPONDER(role) (1 || role)
7042134bc6SMatthias Ringwald #endif
7142134bc6SMatthias Ringwald #endif
7242134bc6SMatthias Ringwald 
73e53be891SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
7435ef8655SMatthias Ringwald // assert SM Public Key can be sent/received
7535ef8655SMatthias Ringwald #if HCI_ACL_PAYLOAD_SIZE < 69
7635ef8655SMatthias Ringwald #error "HCI_ACL_PAYLOAD_SIZE must be at least 69 bytes when using LE Secure Conection. Please increase HCI_ACL_PAYLOAD_SIZE or disable ENABLE_LE_SECURE_CONNECTIONS"
7735ef8655SMatthias Ringwald #endif
7835ef8655SMatthias Ringwald 
797df18c15SMatthias Ringwald #ifdef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
807df18c15SMatthias Ringwald #error "Support for DHKEY Support in HCI Controller not implemented yet. Please use software implementation"
817df18c15SMatthias Ringwald #else
82c692d776SMatthias Ringwald #define USE_MICROECC_FOR_ECDH
837df18c15SMatthias Ringwald #endif
847df18c15SMatthias Ringwald #endif
857df18c15SMatthias Ringwald 
86c692d776SMatthias Ringwald // Software ECDH implementation provided by micro-ecc
87c692d776SMatthias Ringwald #ifdef USE_MICROECC_FOR_ECDH
88c692d776SMatthias Ringwald #include "uECC.h"
89c692d776SMatthias Ringwald #endif
90c692d776SMatthias Ringwald 
917a766ebfSMatthias Ringwald #if defined(ENABLE_LE_SIGNED_WRITE) || defined(ENABLE_LE_SECURE_CONNECTIONS)
927a766ebfSMatthias Ringwald #define ENABLE_CMAC_ENGINE
937a766ebfSMatthias Ringwald #endif
947a766ebfSMatthias Ringwald 
953deb3ec6SMatthias Ringwald //
963deb3ec6SMatthias Ringwald // SM internal types and globals
973deb3ec6SMatthias Ringwald //
983deb3ec6SMatthias Ringwald 
993deb3ec6SMatthias Ringwald typedef enum {
1003deb3ec6SMatthias Ringwald     DKG_W4_WORKING,
1013deb3ec6SMatthias Ringwald     DKG_CALC_IRK,
1023deb3ec6SMatthias Ringwald     DKG_W4_IRK,
1033deb3ec6SMatthias Ringwald     DKG_CALC_DHK,
1043deb3ec6SMatthias Ringwald     DKG_W4_DHK,
1053deb3ec6SMatthias Ringwald     DKG_READY
1063deb3ec6SMatthias Ringwald } derived_key_generation_t;
1073deb3ec6SMatthias Ringwald 
1083deb3ec6SMatthias Ringwald typedef enum {
1093deb3ec6SMatthias Ringwald     RAU_W4_WORKING,
1103deb3ec6SMatthias Ringwald     RAU_IDLE,
1113deb3ec6SMatthias Ringwald     RAU_GET_RANDOM,
1123deb3ec6SMatthias Ringwald     RAU_W4_RANDOM,
1133deb3ec6SMatthias Ringwald     RAU_GET_ENC,
1143deb3ec6SMatthias Ringwald     RAU_W4_ENC,
1153deb3ec6SMatthias Ringwald     RAU_SET_ADDRESS,
1163deb3ec6SMatthias Ringwald } random_address_update_t;
1173deb3ec6SMatthias Ringwald 
1183deb3ec6SMatthias Ringwald typedef enum {
1193deb3ec6SMatthias Ringwald     CMAC_IDLE,
1203deb3ec6SMatthias Ringwald     CMAC_CALC_SUBKEYS,
1213deb3ec6SMatthias Ringwald     CMAC_W4_SUBKEYS,
1223deb3ec6SMatthias Ringwald     CMAC_CALC_MI,
1233deb3ec6SMatthias Ringwald     CMAC_W4_MI,
1243deb3ec6SMatthias Ringwald     CMAC_CALC_MLAST,
1253deb3ec6SMatthias Ringwald     CMAC_W4_MLAST
1263deb3ec6SMatthias Ringwald } cmac_state_t;
1273deb3ec6SMatthias Ringwald 
1283deb3ec6SMatthias Ringwald typedef enum {
1293deb3ec6SMatthias Ringwald     JUST_WORKS,
13027c32905SMatthias Ringwald     PK_RESP_INPUT,  // Initiator displays PK, responder inputs PK
13127c32905SMatthias Ringwald     PK_INIT_INPUT,  // Responder displays PK, initiator inputs PK
1323deb3ec6SMatthias Ringwald     OK_BOTH_INPUT,  // Only input on both, both input PK
13327c32905SMatthias Ringwald     NK_BOTH_INPUT,  // Only numerical compparison (yes/no) on on both sides
1343deb3ec6SMatthias Ringwald     OOB             // OOB available on both sides
1353deb3ec6SMatthias Ringwald } stk_generation_method_t;
1363deb3ec6SMatthias Ringwald 
1373deb3ec6SMatthias Ringwald typedef enum {
1383deb3ec6SMatthias Ringwald     SM_USER_RESPONSE_IDLE,
1393deb3ec6SMatthias Ringwald     SM_USER_RESPONSE_PENDING,
1403deb3ec6SMatthias Ringwald     SM_USER_RESPONSE_CONFIRM,
1413deb3ec6SMatthias Ringwald     SM_USER_RESPONSE_PASSKEY,
1423deb3ec6SMatthias Ringwald     SM_USER_RESPONSE_DECLINE
1433deb3ec6SMatthias Ringwald } sm_user_response_t;
1443deb3ec6SMatthias Ringwald 
1453deb3ec6SMatthias Ringwald typedef enum {
1463deb3ec6SMatthias Ringwald     SM_AES128_IDLE,
1473deb3ec6SMatthias Ringwald     SM_AES128_ACTIVE
1483deb3ec6SMatthias Ringwald } sm_aes128_state_t;
1493deb3ec6SMatthias Ringwald 
1503deb3ec6SMatthias Ringwald typedef enum {
1513deb3ec6SMatthias Ringwald     ADDRESS_RESOLUTION_IDLE,
1523deb3ec6SMatthias Ringwald     ADDRESS_RESOLUTION_GENERAL,
1533deb3ec6SMatthias Ringwald     ADDRESS_RESOLUTION_FOR_CONNECTION,
1543deb3ec6SMatthias Ringwald } address_resolution_mode_t;
1553deb3ec6SMatthias Ringwald 
1563deb3ec6SMatthias Ringwald typedef enum {
1573deb3ec6SMatthias Ringwald     ADDRESS_RESOLUTION_SUCEEDED,
1583deb3ec6SMatthias Ringwald     ADDRESS_RESOLUTION_FAILED,
1593deb3ec6SMatthias Ringwald } address_resolution_event_t;
160901c000fSMatthias Ringwald 
161901c000fSMatthias Ringwald typedef enum {
1627df18c15SMatthias Ringwald     EC_KEY_GENERATION_IDLE,
1637df18c15SMatthias Ringwald     EC_KEY_GENERATION_ACTIVE,
16409e4d397SMatthias Ringwald     EC_KEY_GENERATION_W4_KEY,
1657df18c15SMatthias Ringwald     EC_KEY_GENERATION_DONE,
1667df18c15SMatthias Ringwald } ec_key_generation_state_t;
1677df18c15SMatthias Ringwald 
1687df18c15SMatthias Ringwald typedef enum {
169901c000fSMatthias Ringwald     SM_STATE_VAR_DHKEY_COMMAND_RECEIVED = 1 << 0
170901c000fSMatthias Ringwald } sm_state_var_t;
171901c000fSMatthias Ringwald 
1723deb3ec6SMatthias Ringwald //
1733deb3ec6SMatthias Ringwald // GLOBAL DATA
1743deb3ec6SMatthias Ringwald //
1753deb3ec6SMatthias Ringwald 
1763deb3ec6SMatthias Ringwald static uint8_t test_use_fixed_local_csrk;
1773deb3ec6SMatthias Ringwald 
1783deb3ec6SMatthias Ringwald // configuration
1793deb3ec6SMatthias Ringwald static uint8_t sm_accepted_stk_generation_methods;
1803deb3ec6SMatthias Ringwald static uint8_t sm_max_encryption_key_size;
1813deb3ec6SMatthias Ringwald static uint8_t sm_min_encryption_key_size;
1823deb3ec6SMatthias Ringwald static uint8_t sm_auth_req = 0;
1833deb3ec6SMatthias Ringwald static uint8_t sm_io_capabilities = IO_CAPABILITY_NO_INPUT_NO_OUTPUT;
1843deb3ec6SMatthias Ringwald static uint8_t sm_slave_request_security;
18531c09488SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
186df86eb96SMatthias Ringwald static uint8_t sm_have_ec_keypair;
18731c09488SMatthias Ringwald #endif
1883deb3ec6SMatthias Ringwald 
1893deb3ec6SMatthias Ringwald // Security Manager Master Keys, please use sm_set_er(er) and sm_set_ir(ir) with your own 128 bit random values
1903deb3ec6SMatthias Ringwald static sm_key_t sm_persistent_er;
1913deb3ec6SMatthias Ringwald static sm_key_t sm_persistent_ir;
1923deb3ec6SMatthias Ringwald 
1933deb3ec6SMatthias Ringwald // derived from sm_persistent_ir
1943deb3ec6SMatthias Ringwald static sm_key_t sm_persistent_dhk;
1953deb3ec6SMatthias Ringwald static sm_key_t sm_persistent_irk;
1963deb3ec6SMatthias Ringwald static uint8_t  sm_persistent_irk_ready = 0;    // used for testing
1973deb3ec6SMatthias Ringwald static derived_key_generation_t dkg_state;
1983deb3ec6SMatthias Ringwald 
1993deb3ec6SMatthias Ringwald // derived from sm_persistent_er
2003deb3ec6SMatthias Ringwald // ..
2013deb3ec6SMatthias Ringwald 
2023deb3ec6SMatthias Ringwald // random address update
2033deb3ec6SMatthias Ringwald static random_address_update_t rau_state;
2043deb3ec6SMatthias Ringwald static bd_addr_t sm_random_address;
2053deb3ec6SMatthias Ringwald 
206514d35fcSMatthias Ringwald // CMAC Calculation: General
2077a766ebfSMatthias Ringwald #ifdef ENABLE_CMAC_ENGINE
2083deb3ec6SMatthias Ringwald static cmac_state_t sm_cmac_state;
2093deb3ec6SMatthias Ringwald static uint16_t     sm_cmac_message_len;
210514d35fcSMatthias Ringwald static sm_key_t     sm_cmac_k;
2113deb3ec6SMatthias Ringwald static sm_key_t     sm_cmac_x;
212514d35fcSMatthias Ringwald static sm_key_t     sm_cmac_m_last;
2133deb3ec6SMatthias Ringwald static uint8_t      sm_cmac_block_current;
2143deb3ec6SMatthias Ringwald static uint8_t      sm_cmac_block_count;
215514d35fcSMatthias Ringwald static uint8_t      (*sm_cmac_get_byte)(uint16_t offset);
216514d35fcSMatthias Ringwald static void         (*sm_cmac_done_handler)(uint8_t * hash);
2177a766ebfSMatthias Ringwald #endif
218514d35fcSMatthias Ringwald 
219514d35fcSMatthias Ringwald // CMAC for ATT Signed Writes
2207a766ebfSMatthias Ringwald #ifdef ENABLE_LE_SIGNED_WRITE
221514d35fcSMatthias Ringwald static uint8_t      sm_cmac_header[3];
222aec94140SMatthias Ringwald static const uint8_t * sm_cmac_message;
223514d35fcSMatthias Ringwald static uint8_t      sm_cmac_sign_counter[4];
2247a766ebfSMatthias Ringwald #endif
225514d35fcSMatthias Ringwald 
226514d35fcSMatthias Ringwald // CMAC for Secure Connection functions
227514d35fcSMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
228aec94140SMatthias Ringwald static sm_connection_t * sm_cmac_connection;
229514d35fcSMatthias Ringwald static uint8_t           sm_cmac_sc_buffer[80];
230514d35fcSMatthias Ringwald #endif
2313deb3ec6SMatthias Ringwald 
2323deb3ec6SMatthias Ringwald // resolvable private address lookup / CSRK calculation
2333deb3ec6SMatthias Ringwald static int       sm_address_resolution_test;
2343deb3ec6SMatthias Ringwald static int       sm_address_resolution_ah_calculation_active;
2353deb3ec6SMatthias Ringwald static uint8_t   sm_address_resolution_addr_type;
2363deb3ec6SMatthias Ringwald static bd_addr_t sm_address_resolution_address;
2373deb3ec6SMatthias Ringwald static void *    sm_address_resolution_context;
2383deb3ec6SMatthias Ringwald static address_resolution_mode_t sm_address_resolution_mode;
2398f2a52f4SMatthias Ringwald static btstack_linked_list_t sm_address_resolution_general_queue;
2403deb3ec6SMatthias Ringwald 
2413deb3ec6SMatthias Ringwald // aes128 crypto engine. store current sm_connection_t in sm_aes128_context
2423deb3ec6SMatthias Ringwald static sm_aes128_state_t  sm_aes128_state;
2433deb3ec6SMatthias Ringwald static void *             sm_aes128_context;
2443deb3ec6SMatthias Ringwald 
2457df1ef2fSMatthias Ringwald // use aes128 provided by MCU - not needed usually
2467df1ef2fSMatthias Ringwald #ifdef HAVE_AES128
2477df1ef2fSMatthias Ringwald static uint8_t                aes128_result_flipped[16];
2487df1ef2fSMatthias Ringwald static btstack_timer_source_t aes128_timer;
2498e24486aSMatthias Ringwald void btstack_aes128_calc(uint8_t * key, uint8_t * plaintext, uint8_t * result);
2507df1ef2fSMatthias Ringwald #endif
2517df1ef2fSMatthias Ringwald 
2523deb3ec6SMatthias Ringwald // random engine. store context (ususally sm_connection_t)
2533deb3ec6SMatthias Ringwald static void * sm_random_context;
2543deb3ec6SMatthias Ringwald 
255e03e489aSMatthias Ringwald // to receive hci events
256e03e489aSMatthias Ringwald static btstack_packet_callback_registration_t hci_event_callback_registration;
257e03e489aSMatthias Ringwald 
25889a78d34SMatthias Ringwald /* to dispatch sm event */
25989a78d34SMatthias Ringwald static btstack_linked_list_t sm_event_handlers;
26089a78d34SMatthias Ringwald 
26109e4d397SMatthias Ringwald // LE Secure Connections
26209e4d397SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
26309e4d397SMatthias Ringwald static ec_key_generation_state_t ec_key_generation_state;
26409e4d397SMatthias Ringwald static uint8_t ec_d[32];
265fc5bff5fSMatthias Ringwald static uint8_t ec_q[64];
26609e4d397SMatthias Ringwald #endif
267df86eb96SMatthias Ringwald 
2683deb3ec6SMatthias Ringwald //
2693deb3ec6SMatthias Ringwald // Volume 3, Part H, Chapter 24
2703deb3ec6SMatthias Ringwald // "Security shall be initiated by the Security Manager in the device in the master role.
2713deb3ec6SMatthias Ringwald // The device in the slave role shall be the responding device."
2723deb3ec6SMatthias Ringwald // -> master := initiator, slave := responder
2733deb3ec6SMatthias Ringwald //
2743deb3ec6SMatthias Ringwald 
2753deb3ec6SMatthias Ringwald // data needed for security setup
2763deb3ec6SMatthias Ringwald typedef struct sm_setup_context {
2773deb3ec6SMatthias Ringwald 
278ec820d77SMatthias Ringwald     btstack_timer_source_t sm_timeout;
2793deb3ec6SMatthias Ringwald 
2803deb3ec6SMatthias Ringwald     // used in all phases
2813deb3ec6SMatthias Ringwald     uint8_t   sm_pairing_failed_reason;
2823deb3ec6SMatthias Ringwald 
2833deb3ec6SMatthias Ringwald     // user response, (Phase 1 and/or 2)
2843deb3ec6SMatthias Ringwald     uint8_t   sm_user_response;
2853d7fe1e9SMatthias Ringwald     uint8_t   sm_keypress_notification;
2863deb3ec6SMatthias Ringwald 
2873deb3ec6SMatthias Ringwald     // defines which keys will be send after connection is encrypted - calculated during Phase 1, used Phase 3
2883deb3ec6SMatthias Ringwald     int       sm_key_distribution_send_set;
2893deb3ec6SMatthias Ringwald     int       sm_key_distribution_received_set;
2903deb3ec6SMatthias Ringwald 
2913deb3ec6SMatthias Ringwald     // Phase 2 (Pairing over SMP)
2923deb3ec6SMatthias Ringwald     stk_generation_method_t sm_stk_generation_method;
2933deb3ec6SMatthias Ringwald     sm_key_t  sm_tk;
29427c32905SMatthias Ringwald     uint8_t   sm_use_secure_connections;
2953deb3ec6SMatthias Ringwald 
2963deb3ec6SMatthias Ringwald     sm_key_t  sm_c1_t3_value;   // c1 calculation
2973deb3ec6SMatthias Ringwald     sm_pairing_packet_t sm_m_preq; // pairing request - needed only for c1
2983deb3ec6SMatthias Ringwald     sm_pairing_packet_t sm_s_pres; // pairing response - needed only for c1
2993deb3ec6SMatthias Ringwald     sm_key_t  sm_local_random;
3003deb3ec6SMatthias Ringwald     sm_key_t  sm_local_confirm;
3013deb3ec6SMatthias Ringwald     sm_key_t  sm_peer_random;
3023deb3ec6SMatthias Ringwald     sm_key_t  sm_peer_confirm;
3033deb3ec6SMatthias Ringwald     uint8_t   sm_m_addr_type;   // address and type can be removed
3043deb3ec6SMatthias Ringwald     uint8_t   sm_s_addr_type;   //  ''
3053deb3ec6SMatthias Ringwald     bd_addr_t sm_m_address;     //  ''
3063deb3ec6SMatthias Ringwald     bd_addr_t sm_s_address;     //  ''
3073deb3ec6SMatthias Ringwald     sm_key_t  sm_ltk;
3083deb3ec6SMatthias Ringwald 
30968437d83SMatthias Ringwald     uint8_t   sm_state_vars;
310e53be891SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
311fc5bff5fSMatthias Ringwald     uint8_t   sm_peer_q[64];    // also stores random for EC key generation during init
312446a8c36SMatthias Ringwald     sm_key_t  sm_peer_nonce;    // might be combined with sm_peer_random
313446a8c36SMatthias Ringwald     sm_key_t  sm_local_nonce;   // might be combined with sm_local_random
314e53be891SMatthias Ringwald     sm_key_t  sm_peer_dhkey_check;
315e53be891SMatthias Ringwald     sm_key_t  sm_local_dhkey_check;
316446a8c36SMatthias Ringwald     sm_key_t  sm_ra;
317446a8c36SMatthias Ringwald     sm_key_t  sm_rb;
3182bacf595SMatthias Ringwald     sm_key_t  sm_t;             // used for f5 and h6
319a9f29768SMatthias Ringwald     sm_key_t  sm_mackey;
3207df18c15SMatthias Ringwald     uint8_t   sm_passkey_bit;   // also stores number of generated random bytes for EC key generation
321e53be891SMatthias Ringwald #endif
32227c32905SMatthias Ringwald 
3233deb3ec6SMatthias Ringwald     // Phase 3
3243deb3ec6SMatthias Ringwald 
3253deb3ec6SMatthias Ringwald     // key distribution, we generate
3263deb3ec6SMatthias Ringwald     uint16_t  sm_local_y;
3273deb3ec6SMatthias Ringwald     uint16_t  sm_local_div;
3283deb3ec6SMatthias Ringwald     uint16_t  sm_local_ediv;
3293deb3ec6SMatthias Ringwald     uint8_t   sm_local_rand[8];
3303deb3ec6SMatthias Ringwald     sm_key_t  sm_local_ltk;
3313deb3ec6SMatthias Ringwald     sm_key_t  sm_local_csrk;
3323deb3ec6SMatthias Ringwald     sm_key_t  sm_local_irk;
3333deb3ec6SMatthias Ringwald     // sm_local_address/addr_type not needed
3343deb3ec6SMatthias Ringwald 
3353deb3ec6SMatthias Ringwald     // key distribution, received from peer
3363deb3ec6SMatthias Ringwald     uint16_t  sm_peer_y;
3373deb3ec6SMatthias Ringwald     uint16_t  sm_peer_div;
3383deb3ec6SMatthias Ringwald     uint16_t  sm_peer_ediv;
3393deb3ec6SMatthias Ringwald     uint8_t   sm_peer_rand[8];
3403deb3ec6SMatthias Ringwald     sm_key_t  sm_peer_ltk;
3413deb3ec6SMatthias Ringwald     sm_key_t  sm_peer_irk;
3423deb3ec6SMatthias Ringwald     sm_key_t  sm_peer_csrk;
3433deb3ec6SMatthias Ringwald     uint8_t   sm_peer_addr_type;
3443deb3ec6SMatthias Ringwald     bd_addr_t sm_peer_address;
3453deb3ec6SMatthias Ringwald 
3463deb3ec6SMatthias Ringwald } sm_setup_context_t;
3473deb3ec6SMatthias Ringwald 
3483deb3ec6SMatthias Ringwald //
3493deb3ec6SMatthias Ringwald static sm_setup_context_t the_setup;
3503deb3ec6SMatthias Ringwald static sm_setup_context_t * setup = &the_setup;
3513deb3ec6SMatthias Ringwald 
3523deb3ec6SMatthias Ringwald // active connection - the one for which the_setup is used for
3537149bde5SMatthias Ringwald static uint16_t sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
3543deb3ec6SMatthias Ringwald 
3553deb3ec6SMatthias Ringwald // @returns 1 if oob data is available
3563deb3ec6SMatthias Ringwald // stores oob data in provided 16 byte buffer if not null
3573deb3ec6SMatthias Ringwald static int (*sm_get_oob_data)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data) = NULL;
3583deb3ec6SMatthias Ringwald 
3593deb3ec6SMatthias Ringwald // horizontal: initiator capabilities
3603deb3ec6SMatthias Ringwald // vertial:    responder capabilities
3613deb3ec6SMatthias Ringwald static const stk_generation_method_t stk_generation_method [5] [5] = {
3623deb3ec6SMatthias Ringwald     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
3633deb3ec6SMatthias Ringwald     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
3643deb3ec6SMatthias Ringwald     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
3653deb3ec6SMatthias Ringwald     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
3663deb3ec6SMatthias Ringwald     { PK_RESP_INPUT,   PK_RESP_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
3673deb3ec6SMatthias Ringwald };
3683deb3ec6SMatthias Ringwald 
36927c32905SMatthias Ringwald // uses numeric comparison if one side has DisplayYesNo and KeyboardDisplay combinations
37027c32905SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
37127c32905SMatthias Ringwald static const stk_generation_method_t stk_generation_method_with_secure_connection[5][5] = {
37227c32905SMatthias Ringwald     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
37327c32905SMatthias Ringwald     { JUST_WORKS,      NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
37427c32905SMatthias Ringwald     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
37527c32905SMatthias Ringwald     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
37627c32905SMatthias Ringwald     { PK_RESP_INPUT,   NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
37727c32905SMatthias Ringwald };
37827c32905SMatthias Ringwald #endif
37927c32905SMatthias Ringwald 
3803deb3ec6SMatthias Ringwald static void sm_run(void);
381711e6c80SMatthias Ringwald static void sm_done_for_handle(hci_con_handle_t con_handle);
382711e6c80SMatthias Ringwald static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle);
3833deb3ec6SMatthias Ringwald static inline int sm_calc_actual_encryption_key_size(int other);
3843deb3ec6SMatthias Ringwald static int sm_validate_stk_generation_method(void);
3857df1ef2fSMatthias Ringwald static void sm_handle_encryption_result(uint8_t * data);
3863deb3ec6SMatthias Ringwald 
3873deb3ec6SMatthias Ringwald static void log_info_hex16(const char * name, uint16_t value){
3883deb3ec6SMatthias Ringwald     log_info("%-6s 0x%04x", name, value);
3893deb3ec6SMatthias Ringwald }
3903deb3ec6SMatthias Ringwald 
3913deb3ec6SMatthias Ringwald // @returns 1 if all bytes are 0
3923764b551SMatthias Ringwald static int sm_is_null(uint8_t * data, int size){
3933deb3ec6SMatthias Ringwald     int i;
3943764b551SMatthias Ringwald     for (i=0; i < size ; i++){
3953764b551SMatthias Ringwald         if (data[i]) return 0;
3963deb3ec6SMatthias Ringwald     }
3973deb3ec6SMatthias Ringwald     return 1;
3983deb3ec6SMatthias Ringwald }
3993deb3ec6SMatthias Ringwald 
4003764b551SMatthias Ringwald static int sm_is_null_random(uint8_t random[8]){
4013764b551SMatthias Ringwald     return sm_is_null(random, 8);
4023764b551SMatthias Ringwald }
4033764b551SMatthias Ringwald 
4043764b551SMatthias Ringwald static int sm_is_null_key(uint8_t * key){
4053764b551SMatthias Ringwald     return sm_is_null(key, 16);
4063764b551SMatthias Ringwald }
4073764b551SMatthias Ringwald 
4083deb3ec6SMatthias Ringwald // Key utils
4093deb3ec6SMatthias Ringwald static void sm_reset_tk(void){
4103deb3ec6SMatthias Ringwald     int i;
4113deb3ec6SMatthias Ringwald     for (i=0;i<16;i++){
4123deb3ec6SMatthias Ringwald         setup->sm_tk[i] = 0;
4133deb3ec6SMatthias Ringwald     }
4143deb3ec6SMatthias Ringwald }
4153deb3ec6SMatthias Ringwald 
4163deb3ec6SMatthias Ringwald // "For example, if a 128-bit encryption key is 0x123456789ABCDEF0123456789ABCDEF0
4173deb3ec6SMatthias Ringwald // and it is reduced to 7 octets (56 bits), then the resulting key is 0x0000000000000000003456789ABCDEF0.""
4183deb3ec6SMatthias Ringwald static void sm_truncate_key(sm_key_t key, int max_encryption_size){
4193deb3ec6SMatthias Ringwald     int i;
4203deb3ec6SMatthias Ringwald     for (i = max_encryption_size ; i < 16 ; i++){
4213deb3ec6SMatthias Ringwald         key[15-i] = 0;
4223deb3ec6SMatthias Ringwald     }
4233deb3ec6SMatthias Ringwald }
4243deb3ec6SMatthias Ringwald 
4253deb3ec6SMatthias Ringwald // SMP Timeout implementation
4263deb3ec6SMatthias Ringwald 
4273deb3ec6SMatthias Ringwald // Upon transmission of the Pairing Request command or reception of the Pairing Request command,
4283deb3ec6SMatthias Ringwald // the Security Manager Timer shall be reset and started.
4293deb3ec6SMatthias Ringwald //
4303deb3ec6SMatthias Ringwald // The Security Manager Timer shall be reset when an L2CAP SMP command is queued for transmission.
4313deb3ec6SMatthias Ringwald //
4323deb3ec6SMatthias Ringwald // If the Security Manager Timer reaches 30 seconds, the procedure shall be considered to have failed,
4333deb3ec6SMatthias Ringwald // and the local higher layer shall be notified. No further SMP commands shall be sent over the L2CAP
4343deb3ec6SMatthias Ringwald // Security Manager Channel. A new SM procedure shall only be performed when a new physical link has been
4353deb3ec6SMatthias Ringwald // established.
4363deb3ec6SMatthias Ringwald 
437ec820d77SMatthias Ringwald static void sm_timeout_handler(btstack_timer_source_t * timer){
4383deb3ec6SMatthias Ringwald     log_info("SM timeout");
439c5b64319SMatthias Ringwald     sm_connection_t * sm_conn = (sm_connection_t*) btstack_run_loop_get_timer_context(timer);
4403deb3ec6SMatthias Ringwald     sm_conn->sm_engine_state = SM_GENERAL_TIMEOUT;
4413deb3ec6SMatthias Ringwald     sm_done_for_handle(sm_conn->sm_handle);
4423deb3ec6SMatthias Ringwald 
4433deb3ec6SMatthias Ringwald     // trigger handling of next ready connection
4443deb3ec6SMatthias Ringwald     sm_run();
4453deb3ec6SMatthias Ringwald }
4463deb3ec6SMatthias Ringwald static void sm_timeout_start(sm_connection_t * sm_conn){
447528a4a3bSMatthias Ringwald     btstack_run_loop_remove_timer(&setup->sm_timeout);
44891a977e8SMatthias Ringwald     btstack_run_loop_set_timer_context(&setup->sm_timeout, sm_conn);
449528a4a3bSMatthias Ringwald     btstack_run_loop_set_timer_handler(&setup->sm_timeout, sm_timeout_handler);
450528a4a3bSMatthias Ringwald     btstack_run_loop_set_timer(&setup->sm_timeout, 30000); // 30 seconds sm timeout
451528a4a3bSMatthias Ringwald     btstack_run_loop_add_timer(&setup->sm_timeout);
4523deb3ec6SMatthias Ringwald }
4533deb3ec6SMatthias Ringwald static void sm_timeout_stop(void){
454528a4a3bSMatthias Ringwald     btstack_run_loop_remove_timer(&setup->sm_timeout);
4553deb3ec6SMatthias Ringwald }
4563deb3ec6SMatthias Ringwald static void sm_timeout_reset(sm_connection_t * sm_conn){
4573deb3ec6SMatthias Ringwald     sm_timeout_stop();
4583deb3ec6SMatthias Ringwald     sm_timeout_start(sm_conn);
4593deb3ec6SMatthias Ringwald }
4603deb3ec6SMatthias Ringwald 
4613deb3ec6SMatthias Ringwald // end of sm timeout
4623deb3ec6SMatthias Ringwald 
4633deb3ec6SMatthias Ringwald // GAP Random Address updates
4643deb3ec6SMatthias Ringwald static gap_random_address_type_t gap_random_adress_type;
465ec820d77SMatthias Ringwald static btstack_timer_source_t gap_random_address_update_timer;
4663deb3ec6SMatthias Ringwald static uint32_t gap_random_adress_update_period;
4673deb3ec6SMatthias Ringwald 
4683deb3ec6SMatthias Ringwald static void gap_random_address_trigger(void){
4693deb3ec6SMatthias Ringwald     if (rau_state != RAU_IDLE) return;
4703deb3ec6SMatthias Ringwald     log_info("gap_random_address_trigger");
4713deb3ec6SMatthias Ringwald     rau_state = RAU_GET_RANDOM;
4723deb3ec6SMatthias Ringwald     sm_run();
4733deb3ec6SMatthias Ringwald }
4743deb3ec6SMatthias Ringwald 
475ec820d77SMatthias Ringwald static void gap_random_address_update_handler(btstack_timer_source_t * timer){
4769ec2630cSMatthias Ringwald     UNUSED(timer);
4779ec2630cSMatthias Ringwald 
4783deb3ec6SMatthias Ringwald     log_info("GAP Random Address Update due");
479528a4a3bSMatthias Ringwald     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
480528a4a3bSMatthias Ringwald     btstack_run_loop_add_timer(&gap_random_address_update_timer);
4813deb3ec6SMatthias Ringwald     gap_random_address_trigger();
4823deb3ec6SMatthias Ringwald }
4833deb3ec6SMatthias Ringwald 
4843deb3ec6SMatthias Ringwald static void gap_random_address_update_start(void){
485528a4a3bSMatthias Ringwald     btstack_run_loop_set_timer_handler(&gap_random_address_update_timer, gap_random_address_update_handler);
486528a4a3bSMatthias Ringwald     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
487528a4a3bSMatthias Ringwald     btstack_run_loop_add_timer(&gap_random_address_update_timer);
4883deb3ec6SMatthias Ringwald }
4893deb3ec6SMatthias Ringwald 
4903deb3ec6SMatthias Ringwald static void gap_random_address_update_stop(void){
491528a4a3bSMatthias Ringwald     btstack_run_loop_remove_timer(&gap_random_address_update_timer);
4923deb3ec6SMatthias Ringwald }
4933deb3ec6SMatthias Ringwald 
4943deb3ec6SMatthias Ringwald 
4953deb3ec6SMatthias Ringwald static void sm_random_start(void * context){
4963deb3ec6SMatthias Ringwald     sm_random_context = context;
4973deb3ec6SMatthias Ringwald     hci_send_cmd(&hci_le_rand);
4983deb3ec6SMatthias Ringwald }
4993deb3ec6SMatthias Ringwald 
5007df1ef2fSMatthias Ringwald #ifdef HAVE_AES128
5017df1ef2fSMatthias Ringwald static void aes128_completed(btstack_timer_source_t * ts){
5027df1ef2fSMatthias Ringwald     UNUSED(ts);
5037df1ef2fSMatthias Ringwald     sm_handle_encryption_result(&aes128_result_flipped[0]);
5047df1ef2fSMatthias Ringwald     sm_run();
5057df1ef2fSMatthias Ringwald }
5067df1ef2fSMatthias Ringwald #endif
5077df1ef2fSMatthias Ringwald 
5083deb3ec6SMatthias Ringwald // pre: sm_aes128_state != SM_AES128_ACTIVE, hci_can_send_command == 1
5093deb3ec6SMatthias Ringwald // context is made availabe to aes128 result handler by this
5103deb3ec6SMatthias Ringwald static void sm_aes128_start(sm_key_t key, sm_key_t plaintext, void * context){
5113deb3ec6SMatthias Ringwald     sm_aes128_state = SM_AES128_ACTIVE;
5127df1ef2fSMatthias Ringwald     sm_aes128_context = context;
5137df1ef2fSMatthias Ringwald 
5147df1ef2fSMatthias Ringwald #ifdef HAVE_AES128
5157df1ef2fSMatthias Ringwald     // calc result directly
5167df1ef2fSMatthias Ringwald     sm_key_t result;
5177df1ef2fSMatthias Ringwald     btstack_aes128_calc(key, plaintext, result);
5187df1ef2fSMatthias Ringwald 
5197df1ef2fSMatthias Ringwald     // log
5207df1ef2fSMatthias Ringwald     log_info_key("key", key);
5217df1ef2fSMatthias Ringwald     log_info_key("txt", plaintext);
5227df1ef2fSMatthias Ringwald     log_info_key("res", result);
5237df1ef2fSMatthias Ringwald 
5247df1ef2fSMatthias Ringwald     // flip
5257df1ef2fSMatthias Ringwald     reverse_128(&result[0], &aes128_result_flipped[0]);
5267df1ef2fSMatthias Ringwald 
5277df1ef2fSMatthias Ringwald     // deliver via timer
5287df1ef2fSMatthias Ringwald     btstack_run_loop_set_timer_handler(&aes128_timer, &aes128_completed);
5297df1ef2fSMatthias Ringwald     btstack_run_loop_set_timer(&aes128_timer, 0);    // no delay
5307df1ef2fSMatthias Ringwald     btstack_run_loop_add_timer(&aes128_timer);
5317df1ef2fSMatthias Ringwald #else
5323deb3ec6SMatthias Ringwald     sm_key_t key_flipped, plaintext_flipped;
5339c80e4ccSMatthias Ringwald     reverse_128(key, key_flipped);
5349c80e4ccSMatthias Ringwald     reverse_128(plaintext, plaintext_flipped);
5353deb3ec6SMatthias Ringwald     hci_send_cmd(&hci_le_encrypt, key_flipped, plaintext_flipped);
5367df1ef2fSMatthias Ringwald #endif
5373deb3ec6SMatthias Ringwald }
5383deb3ec6SMatthias Ringwald 
5393deb3ec6SMatthias Ringwald // ah(k,r) helper
5403deb3ec6SMatthias Ringwald // r = padding || r
5413deb3ec6SMatthias Ringwald // r - 24 bit value
5424a6806f3SMatthias Ringwald static void sm_ah_r_prime(uint8_t r[3], uint8_t * r_prime){
5433deb3ec6SMatthias Ringwald     // r'= padding || r
5443deb3ec6SMatthias Ringwald     memset(r_prime, 0, 16);
5453deb3ec6SMatthias Ringwald     memcpy(&r_prime[13], r, 3);
5463deb3ec6SMatthias Ringwald }
5473deb3ec6SMatthias Ringwald 
5483deb3ec6SMatthias Ringwald // d1 helper
5493deb3ec6SMatthias Ringwald // d' = padding || r || d
5503deb3ec6SMatthias Ringwald // d,r - 16 bit values
5514a6806f3SMatthias Ringwald static void sm_d1_d_prime(uint16_t d, uint16_t r, uint8_t * d1_prime){
5523deb3ec6SMatthias Ringwald     // d'= padding || r || d
5533deb3ec6SMatthias Ringwald     memset(d1_prime, 0, 16);
554f8fbdce0SMatthias Ringwald     big_endian_store_16(d1_prime, 12, r);
555f8fbdce0SMatthias Ringwald     big_endian_store_16(d1_prime, 14, d);
5563deb3ec6SMatthias Ringwald }
5573deb3ec6SMatthias Ringwald 
5583deb3ec6SMatthias Ringwald // dm helper
5593deb3ec6SMatthias Ringwald // r’ = padding || r
5603deb3ec6SMatthias Ringwald // r - 64 bit value
5614a6806f3SMatthias Ringwald static void sm_dm_r_prime(uint8_t r[8], uint8_t * r_prime){
5623deb3ec6SMatthias Ringwald     memset(r_prime, 0, 16);
5633deb3ec6SMatthias Ringwald     memcpy(&r_prime[8], r, 8);
5643deb3ec6SMatthias Ringwald }
5653deb3ec6SMatthias Ringwald 
5663deb3ec6SMatthias Ringwald // calculate arguments for first AES128 operation in C1 function
5674a6806f3SMatthias Ringwald static void sm_c1_t1(sm_key_t r, uint8_t preq[7], uint8_t pres[7], uint8_t iat, uint8_t rat, uint8_t * t1){
5683deb3ec6SMatthias Ringwald 
5693deb3ec6SMatthias Ringwald     // p1 = pres || preq || rat’ || iat’
5703deb3ec6SMatthias Ringwald     // "The octet of iat’ becomes the least significant octet of p1 and the most signifi-
5713deb3ec6SMatthias Ringwald     // cant octet of pres becomes the most significant octet of p1.
5723deb3ec6SMatthias Ringwald     // For example, if the 8-bit iat’ is 0x01, the 8-bit rat’ is 0x00, the 56-bit preq
5733deb3ec6SMatthias Ringwald     // is 0x07071000000101 and the 56 bit pres is 0x05000800000302 then
5743deb3ec6SMatthias Ringwald     // p1 is 0x05000800000302070710000001010001."
5753deb3ec6SMatthias Ringwald 
5763deb3ec6SMatthias Ringwald     sm_key_t p1;
5779c80e4ccSMatthias Ringwald     reverse_56(pres, &p1[0]);
5789c80e4ccSMatthias Ringwald     reverse_56(preq, &p1[7]);
5793deb3ec6SMatthias Ringwald     p1[14] = rat;
5803deb3ec6SMatthias Ringwald     p1[15] = iat;
5818314c363SMatthias Ringwald     log_info_key("p1", p1);
5828314c363SMatthias Ringwald     log_info_key("r", r);
5833deb3ec6SMatthias Ringwald 
5843deb3ec6SMatthias Ringwald     // t1 = r xor p1
5853deb3ec6SMatthias Ringwald     int i;
5863deb3ec6SMatthias Ringwald     for (i=0;i<16;i++){
5873deb3ec6SMatthias Ringwald         t1[i] = r[i] ^ p1[i];
5883deb3ec6SMatthias Ringwald     }
5898314c363SMatthias Ringwald     log_info_key("t1", t1);
5903deb3ec6SMatthias Ringwald }
5913deb3ec6SMatthias Ringwald 
5923deb3ec6SMatthias Ringwald // calculate arguments for second AES128 operation in C1 function
5934a6806f3SMatthias Ringwald static void sm_c1_t3(sm_key_t t2, bd_addr_t ia, bd_addr_t ra, uint8_t * t3){
5943deb3ec6SMatthias Ringwald      // p2 = padding || ia || ra
5953deb3ec6SMatthias Ringwald     // "The least significant octet of ra becomes the least significant octet of p2 and
5963deb3ec6SMatthias Ringwald     // the most significant octet of padding becomes the most significant octet of p2.
5973deb3ec6SMatthias Ringwald     // For example, if 48-bit ia is 0xA1A2A3A4A5A6 and the 48-bit ra is
5983deb3ec6SMatthias Ringwald     // 0xB1B2B3B4B5B6 then p2 is 0x00000000A1A2A3A4A5A6B1B2B3B4B5B6.
5993deb3ec6SMatthias Ringwald 
6003deb3ec6SMatthias Ringwald     sm_key_t p2;
6013deb3ec6SMatthias Ringwald     memset(p2, 0, 16);
6023deb3ec6SMatthias Ringwald     memcpy(&p2[4],  ia, 6);
6033deb3ec6SMatthias Ringwald     memcpy(&p2[10], ra, 6);
6048314c363SMatthias Ringwald     log_info_key("p2", p2);
6053deb3ec6SMatthias Ringwald 
6063deb3ec6SMatthias Ringwald     // c1 = e(k, t2_xor_p2)
6073deb3ec6SMatthias Ringwald     int i;
6083deb3ec6SMatthias Ringwald     for (i=0;i<16;i++){
6093deb3ec6SMatthias Ringwald         t3[i] = t2[i] ^ p2[i];
6103deb3ec6SMatthias Ringwald     }
6118314c363SMatthias Ringwald     log_info_key("t3", t3);
6123deb3ec6SMatthias Ringwald }
6133deb3ec6SMatthias Ringwald 
6144a6806f3SMatthias Ringwald static void sm_s1_r_prime(sm_key_t r1, sm_key_t r2, uint8_t * r_prime){
6158314c363SMatthias Ringwald     log_info_key("r1", r1);
6168314c363SMatthias Ringwald     log_info_key("r2", r2);
6173deb3ec6SMatthias Ringwald     memcpy(&r_prime[8], &r2[8], 8);
6183deb3ec6SMatthias Ringwald     memcpy(&r_prime[0], &r1[8], 8);
6193deb3ec6SMatthias Ringwald }
6203deb3ec6SMatthias Ringwald 
621e53be891SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
622e53be891SMatthias Ringwald // Software implementations of crypto toolbox for LE Secure Connection
623e53be891SMatthias Ringwald // TODO: replace with code to use AES Engine of HCI Controller
624e53be891SMatthias Ringwald typedef uint8_t sm_key24_t[3];
625e53be891SMatthias Ringwald typedef uint8_t sm_key56_t[7];
626e53be891SMatthias Ringwald typedef uint8_t sm_key256_t[32];
627e53be891SMatthias Ringwald 
628bd57ffebSMatthias Ringwald #if 0
629e53be891SMatthias Ringwald static void aes128_calc_cyphertext(const uint8_t key[16], const uint8_t plaintext[16], uint8_t cyphertext[16]){
630e53be891SMatthias Ringwald     uint32_t rk[RKLENGTH(KEYBITS)];
631e53be891SMatthias Ringwald     int nrounds = rijndaelSetupEncrypt(rk, &key[0], KEYBITS);
632e53be891SMatthias Ringwald     rijndaelEncrypt(rk, nrounds, plaintext, cyphertext);
633e53be891SMatthias Ringwald }
634e53be891SMatthias Ringwald 
635e53be891SMatthias Ringwald static void calc_subkeys(sm_key_t k0, sm_key_t k1, sm_key_t k2){
636e53be891SMatthias Ringwald     memcpy(k1, k0, 16);
637e53be891SMatthias Ringwald     sm_shift_left_by_one_bit_inplace(16, k1);
638e53be891SMatthias Ringwald     if (k0[0] & 0x80){
639e53be891SMatthias Ringwald         k1[15] ^= 0x87;
640e53be891SMatthias Ringwald     }
641e53be891SMatthias Ringwald     memcpy(k2, k1, 16);
642e53be891SMatthias Ringwald     sm_shift_left_by_one_bit_inplace(16, k2);
643e53be891SMatthias Ringwald     if (k1[0] & 0x80){
644e53be891SMatthias Ringwald         k2[15] ^= 0x87;
645e53be891SMatthias Ringwald     }
646e53be891SMatthias Ringwald }
647e53be891SMatthias Ringwald 
648e53be891SMatthias Ringwald static void aes_cmac(sm_key_t aes_cmac, const sm_key_t key, const uint8_t * data, int cmac_message_len){
649e53be891SMatthias Ringwald     sm_key_t k0, k1, k2, zero;
650e53be891SMatthias Ringwald     memset(zero, 0, 16);
651e53be891SMatthias Ringwald 
652e53be891SMatthias Ringwald     aes128_calc_cyphertext(key, zero, k0);
653e53be891SMatthias Ringwald     calc_subkeys(k0, k1, k2);
654e53be891SMatthias Ringwald 
655e53be891SMatthias Ringwald     int cmac_block_count = (cmac_message_len + 15) / 16;
656e53be891SMatthias Ringwald 
657e53be891SMatthias Ringwald     // step 3: ..
658e53be891SMatthias Ringwald     if (cmac_block_count==0){
659e53be891SMatthias Ringwald         cmac_block_count = 1;
660e53be891SMatthias Ringwald     }
661e53be891SMatthias Ringwald 
662e53be891SMatthias Ringwald     // step 4: set m_last
663e53be891SMatthias Ringwald     sm_key_t cmac_m_last;
664e53be891SMatthias Ringwald     int sm_cmac_last_block_complete = cmac_message_len != 0 && (cmac_message_len & 0x0f) == 0;
665e53be891SMatthias Ringwald     int i;
666e53be891SMatthias Ringwald     if (sm_cmac_last_block_complete){
667e53be891SMatthias Ringwald         for (i=0;i<16;i++){
668e53be891SMatthias Ringwald             cmac_m_last[i] = data[cmac_message_len - 16 + i] ^ k1[i];
669e53be891SMatthias Ringwald         }
670e53be891SMatthias Ringwald     } else {
671e53be891SMatthias Ringwald         int valid_octets_in_last_block = cmac_message_len & 0x0f;
672e53be891SMatthias Ringwald         for (i=0;i<16;i++){
673e53be891SMatthias Ringwald             if (i < valid_octets_in_last_block){
674e53be891SMatthias Ringwald                 cmac_m_last[i] = data[(cmac_message_len & 0xfff0) + i] ^ k2[i];
675e53be891SMatthias Ringwald                 continue;
676e53be891SMatthias Ringwald             }
677e53be891SMatthias Ringwald             if (i == valid_octets_in_last_block){
678e53be891SMatthias Ringwald                 cmac_m_last[i] = 0x80 ^ k2[i];
679e53be891SMatthias Ringwald                 continue;
680e53be891SMatthias Ringwald             }
681e53be891SMatthias Ringwald             cmac_m_last[i] = k2[i];
682e53be891SMatthias Ringwald         }
683e53be891SMatthias Ringwald     }
684e53be891SMatthias Ringwald 
685e53be891SMatthias Ringwald     // printf("sm_cmac_start: len %u, block count %u\n", cmac_message_len, cmac_block_count);
686e53be891SMatthias Ringwald     // LOG_KEY(cmac_m_last);
687e53be891SMatthias Ringwald 
688e53be891SMatthias Ringwald     // Step 5
689e53be891SMatthias Ringwald     sm_key_t cmac_x;
690e53be891SMatthias Ringwald     memset(cmac_x, 0, 16);
691e53be891SMatthias Ringwald 
692e53be891SMatthias Ringwald     // Step 6
693e53be891SMatthias Ringwald     sm_key_t sm_cmac_y;
694e53be891SMatthias Ringwald     for (int block = 0 ; block < cmac_block_count-1 ; block++){
695e53be891SMatthias Ringwald         for (i=0;i<16;i++){
696e53be891SMatthias Ringwald             sm_cmac_y[i] = cmac_x[i] ^ data[block * 16 + i];
697e53be891SMatthias Ringwald         }
698e53be891SMatthias Ringwald         aes128_calc_cyphertext(key, sm_cmac_y, cmac_x);
699e53be891SMatthias Ringwald     }
700e53be891SMatthias Ringwald     for (i=0;i<16;i++){
701e53be891SMatthias Ringwald         sm_cmac_y[i] = cmac_x[i] ^ cmac_m_last[i];
702e53be891SMatthias Ringwald     }
703e53be891SMatthias Ringwald 
704e53be891SMatthias Ringwald     // Step 7
705e53be891SMatthias Ringwald     aes128_calc_cyphertext(key, sm_cmac_y, aes_cmac);
706e53be891SMatthias Ringwald }
707bd57ffebSMatthias Ringwald #endif
708e53be891SMatthias Ringwald #endif
709e53be891SMatthias Ringwald 
710711e6c80SMatthias Ringwald static void sm_setup_event_base(uint8_t * event, int event_size, uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
7113deb3ec6SMatthias Ringwald     event[0] = type;
7123deb3ec6SMatthias Ringwald     event[1] = event_size - 2;
713711e6c80SMatthias Ringwald     little_endian_store_16(event, 2, con_handle);
7143deb3ec6SMatthias Ringwald     event[4] = addr_type;
715724d70a2SMatthias Ringwald     reverse_bd_addr(address, &event[5]);
7163deb3ec6SMatthias Ringwald }
7173deb3ec6SMatthias Ringwald 
71889a78d34SMatthias Ringwald static void sm_dispatch_event(uint8_t packet_type, uint16_t channel, uint8_t * packet, uint16_t size){
7199ec2630cSMatthias Ringwald     UNUSED(channel);
7209ec2630cSMatthias Ringwald 
72113377825SMatthias Ringwald     // log event
72213377825SMatthias Ringwald     hci_dump_packet(packet_type, 1, packet, size);
72389a78d34SMatthias Ringwald     // dispatch to all event handlers
72489a78d34SMatthias Ringwald     btstack_linked_list_iterator_t it;
72589a78d34SMatthias Ringwald     btstack_linked_list_iterator_init(&it, &sm_event_handlers);
72689a78d34SMatthias Ringwald     while (btstack_linked_list_iterator_has_next(&it)){
72789a78d34SMatthias Ringwald         btstack_packet_callback_registration_t * entry = (btstack_packet_callback_registration_t*) btstack_linked_list_iterator_next(&it);
728d9a7306aSMatthias Ringwald         entry->callback(packet_type, 0, packet, size);
72989a78d34SMatthias Ringwald     }
73089a78d34SMatthias Ringwald }
73189a78d34SMatthias Ringwald 
732711e6c80SMatthias Ringwald static void sm_notify_client_base(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
7333deb3ec6SMatthias Ringwald     uint8_t event[11];
734711e6c80SMatthias Ringwald     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
73589a78d34SMatthias Ringwald     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
7363deb3ec6SMatthias Ringwald }
7373deb3ec6SMatthias Ringwald 
738711e6c80SMatthias Ringwald static void sm_notify_client_passkey(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint32_t passkey){
7393deb3ec6SMatthias Ringwald     uint8_t event[15];
740711e6c80SMatthias Ringwald     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
741f8fbdce0SMatthias Ringwald     little_endian_store_32(event, 11, passkey);
74289a78d34SMatthias Ringwald     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
7433deb3ec6SMatthias Ringwald }
7443deb3ec6SMatthias Ringwald 
745711e6c80SMatthias Ringwald static void sm_notify_client_index(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint16_t index){
74613377825SMatthias Ringwald     // fetch addr and addr type from db
74713377825SMatthias Ringwald     bd_addr_t identity_address;
74813377825SMatthias Ringwald     int identity_address_type;
74913377825SMatthias Ringwald     le_device_db_info(index, &identity_address_type, identity_address, NULL);
75013377825SMatthias Ringwald 
751334126b3SMatthias Ringwald     uint8_t event[19];
752711e6c80SMatthias Ringwald     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
75313377825SMatthias Ringwald     event[11] = identity_address_type;
75413377825SMatthias Ringwald     reverse_bd_addr(identity_address, &event[12]);
755334126b3SMatthias Ringwald     event[18] = index;
75689a78d34SMatthias Ringwald     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
7573deb3ec6SMatthias Ringwald }
7583deb3ec6SMatthias Ringwald 
759711e6c80SMatthias Ringwald static void sm_notify_client_authorization(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint8_t result){
7603deb3ec6SMatthias Ringwald 
7613deb3ec6SMatthias Ringwald     uint8_t event[18];
762711e6c80SMatthias Ringwald     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
7633deb3ec6SMatthias Ringwald     event[11] = result;
76489a78d34SMatthias Ringwald     sm_dispatch_event(HCI_EVENT_PACKET, 0, (uint8_t*) &event, sizeof(event));
7653deb3ec6SMatthias Ringwald }
7663deb3ec6SMatthias Ringwald 
7673deb3ec6SMatthias Ringwald // decide on stk generation based on
7683deb3ec6SMatthias Ringwald // - pairing request
7693deb3ec6SMatthias Ringwald // - io capabilities
7703deb3ec6SMatthias Ringwald // - OOB data availability
7713deb3ec6SMatthias Ringwald static void sm_setup_tk(void){
7723deb3ec6SMatthias Ringwald 
7733deb3ec6SMatthias Ringwald     // default: just works
7743deb3ec6SMatthias Ringwald     setup->sm_stk_generation_method = JUST_WORKS;
7753deb3ec6SMatthias Ringwald 
77627c32905SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
77727c32905SMatthias Ringwald     setup->sm_use_secure_connections = ( sm_pairing_packet_get_auth_req(setup->sm_m_preq)
77827c32905SMatthias Ringwald                                        & sm_pairing_packet_get_auth_req(setup->sm_s_pres)
77927c32905SMatthias Ringwald                                        & SM_AUTHREQ_SECURE_CONNECTION ) != 0;
780446a8c36SMatthias Ringwald     memset(setup->sm_ra, 0, 16);
781446a8c36SMatthias Ringwald     memset(setup->sm_rb, 0, 16);
78227c32905SMatthias Ringwald #else
78327c32905SMatthias Ringwald     setup->sm_use_secure_connections = 0;
78427c32905SMatthias Ringwald #endif
78527c32905SMatthias Ringwald 
78627c32905SMatthias Ringwald     // If both devices have not set the MITM option in the Authentication Requirements
78727c32905SMatthias Ringwald     // Flags, then the IO capabilities shall be ignored and the Just Works association
78827c32905SMatthias Ringwald     // model shall be used.
78927c32905SMatthias Ringwald     if (((sm_pairing_packet_get_auth_req(setup->sm_m_preq) & SM_AUTHREQ_MITM_PROTECTION) == 0)
79027c32905SMatthias Ringwald     &&  ((sm_pairing_packet_get_auth_req(setup->sm_s_pres) & SM_AUTHREQ_MITM_PROTECTION) == 0)){
79127c32905SMatthias Ringwald         log_info("SM: MITM not required by both -> JUST WORKS");
79227c32905SMatthias Ringwald         return;
79327c32905SMatthias Ringwald     }
79427c32905SMatthias Ringwald 
79527c32905SMatthias Ringwald     // TODO: with LE SC, OOB is used to transfer data OOB during pairing, single device with OOB is sufficient
79627c32905SMatthias Ringwald 
7973deb3ec6SMatthias Ringwald     // If both devices have out of band authentication data, then the Authentication
7983deb3ec6SMatthias Ringwald     // Requirements Flags shall be ignored when selecting the pairing method and the
7993deb3ec6SMatthias Ringwald     // Out of Band pairing method shall be used.
8001ad129beSMatthias Ringwald     if (sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq)
8011ad129beSMatthias Ringwald     &&  sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres)){
8023deb3ec6SMatthias Ringwald         log_info("SM: have OOB data");
8038314c363SMatthias Ringwald         log_info_key("OOB", setup->sm_tk);
8043deb3ec6SMatthias Ringwald         setup->sm_stk_generation_method = OOB;
8053deb3ec6SMatthias Ringwald         return;
8063deb3ec6SMatthias Ringwald     }
8073deb3ec6SMatthias Ringwald 
8083deb3ec6SMatthias Ringwald     // Reset TK as it has been setup in sm_init_setup
8093deb3ec6SMatthias Ringwald     sm_reset_tk();
8103deb3ec6SMatthias Ringwald 
8113deb3ec6SMatthias Ringwald     // Also use just works if unknown io capabilites
8128da2e96dSMatthias Ringwald     if ((sm_pairing_packet_get_io_capability(setup->sm_m_preq) > IO_CAPABILITY_KEYBOARD_DISPLAY) || (sm_pairing_packet_get_io_capability(setup->sm_s_pres) > IO_CAPABILITY_KEYBOARD_DISPLAY)){
8133deb3ec6SMatthias Ringwald         return;
8143deb3ec6SMatthias Ringwald     }
8153deb3ec6SMatthias Ringwald 
8163deb3ec6SMatthias Ringwald     // Otherwise the IO capabilities of the devices shall be used to determine the
8173deb3ec6SMatthias Ringwald     // pairing method as defined in Table 2.4.
81827c32905SMatthias Ringwald     // see http://stackoverflow.com/a/1052837/393697 for how to specify pointer to 2-dimensional array
81927c32905SMatthias Ringwald     const stk_generation_method_t (*generation_method)[5] = stk_generation_method;
82027c32905SMatthias Ringwald 
82127c32905SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
822c6b7cbd9SMatthias Ringwald     // table not define by default
82327c32905SMatthias Ringwald     if (setup->sm_use_secure_connections){
82427c32905SMatthias Ringwald         generation_method = stk_generation_method_with_secure_connection;
82527c32905SMatthias Ringwald     }
82627c32905SMatthias Ringwald #endif
82727c32905SMatthias Ringwald     setup->sm_stk_generation_method = generation_method[sm_pairing_packet_get_io_capability(setup->sm_s_pres)][sm_pairing_packet_get_io_capability(setup->sm_m_preq)];
82827c32905SMatthias Ringwald 
8293deb3ec6SMatthias Ringwald     log_info("sm_setup_tk: master io cap: %u, slave io cap: %u -> method %u",
8301ad129beSMatthias Ringwald         sm_pairing_packet_get_io_capability(setup->sm_m_preq), sm_pairing_packet_get_io_capability(setup->sm_s_pres), setup->sm_stk_generation_method);
8313deb3ec6SMatthias Ringwald }
8323deb3ec6SMatthias Ringwald 
8333deb3ec6SMatthias Ringwald static int sm_key_distribution_flags_for_set(uint8_t key_set){
8343deb3ec6SMatthias Ringwald     int flags = 0;
8353deb3ec6SMatthias Ringwald     if (key_set & SM_KEYDIST_ENC_KEY){
8363deb3ec6SMatthias Ringwald         flags |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
8373deb3ec6SMatthias Ringwald         flags |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
8383deb3ec6SMatthias Ringwald     }
8393deb3ec6SMatthias Ringwald     if (key_set & SM_KEYDIST_ID_KEY){
8403deb3ec6SMatthias Ringwald         flags |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
8413deb3ec6SMatthias Ringwald         flags |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
8423deb3ec6SMatthias Ringwald     }
8433deb3ec6SMatthias Ringwald     if (key_set & SM_KEYDIST_SIGN){
8443deb3ec6SMatthias Ringwald         flags |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
8453deb3ec6SMatthias Ringwald     }
8463deb3ec6SMatthias Ringwald     return flags;
8473deb3ec6SMatthias Ringwald }
8483deb3ec6SMatthias Ringwald 
8493deb3ec6SMatthias Ringwald static void sm_setup_key_distribution(uint8_t key_set){
8503deb3ec6SMatthias Ringwald     setup->sm_key_distribution_received_set = 0;
8513deb3ec6SMatthias Ringwald     setup->sm_key_distribution_send_set = sm_key_distribution_flags_for_set(key_set);
8523deb3ec6SMatthias Ringwald }
8533deb3ec6SMatthias Ringwald 
8543deb3ec6SMatthias Ringwald // CSRK Key Lookup
8553deb3ec6SMatthias Ringwald 
8563deb3ec6SMatthias Ringwald 
8573deb3ec6SMatthias Ringwald static int sm_address_resolution_idle(void){
8583deb3ec6SMatthias Ringwald     return sm_address_resolution_mode == ADDRESS_RESOLUTION_IDLE;
8593deb3ec6SMatthias Ringwald }
8603deb3ec6SMatthias Ringwald 
861711e6c80SMatthias Ringwald static void sm_address_resolution_start_lookup(uint8_t addr_type, hci_con_handle_t con_handle, bd_addr_t addr, address_resolution_mode_t mode, void * context){
8623deb3ec6SMatthias Ringwald     memcpy(sm_address_resolution_address, addr, 6);
8633deb3ec6SMatthias Ringwald     sm_address_resolution_addr_type = addr_type;
8643deb3ec6SMatthias Ringwald     sm_address_resolution_test = 0;
8653deb3ec6SMatthias Ringwald     sm_address_resolution_mode = mode;
8663deb3ec6SMatthias Ringwald     sm_address_resolution_context = context;
867711e6c80SMatthias Ringwald     sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_STARTED, con_handle, addr_type, addr);
8683deb3ec6SMatthias Ringwald }
8693deb3ec6SMatthias Ringwald 
8703deb3ec6SMatthias Ringwald int sm_address_resolution_lookup(uint8_t address_type, bd_addr_t address){
8713deb3ec6SMatthias Ringwald     // check if already in list
872665d90f2SMatthias Ringwald     btstack_linked_list_iterator_t it;
8733deb3ec6SMatthias Ringwald     sm_lookup_entry_t * entry;
874665d90f2SMatthias Ringwald     btstack_linked_list_iterator_init(&it, &sm_address_resolution_general_queue);
875665d90f2SMatthias Ringwald     while(btstack_linked_list_iterator_has_next(&it)){
876665d90f2SMatthias Ringwald         entry = (sm_lookup_entry_t *) btstack_linked_list_iterator_next(&it);
8773deb3ec6SMatthias Ringwald         if (entry->address_type != address_type) continue;
8783deb3ec6SMatthias Ringwald         if (memcmp(entry->address, address, 6))  continue;
8793deb3ec6SMatthias Ringwald         // already in list
8803deb3ec6SMatthias Ringwald         return BTSTACK_BUSY;
8813deb3ec6SMatthias Ringwald     }
8823deb3ec6SMatthias Ringwald     entry = btstack_memory_sm_lookup_entry_get();
8833deb3ec6SMatthias Ringwald     if (!entry) return BTSTACK_MEMORY_ALLOC_FAILED;
8843deb3ec6SMatthias Ringwald     entry->address_type = (bd_addr_type_t) address_type;
8853deb3ec6SMatthias Ringwald     memcpy(entry->address, address, 6);
886665d90f2SMatthias Ringwald     btstack_linked_list_add(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
8873deb3ec6SMatthias Ringwald     sm_run();
8883deb3ec6SMatthias Ringwald     return 0;
8893deb3ec6SMatthias Ringwald }
8903deb3ec6SMatthias Ringwald 
8913deb3ec6SMatthias Ringwald // while x_state++ for an enum is possible in C, it isn't in C++. we use this helpers to avoid compile errors for now
8923deb3ec6SMatthias Ringwald static inline void sm_next_responding_state(sm_connection_t * sm_conn){
8933deb3ec6SMatthias Ringwald     sm_conn->sm_engine_state = (security_manager_state_t) (((int)sm_conn->sm_engine_state) + 1);
8943deb3ec6SMatthias Ringwald }
8953deb3ec6SMatthias Ringwald static inline void dkg_next_state(void){
8963deb3ec6SMatthias Ringwald     dkg_state = (derived_key_generation_t) (((int)dkg_state) + 1);
8973deb3ec6SMatthias Ringwald }
8983deb3ec6SMatthias Ringwald static inline void rau_next_state(void){
8993deb3ec6SMatthias Ringwald     rau_state = (random_address_update_t) (((int)rau_state) + 1);
9003deb3ec6SMatthias Ringwald }
901514d35fcSMatthias Ringwald 
902514d35fcSMatthias Ringwald // CMAC calculation using AES Engine
9037a766ebfSMatthias Ringwald #ifdef ENABLE_CMAC_ENGINE
904514d35fcSMatthias Ringwald 
9053deb3ec6SMatthias Ringwald static inline void sm_cmac_next_state(void){
9063deb3ec6SMatthias Ringwald     sm_cmac_state = (cmac_state_t) (((int)sm_cmac_state) + 1);
9073deb3ec6SMatthias Ringwald }
908514d35fcSMatthias Ringwald 
9093deb3ec6SMatthias Ringwald static int sm_cmac_last_block_complete(void){
9103deb3ec6SMatthias Ringwald     if (sm_cmac_message_len == 0) return 0;
9113deb3ec6SMatthias Ringwald     return (sm_cmac_message_len & 0x0f) == 0;
9123deb3ec6SMatthias Ringwald }
913514d35fcSMatthias Ringwald 
9144dfd504aSMatthias Ringwald int sm_cmac_ready(void){
9154dfd504aSMatthias Ringwald     return sm_cmac_state == CMAC_IDLE;
9163deb3ec6SMatthias Ringwald }
9173deb3ec6SMatthias Ringwald 
918514d35fcSMatthias Ringwald // generic cmac calculation
919aec94140SMatthias Ringwald void sm_cmac_general_start(const sm_key_t key, uint16_t message_len, uint8_t (*get_byte_callback)(uint16_t offset), void (*done_callback)(uint8_t hash[8])){
920514d35fcSMatthias Ringwald     // Generalized CMAC
921514d35fcSMatthias Ringwald     memcpy(sm_cmac_k, key, 16);
9223deb3ec6SMatthias Ringwald     memset(sm_cmac_x, 0, 16);
923514d35fcSMatthias Ringwald     sm_cmac_block_current = 0;
924514d35fcSMatthias Ringwald     sm_cmac_message_len  = message_len;
925514d35fcSMatthias Ringwald     sm_cmac_done_handler = done_callback;
926514d35fcSMatthias Ringwald     sm_cmac_get_byte     = get_byte_callback;
9273deb3ec6SMatthias Ringwald 
9283deb3ec6SMatthias Ringwald     // step 2: n := ceil(len/const_Bsize);
9293deb3ec6SMatthias Ringwald     sm_cmac_block_count = (sm_cmac_message_len + 15) / 16;
9303deb3ec6SMatthias Ringwald 
9313deb3ec6SMatthias Ringwald     // step 3: ..
9323deb3ec6SMatthias Ringwald     if (sm_cmac_block_count==0){
9333deb3ec6SMatthias Ringwald         sm_cmac_block_count = 1;
9343deb3ec6SMatthias Ringwald     }
935514d35fcSMatthias Ringwald     log_info("sm_cmac_general_start: len %u, block count %u", sm_cmac_message_len, sm_cmac_block_count);
9363deb3ec6SMatthias Ringwald 
9373deb3ec6SMatthias Ringwald     // first, we need to compute l for k1, k2, and m_last
9383deb3ec6SMatthias Ringwald     sm_cmac_state = CMAC_CALC_SUBKEYS;
9393deb3ec6SMatthias Ringwald 
9403deb3ec6SMatthias Ringwald     // let's go
9413deb3ec6SMatthias Ringwald     sm_run();
9423deb3ec6SMatthias Ringwald }
9437a766ebfSMatthias Ringwald #endif
9443deb3ec6SMatthias Ringwald 
945514d35fcSMatthias Ringwald // cmac for ATT Message signing
9467a766ebfSMatthias Ringwald #ifdef ENABLE_LE_SIGNED_WRITE
9474dfd504aSMatthias Ringwald static uint8_t sm_cmac_signed_write_message_get_byte(uint16_t offset){
9484dfd504aSMatthias Ringwald     if (offset >= sm_cmac_message_len) {
9494dfd504aSMatthias Ringwald         log_error("sm_cmac_signed_write_message_get_byte. out of bounds, access %u, len %u", offset, sm_cmac_message_len);
9504dfd504aSMatthias Ringwald         return 0;
9514dfd504aSMatthias Ringwald     }
9524dfd504aSMatthias Ringwald 
9534dfd504aSMatthias Ringwald     offset = sm_cmac_message_len - 1 - offset;
9544dfd504aSMatthias Ringwald 
9554dfd504aSMatthias Ringwald     // sm_cmac_header[3] | message[] | sm_cmac_sign_counter[4]
9564dfd504aSMatthias Ringwald     if (offset < 3){
9574dfd504aSMatthias Ringwald         return sm_cmac_header[offset];
9584dfd504aSMatthias Ringwald     }
9594dfd504aSMatthias Ringwald     int actual_message_len_incl_header = sm_cmac_message_len - 4;
9604dfd504aSMatthias Ringwald     if (offset <  actual_message_len_incl_header){
9614dfd504aSMatthias Ringwald         return sm_cmac_message[offset - 3];
9624dfd504aSMatthias Ringwald     }
9634dfd504aSMatthias Ringwald     return sm_cmac_sign_counter[offset - actual_message_len_incl_header];
9644dfd504aSMatthias Ringwald }
9654dfd504aSMatthias Ringwald 
9664dfd504aSMatthias Ringwald void sm_cmac_signed_write_start(const sm_key_t k, uint8_t opcode, hci_con_handle_t con_handle, uint16_t message_len, const uint8_t * message, uint32_t sign_counter, void (*done_handler)(uint8_t * hash)){
967514d35fcSMatthias Ringwald     // ATT Message Signing
968514d35fcSMatthias Ringwald     sm_cmac_header[0] = opcode;
969514d35fcSMatthias Ringwald     little_endian_store_16(sm_cmac_header, 1, con_handle);
970514d35fcSMatthias Ringwald     little_endian_store_32(sm_cmac_sign_counter, 0, sign_counter);
971514d35fcSMatthias Ringwald     uint16_t total_message_len = 3 + message_len + 4;  // incl. virtually prepended att opcode, handle and appended sign_counter in LE
972514d35fcSMatthias Ringwald     sm_cmac_message = message;
9734dfd504aSMatthias Ringwald     sm_cmac_general_start(k, total_message_len, &sm_cmac_signed_write_message_get_byte, done_handler);
974514d35fcSMatthias Ringwald }
9757a766ebfSMatthias Ringwald #endif
976514d35fcSMatthias Ringwald 
9777a766ebfSMatthias Ringwald #ifdef ENABLE_CMAC_ENGINE
9783deb3ec6SMatthias Ringwald static void sm_cmac_handle_aes_engine_ready(void){
9793deb3ec6SMatthias Ringwald     switch (sm_cmac_state){
9803deb3ec6SMatthias Ringwald         case CMAC_CALC_SUBKEYS: {
9813deb3ec6SMatthias Ringwald             sm_key_t const_zero;
9823deb3ec6SMatthias Ringwald             memset(const_zero, 0, 16);
9833deb3ec6SMatthias Ringwald             sm_cmac_next_state();
9843deb3ec6SMatthias Ringwald             sm_aes128_start(sm_cmac_k, const_zero, NULL);
9853deb3ec6SMatthias Ringwald             break;
9863deb3ec6SMatthias Ringwald         }
9873deb3ec6SMatthias Ringwald         case CMAC_CALC_MI: {
9883deb3ec6SMatthias Ringwald             int j;
9893deb3ec6SMatthias Ringwald             sm_key_t y;
9903deb3ec6SMatthias Ringwald             for (j=0;j<16;j++){
991514d35fcSMatthias Ringwald                 y[j] = sm_cmac_x[j] ^ sm_cmac_get_byte(sm_cmac_block_current*16 + j);
9923deb3ec6SMatthias Ringwald             }
9933deb3ec6SMatthias Ringwald             sm_cmac_block_current++;
9943deb3ec6SMatthias Ringwald             sm_cmac_next_state();
9953deb3ec6SMatthias Ringwald             sm_aes128_start(sm_cmac_k, y, NULL);
9963deb3ec6SMatthias Ringwald             break;
9973deb3ec6SMatthias Ringwald         }
9983deb3ec6SMatthias Ringwald         case CMAC_CALC_MLAST: {
9993deb3ec6SMatthias Ringwald             int i;
10003deb3ec6SMatthias Ringwald             sm_key_t y;
10013deb3ec6SMatthias Ringwald             for (i=0;i<16;i++){
10023deb3ec6SMatthias Ringwald                 y[i] = sm_cmac_x[i] ^ sm_cmac_m_last[i];
10033deb3ec6SMatthias Ringwald             }
10048314c363SMatthias Ringwald             log_info_key("Y", y);
10053deb3ec6SMatthias Ringwald             sm_cmac_block_current++;
10063deb3ec6SMatthias Ringwald             sm_cmac_next_state();
10073deb3ec6SMatthias Ringwald             sm_aes128_start(sm_cmac_k, y, NULL);
10083deb3ec6SMatthias Ringwald             break;
10093deb3ec6SMatthias Ringwald         }
10103deb3ec6SMatthias Ringwald         default:
10113deb3ec6SMatthias Ringwald             log_info("sm_cmac_handle_aes_engine_ready called in state %u", sm_cmac_state);
10123deb3ec6SMatthias Ringwald             break;
10133deb3ec6SMatthias Ringwald     }
10143deb3ec6SMatthias Ringwald }
10153deb3ec6SMatthias Ringwald 
10167a766ebfSMatthias Ringwald // CMAC Implementation using AES128 engine
10177a766ebfSMatthias Ringwald static void sm_shift_left_by_one_bit_inplace(int len, uint8_t * data){
10187a766ebfSMatthias Ringwald     int i;
10197a766ebfSMatthias Ringwald     int carry = 0;
10207a766ebfSMatthias Ringwald     for (i=len-1; i >= 0 ; i--){
10217a766ebfSMatthias Ringwald         int new_carry = data[i] >> 7;
10227a766ebfSMatthias Ringwald         data[i] = data[i] << 1 | carry;
10237a766ebfSMatthias Ringwald         carry = new_carry;
10247a766ebfSMatthias Ringwald     }
10257a766ebfSMatthias Ringwald }
10267a766ebfSMatthias Ringwald 
10273deb3ec6SMatthias Ringwald static void sm_cmac_handle_encryption_result(sm_key_t data){
10283deb3ec6SMatthias Ringwald     switch (sm_cmac_state){
10293deb3ec6SMatthias Ringwald         case CMAC_W4_SUBKEYS: {
10303deb3ec6SMatthias Ringwald             sm_key_t k1;
10313deb3ec6SMatthias Ringwald             memcpy(k1, data, 16);
10323deb3ec6SMatthias Ringwald             sm_shift_left_by_one_bit_inplace(16, k1);
10333deb3ec6SMatthias Ringwald             if (data[0] & 0x80){
10343deb3ec6SMatthias Ringwald                 k1[15] ^= 0x87;
10353deb3ec6SMatthias Ringwald             }
10363deb3ec6SMatthias Ringwald             sm_key_t k2;
10373deb3ec6SMatthias Ringwald             memcpy(k2, k1, 16);
10383deb3ec6SMatthias Ringwald             sm_shift_left_by_one_bit_inplace(16, k2);
10393deb3ec6SMatthias Ringwald             if (k1[0] & 0x80){
10403deb3ec6SMatthias Ringwald                 k2[15] ^= 0x87;
10413deb3ec6SMatthias Ringwald             }
10423deb3ec6SMatthias Ringwald 
10438314c363SMatthias Ringwald             log_info_key("k", sm_cmac_k);
10448314c363SMatthias Ringwald             log_info_key("k1", k1);
10458314c363SMatthias Ringwald             log_info_key("k2", k2);
10463deb3ec6SMatthias Ringwald 
10473deb3ec6SMatthias Ringwald             // step 4: set m_last
10483deb3ec6SMatthias Ringwald             int i;
10493deb3ec6SMatthias Ringwald             if (sm_cmac_last_block_complete()){
10503deb3ec6SMatthias Ringwald                 for (i=0;i<16;i++){
1051514d35fcSMatthias Ringwald                     sm_cmac_m_last[i] = sm_cmac_get_byte(sm_cmac_message_len - 16 + i) ^ k1[i];
10523deb3ec6SMatthias Ringwald                 }
10533deb3ec6SMatthias Ringwald             } else {
10543deb3ec6SMatthias Ringwald                 int valid_octets_in_last_block = sm_cmac_message_len & 0x0f;
10553deb3ec6SMatthias Ringwald                 for (i=0;i<16;i++){
10563deb3ec6SMatthias Ringwald                     if (i < valid_octets_in_last_block){
1057514d35fcSMatthias Ringwald                         sm_cmac_m_last[i] = sm_cmac_get_byte((sm_cmac_message_len & 0xfff0) + i) ^ k2[i];
10583deb3ec6SMatthias Ringwald                         continue;
10593deb3ec6SMatthias Ringwald                     }
10603deb3ec6SMatthias Ringwald                     if (i == valid_octets_in_last_block){
10613deb3ec6SMatthias Ringwald                         sm_cmac_m_last[i] = 0x80 ^ k2[i];
10623deb3ec6SMatthias Ringwald                         continue;
10633deb3ec6SMatthias Ringwald                     }
10643deb3ec6SMatthias Ringwald                     sm_cmac_m_last[i] = k2[i];
10653deb3ec6SMatthias Ringwald                 }
10663deb3ec6SMatthias Ringwald             }
10673deb3ec6SMatthias Ringwald 
10683deb3ec6SMatthias Ringwald             // next
10693deb3ec6SMatthias Ringwald             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
10703deb3ec6SMatthias Ringwald             break;
10713deb3ec6SMatthias Ringwald         }
10723deb3ec6SMatthias Ringwald         case CMAC_W4_MI:
10733deb3ec6SMatthias Ringwald             memcpy(sm_cmac_x, data, 16);
10743deb3ec6SMatthias Ringwald             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
10753deb3ec6SMatthias Ringwald             break;
10763deb3ec6SMatthias Ringwald         case CMAC_W4_MLAST:
10773deb3ec6SMatthias Ringwald             // done
10780346c37cSMatthias Ringwald             log_info("Setting CMAC Engine to IDLE");
10790346c37cSMatthias Ringwald             sm_cmac_state = CMAC_IDLE;
10808314c363SMatthias Ringwald             log_info_key("CMAC", data);
10813deb3ec6SMatthias Ringwald             sm_cmac_done_handler(data);
10823deb3ec6SMatthias Ringwald             break;
10833deb3ec6SMatthias Ringwald         default:
10843deb3ec6SMatthias Ringwald             log_info("sm_cmac_handle_encryption_result called in state %u", sm_cmac_state);
10853deb3ec6SMatthias Ringwald             break;
10863deb3ec6SMatthias Ringwald     }
10873deb3ec6SMatthias Ringwald }
10887a766ebfSMatthias Ringwald #endif
10893deb3ec6SMatthias Ringwald 
10903deb3ec6SMatthias Ringwald static void sm_trigger_user_response(sm_connection_t * sm_conn){
1091446a8c36SMatthias Ringwald     // notify client for: JUST WORKS confirm, Numeric comparison confirm, PASSKEY display or input
10923deb3ec6SMatthias Ringwald     setup->sm_user_response = SM_USER_RESPONSE_IDLE;
10933deb3ec6SMatthias Ringwald     switch (setup->sm_stk_generation_method){
10943deb3ec6SMatthias Ringwald         case PK_RESP_INPUT:
109542134bc6SMatthias Ringwald             if (IS_RESPONDER(sm_conn->sm_role)){
10963deb3ec6SMatthias Ringwald                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
10975611a760SMatthias Ringwald                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
10983deb3ec6SMatthias Ringwald             } else {
1099c9b8fdd9SMatthias Ringwald                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
11003deb3ec6SMatthias Ringwald             }
11013deb3ec6SMatthias Ringwald             break;
11023deb3ec6SMatthias Ringwald         case PK_INIT_INPUT:
110342134bc6SMatthias Ringwald             if (IS_RESPONDER(sm_conn->sm_role)){
1104c9b8fdd9SMatthias Ringwald                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
11053deb3ec6SMatthias Ringwald             } else {
11063deb3ec6SMatthias Ringwald                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
11075611a760SMatthias Ringwald                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
11083deb3ec6SMatthias Ringwald             }
11093deb3ec6SMatthias Ringwald             break;
11103deb3ec6SMatthias Ringwald         case OK_BOTH_INPUT:
11113deb3ec6SMatthias Ringwald             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
11125611a760SMatthias Ringwald             sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
11133deb3ec6SMatthias Ringwald             break;
111427c32905SMatthias Ringwald         case NK_BOTH_INPUT:
1115446a8c36SMatthias Ringwald             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1116c8c46d51SMatthias Ringwald             sm_notify_client_passkey(SM_EVENT_NUMERIC_COMPARISON_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
111727c32905SMatthias Ringwald             break;
11183deb3ec6SMatthias Ringwald         case JUST_WORKS:
11193deb3ec6SMatthias Ringwald             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
11205611a760SMatthias Ringwald             sm_notify_client_base(SM_EVENT_JUST_WORKS_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
11213deb3ec6SMatthias Ringwald             break;
11223deb3ec6SMatthias Ringwald         case OOB:
11233deb3ec6SMatthias Ringwald             // client already provided OOB data, let's skip notification.
11243deb3ec6SMatthias Ringwald             break;
11253deb3ec6SMatthias Ringwald     }
11263deb3ec6SMatthias Ringwald }
11273deb3ec6SMatthias Ringwald 
11283deb3ec6SMatthias Ringwald static int sm_key_distribution_all_received(sm_connection_t * sm_conn){
11293deb3ec6SMatthias Ringwald     int recv_flags;
113042134bc6SMatthias Ringwald     if (IS_RESPONDER(sm_conn->sm_role)){
113152f9cf63SMatthias Ringwald         // slave / responder
11321ad129beSMatthias Ringwald         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres));
11333deb3ec6SMatthias Ringwald     } else {
11343deb3ec6SMatthias Ringwald         // master / initiator
11351ad129beSMatthias Ringwald         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
11363deb3ec6SMatthias Ringwald     }
11373deb3ec6SMatthias Ringwald     log_debug("sm_key_distribution_all_received: received 0x%02x, expecting 0x%02x", setup->sm_key_distribution_received_set, recv_flags);
11383deb3ec6SMatthias Ringwald     return recv_flags == setup->sm_key_distribution_received_set;
11393deb3ec6SMatthias Ringwald }
11403deb3ec6SMatthias Ringwald 
1141711e6c80SMatthias Ringwald static void sm_done_for_handle(hci_con_handle_t con_handle){
11427149bde5SMatthias Ringwald     if (sm_active_connection_handle == con_handle){
11433deb3ec6SMatthias Ringwald         sm_timeout_stop();
11447149bde5SMatthias Ringwald         sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
1145711e6c80SMatthias Ringwald         log_info("sm: connection 0x%x released setup context", con_handle);
11463deb3ec6SMatthias Ringwald     }
11473deb3ec6SMatthias Ringwald }
11483deb3ec6SMatthias Ringwald 
11493deb3ec6SMatthias Ringwald static int sm_key_distribution_flags_for_auth_req(void){
11503deb3ec6SMatthias Ringwald     int flags = SM_KEYDIST_ID_KEY | SM_KEYDIST_SIGN;
11513deb3ec6SMatthias Ringwald     if (sm_auth_req & SM_AUTHREQ_BONDING){
11523deb3ec6SMatthias Ringwald         // encryption information only if bonding requested
11533deb3ec6SMatthias Ringwald         flags |= SM_KEYDIST_ENC_KEY;
11543deb3ec6SMatthias Ringwald     }
11553deb3ec6SMatthias Ringwald     return flags;
11563deb3ec6SMatthias Ringwald }
11573deb3ec6SMatthias Ringwald 
1158d7471931SMatthias Ringwald static void sm_reset_setup(void){
11593deb3ec6SMatthias Ringwald     // fill in sm setup
1160901c000fSMatthias Ringwald     setup->sm_state_vars = 0;
11613d7fe1e9SMatthias Ringwald     setup->sm_keypress_notification = 0xff;
11623deb3ec6SMatthias Ringwald     sm_reset_tk();
1163d7471931SMatthias Ringwald }
1164d7471931SMatthias Ringwald 
1165d7471931SMatthias Ringwald static void sm_init_setup(sm_connection_t * sm_conn){
1166d7471931SMatthias Ringwald 
1167d7471931SMatthias Ringwald     // fill in sm setup
11683deb3ec6SMatthias Ringwald     setup->sm_peer_addr_type = sm_conn->sm_peer_addr_type;
11693deb3ec6SMatthias Ringwald     memcpy(setup->sm_peer_address, sm_conn->sm_peer_address, 6);
11703deb3ec6SMatthias Ringwald 
11713deb3ec6SMatthias Ringwald     // query client for OOB data
11723deb3ec6SMatthias Ringwald     int have_oob_data = 0;
11733deb3ec6SMatthias Ringwald     if (sm_get_oob_data) {
11743deb3ec6SMatthias Ringwald         have_oob_data = (*sm_get_oob_data)(sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, setup->sm_tk);
11753deb3ec6SMatthias Ringwald     }
11763deb3ec6SMatthias Ringwald 
11773deb3ec6SMatthias Ringwald     sm_pairing_packet_t * local_packet;
117842134bc6SMatthias Ringwald     if (IS_RESPONDER(sm_conn->sm_role)){
11793deb3ec6SMatthias Ringwald         // slave
11803deb3ec6SMatthias Ringwald         local_packet = &setup->sm_s_pres;
1181b95a5a35SMatthias Ringwald         gap_le_get_own_address(&setup->sm_s_addr_type, setup->sm_s_address);
11823deb3ec6SMatthias Ringwald         setup->sm_m_addr_type = sm_conn->sm_peer_addr_type;
11833deb3ec6SMatthias Ringwald         memcpy(setup->sm_m_address, sm_conn->sm_peer_address, 6);
11843deb3ec6SMatthias Ringwald     } else {
11853deb3ec6SMatthias Ringwald         // master
11863deb3ec6SMatthias Ringwald         local_packet = &setup->sm_m_preq;
1187b95a5a35SMatthias Ringwald         gap_le_get_own_address(&setup->sm_m_addr_type, setup->sm_m_address);
11883deb3ec6SMatthias Ringwald         setup->sm_s_addr_type = sm_conn->sm_peer_addr_type;
11893deb3ec6SMatthias Ringwald         memcpy(setup->sm_s_address, sm_conn->sm_peer_address, 6);
11903deb3ec6SMatthias Ringwald 
11913deb3ec6SMatthias Ringwald         int key_distribution_flags = sm_key_distribution_flags_for_auth_req();
11921ad129beSMatthias Ringwald         sm_pairing_packet_set_initiator_key_distribution(setup->sm_m_preq, key_distribution_flags);
11931ad129beSMatthias Ringwald         sm_pairing_packet_set_responder_key_distribution(setup->sm_m_preq, key_distribution_flags);
11943deb3ec6SMatthias Ringwald     }
11953deb3ec6SMatthias Ringwald 
1196df86eb96SMatthias Ringwald     uint8_t auth_req = sm_auth_req;
11971ad129beSMatthias Ringwald     sm_pairing_packet_set_io_capability(*local_packet, sm_io_capabilities);
11981ad129beSMatthias Ringwald     sm_pairing_packet_set_oob_data_flag(*local_packet, have_oob_data);
1199df86eb96SMatthias Ringwald     sm_pairing_packet_set_auth_req(*local_packet, auth_req);
12001ad129beSMatthias Ringwald     sm_pairing_packet_set_max_encryption_key_size(*local_packet, sm_max_encryption_key_size);
12013deb3ec6SMatthias Ringwald }
12023deb3ec6SMatthias Ringwald 
12033deb3ec6SMatthias Ringwald static int sm_stk_generation_init(sm_connection_t * sm_conn){
12043deb3ec6SMatthias Ringwald 
12053deb3ec6SMatthias Ringwald     sm_pairing_packet_t * remote_packet;
12063deb3ec6SMatthias Ringwald     int                   remote_key_request;
120742134bc6SMatthias Ringwald     if (IS_RESPONDER(sm_conn->sm_role)){
120852f9cf63SMatthias Ringwald         // slave / responder
12093deb3ec6SMatthias Ringwald         remote_packet      = &setup->sm_m_preq;
12101ad129beSMatthias Ringwald         remote_key_request = sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq);
12113deb3ec6SMatthias Ringwald     } else {
12123deb3ec6SMatthias Ringwald         // master / initiator
12133deb3ec6SMatthias Ringwald         remote_packet      = &setup->sm_s_pres;
12141ad129beSMatthias Ringwald         remote_key_request = sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres);
12153deb3ec6SMatthias Ringwald     }
12163deb3ec6SMatthias Ringwald 
12173deb3ec6SMatthias Ringwald     // check key size
12181ad129beSMatthias Ringwald     sm_conn->sm_actual_encryption_key_size = sm_calc_actual_encryption_key_size(sm_pairing_packet_get_max_encryption_key_size(*remote_packet));
12193deb3ec6SMatthias Ringwald     if (sm_conn->sm_actual_encryption_key_size == 0) return SM_REASON_ENCRYPTION_KEY_SIZE;
12203deb3ec6SMatthias Ringwald 
12213deb3ec6SMatthias Ringwald     // decide on STK generation method
12223deb3ec6SMatthias Ringwald     sm_setup_tk();
12233deb3ec6SMatthias Ringwald     log_info("SMP: generation method %u", setup->sm_stk_generation_method);
12243deb3ec6SMatthias Ringwald 
12253deb3ec6SMatthias Ringwald     // check if STK generation method is acceptable by client
12263deb3ec6SMatthias Ringwald     if (!sm_validate_stk_generation_method()) return SM_REASON_AUTHENTHICATION_REQUIREMENTS;
12273deb3ec6SMatthias Ringwald 
122852f9cf63SMatthias Ringwald     // identical to responder
122952f9cf63SMatthias Ringwald     sm_setup_key_distribution(remote_key_request);
123052f9cf63SMatthias Ringwald 
12313deb3ec6SMatthias Ringwald     // JUST WORKS doens't provide authentication
12323deb3ec6SMatthias Ringwald     sm_conn->sm_connection_authenticated = setup->sm_stk_generation_method == JUST_WORKS ? 0 : 1;
12333deb3ec6SMatthias Ringwald 
12343deb3ec6SMatthias Ringwald     return 0;
12353deb3ec6SMatthias Ringwald }
12363deb3ec6SMatthias Ringwald 
12373deb3ec6SMatthias Ringwald static void sm_address_resolution_handle_event(address_resolution_event_t event){
12383deb3ec6SMatthias Ringwald 
12393deb3ec6SMatthias Ringwald     // cache and reset context
12403deb3ec6SMatthias Ringwald     int matched_device_id = sm_address_resolution_test;
12413deb3ec6SMatthias Ringwald     address_resolution_mode_t mode = sm_address_resolution_mode;
12423deb3ec6SMatthias Ringwald     void * context = sm_address_resolution_context;
12433deb3ec6SMatthias Ringwald 
12443deb3ec6SMatthias Ringwald     // reset context
12453deb3ec6SMatthias Ringwald     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
12463deb3ec6SMatthias Ringwald     sm_address_resolution_context = NULL;
12473deb3ec6SMatthias Ringwald     sm_address_resolution_test = -1;
1248711e6c80SMatthias Ringwald     hci_con_handle_t con_handle = 0;
12493deb3ec6SMatthias Ringwald 
12503deb3ec6SMatthias Ringwald     sm_connection_t * sm_connection;
125142134bc6SMatthias Ringwald #ifdef ENABLE_LE_CENTRAL
1252d2e90122SMatthias Ringwald     sm_key_t ltk;
125342134bc6SMatthias Ringwald #endif
12543deb3ec6SMatthias Ringwald     switch (mode){
12553deb3ec6SMatthias Ringwald         case ADDRESS_RESOLUTION_GENERAL:
12563deb3ec6SMatthias Ringwald             break;
12573deb3ec6SMatthias Ringwald         case ADDRESS_RESOLUTION_FOR_CONNECTION:
12583deb3ec6SMatthias Ringwald             sm_connection = (sm_connection_t *) context;
1259711e6c80SMatthias Ringwald             con_handle = sm_connection->sm_handle;
12603deb3ec6SMatthias Ringwald             switch (event){
12613deb3ec6SMatthias Ringwald                 case ADDRESS_RESOLUTION_SUCEEDED:
12623deb3ec6SMatthias Ringwald                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_SUCCEEDED;
12633deb3ec6SMatthias Ringwald                     sm_connection->sm_le_db_index = matched_device_id;
12643deb3ec6SMatthias Ringwald                     log_info("ADDRESS_RESOLUTION_SUCEEDED, index %d", sm_connection->sm_le_db_index);
126542134bc6SMatthias Ringwald #ifdef ENABLE_LE_CENTRAL
12663deb3ec6SMatthias Ringwald                     if (sm_connection->sm_role) break;
12673deb3ec6SMatthias Ringwald                     if (!sm_connection->sm_bonding_requested && !sm_connection->sm_security_request_received) break;
12683deb3ec6SMatthias Ringwald                     sm_connection->sm_security_request_received = 0;
12693deb3ec6SMatthias Ringwald                     sm_connection->sm_bonding_requested = 0;
1270d2e90122SMatthias Ringwald                     le_device_db_encryption_get(sm_connection->sm_le_db_index, NULL, NULL, ltk, NULL, NULL, NULL);
1271d2e90122SMatthias Ringwald                     if (!sm_is_null_key(ltk)){
12723deb3ec6SMatthias Ringwald                         sm_connection->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
12733deb3ec6SMatthias Ringwald                     } else {
12743deb3ec6SMatthias Ringwald                         sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
12753deb3ec6SMatthias Ringwald                     }
127642134bc6SMatthias Ringwald #endif
12773deb3ec6SMatthias Ringwald                     break;
12783deb3ec6SMatthias Ringwald                 case ADDRESS_RESOLUTION_FAILED:
12793deb3ec6SMatthias Ringwald                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_FAILED;
128042134bc6SMatthias Ringwald #ifdef ENABLE_LE_CENTRAL
12813deb3ec6SMatthias Ringwald                     if (sm_connection->sm_role) break;
12823deb3ec6SMatthias Ringwald                     if (!sm_connection->sm_bonding_requested && !sm_connection->sm_security_request_received) break;
12833deb3ec6SMatthias Ringwald                     sm_connection->sm_security_request_received = 0;
12843deb3ec6SMatthias Ringwald                     sm_connection->sm_bonding_requested = 0;
12853deb3ec6SMatthias Ringwald                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
128642134bc6SMatthias Ringwald #endif
12873deb3ec6SMatthias Ringwald                     break;
12883deb3ec6SMatthias Ringwald             }
12893deb3ec6SMatthias Ringwald             break;
12903deb3ec6SMatthias Ringwald         default:
12913deb3ec6SMatthias Ringwald             break;
12923deb3ec6SMatthias Ringwald     }
12933deb3ec6SMatthias Ringwald 
12943deb3ec6SMatthias Ringwald     switch (event){
12953deb3ec6SMatthias Ringwald         case ADDRESS_RESOLUTION_SUCEEDED:
1296711e6c80SMatthias Ringwald             sm_notify_client_index(SM_EVENT_IDENTITY_RESOLVING_SUCCEEDED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address, matched_device_id);
12973deb3ec6SMatthias Ringwald             break;
12983deb3ec6SMatthias Ringwald         case ADDRESS_RESOLUTION_FAILED:
1299711e6c80SMatthias Ringwald             sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_FAILED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address);
13003deb3ec6SMatthias Ringwald             break;
13013deb3ec6SMatthias Ringwald     }
13023deb3ec6SMatthias Ringwald }
13033deb3ec6SMatthias Ringwald 
13043deb3ec6SMatthias Ringwald static void sm_key_distribution_handle_all_received(sm_connection_t * sm_conn){
13053deb3ec6SMatthias Ringwald 
13063deb3ec6SMatthias Ringwald     int le_db_index = -1;
13073deb3ec6SMatthias Ringwald 
13083deb3ec6SMatthias Ringwald     // lookup device based on IRK
13093deb3ec6SMatthias Ringwald     if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
13103deb3ec6SMatthias Ringwald         int i;
13113deb3ec6SMatthias Ringwald         for (i=0; i < le_device_db_count(); i++){
13123deb3ec6SMatthias Ringwald             sm_key_t irk;
13133deb3ec6SMatthias Ringwald             bd_addr_t address;
13143deb3ec6SMatthias Ringwald             int address_type;
13153deb3ec6SMatthias Ringwald             le_device_db_info(i, &address_type, address, irk);
13163deb3ec6SMatthias Ringwald             if (memcmp(irk, setup->sm_peer_irk, 16) == 0){
13173deb3ec6SMatthias Ringwald                 log_info("sm: device found for IRK, updating");
13183deb3ec6SMatthias Ringwald                 le_db_index = i;
13193deb3ec6SMatthias Ringwald                 break;
13203deb3ec6SMatthias Ringwald             }
13213deb3ec6SMatthias Ringwald         }
13223deb3ec6SMatthias Ringwald     }
13233deb3ec6SMatthias Ringwald 
13243deb3ec6SMatthias Ringwald     // if not found, lookup via public address if possible
13253deb3ec6SMatthias Ringwald     log_info("sm peer addr type %u, peer addres %s", setup->sm_peer_addr_type, bd_addr_to_str(setup->sm_peer_address));
13263deb3ec6SMatthias Ringwald     if (le_db_index < 0 && setup->sm_peer_addr_type == BD_ADDR_TYPE_LE_PUBLIC){
13273deb3ec6SMatthias Ringwald         int i;
13283deb3ec6SMatthias Ringwald         for (i=0; i < le_device_db_count(); i++){
13293deb3ec6SMatthias Ringwald             bd_addr_t address;
13303deb3ec6SMatthias Ringwald             int address_type;
13313deb3ec6SMatthias Ringwald             le_device_db_info(i, &address_type, address, NULL);
13323deb3ec6SMatthias Ringwald             log_info("device %u, sm peer addr type %u, peer addres %s", i, address_type, bd_addr_to_str(address));
13333deb3ec6SMatthias Ringwald             if (address_type == BD_ADDR_TYPE_LE_PUBLIC && memcmp(address, setup->sm_peer_address, 6) == 0){
13343deb3ec6SMatthias Ringwald                 log_info("sm: device found for public address, updating");
13353deb3ec6SMatthias Ringwald                 le_db_index = i;
13363deb3ec6SMatthias Ringwald                 break;
13373deb3ec6SMatthias Ringwald             }
13383deb3ec6SMatthias Ringwald         }
13393deb3ec6SMatthias Ringwald     }
13403deb3ec6SMatthias Ringwald 
13413deb3ec6SMatthias Ringwald     // if not found, add to db
13423deb3ec6SMatthias Ringwald     if (le_db_index < 0) {
13433deb3ec6SMatthias Ringwald         le_db_index = le_device_db_add(setup->sm_peer_addr_type, setup->sm_peer_address, setup->sm_peer_irk);
13443deb3ec6SMatthias Ringwald     }
13453deb3ec6SMatthias Ringwald 
134613377825SMatthias Ringwald     sm_notify_client_index(SM_EVENT_IDENTITY_CREATED, sm_conn->sm_handle, setup->sm_peer_addr_type, setup->sm_peer_address, le_db_index);
134713377825SMatthias Ringwald 
13483deb3ec6SMatthias Ringwald     if (le_db_index >= 0){
13493deb3ec6SMatthias Ringwald 
1350eda85fbfSMatthias Ringwald #ifdef ENABLE_LE_SIGNED_WRITE
13513deb3ec6SMatthias Ringwald         // store local CSRK
13523deb3ec6SMatthias Ringwald         if (setup->sm_key_distribution_send_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
13533deb3ec6SMatthias Ringwald             log_info("sm: store local CSRK");
13543deb3ec6SMatthias Ringwald             le_device_db_local_csrk_set(le_db_index, setup->sm_local_csrk);
13553deb3ec6SMatthias Ringwald             le_device_db_local_counter_set(le_db_index, 0);
13563deb3ec6SMatthias Ringwald         }
13573deb3ec6SMatthias Ringwald 
13583deb3ec6SMatthias Ringwald         // store remote CSRK
13593deb3ec6SMatthias Ringwald         if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
13603deb3ec6SMatthias Ringwald             log_info("sm: store remote CSRK");
13613deb3ec6SMatthias Ringwald             le_device_db_remote_csrk_set(le_db_index, setup->sm_peer_csrk);
13623deb3ec6SMatthias Ringwald             le_device_db_remote_counter_set(le_db_index, 0);
13633deb3ec6SMatthias Ringwald         }
1364eda85fbfSMatthias Ringwald #endif
136578f44163SMatthias Ringwald         // store encryption information for secure connections: LTK generated by ECDH
136678f44163SMatthias Ringwald         if (setup->sm_use_secure_connections){
1367e6343eb6SMatthias Ringwald             log_info("sm: store SC LTK (key size %u, authenticated %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
136878f44163SMatthias Ringwald             uint8_t zero_rand[8];
136978f44163SMatthias Ringwald             memset(zero_rand, 0, 8);
137078f44163SMatthias Ringwald             le_device_db_encryption_set(le_db_index, 0, zero_rand, setup->sm_ltk, sm_conn->sm_actual_encryption_key_size,
137178f44163SMatthias Ringwald                 sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
137278f44163SMatthias Ringwald         }
137378f44163SMatthias Ringwald 
1374e6343eb6SMatthias Ringwald         // store encryption information for legacy pairing: peer LTK, EDIV, RAND
137578f44163SMatthias Ringwald         else if ( (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION)
137678f44163SMatthias Ringwald                && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_MASTER_IDENTIFICATION )){
1377e6343eb6SMatthias Ringwald             log_info("sm: set encryption information (key size %u, authenticated %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
13783deb3ec6SMatthias Ringwald             le_device_db_encryption_set(le_db_index, setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
13793deb3ec6SMatthias Ringwald                 sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
138078f44163SMatthias Ringwald 
13813deb3ec6SMatthias Ringwald         }
13823deb3ec6SMatthias Ringwald     }
13833deb3ec6SMatthias Ringwald 
13843deb3ec6SMatthias Ringwald     // keep le_db_index
13853deb3ec6SMatthias Ringwald     sm_conn->sm_le_db_index = le_db_index;
13863deb3ec6SMatthias Ringwald }
13873deb3ec6SMatthias Ringwald 
1388688a08f9SMatthias Ringwald static void sm_pairing_error(sm_connection_t * sm_conn, uint8_t reason){
1389688a08f9SMatthias Ringwald     setup->sm_pairing_failed_reason = reason;
1390688a08f9SMatthias Ringwald     sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1391688a08f9SMatthias Ringwald }
1392688a08f9SMatthias Ringwald 
1393688a08f9SMatthias Ringwald static inline void sm_pdu_received_in_wrong_state(sm_connection_t * sm_conn){
1394688a08f9SMatthias Ringwald     sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
1395688a08f9SMatthias Ringwald }
1396688a08f9SMatthias Ringwald 
13979af0f475SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
1398688a08f9SMatthias Ringwald 
1399dc300847SMatthias Ringwald static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn);
1400945888f5SMatthias Ringwald static int sm_passkey_used(stk_generation_method_t method);
1401f1c1783eSMatthias Ringwald static int sm_just_works_or_numeric_comparison(stk_generation_method_t method);
1402dc300847SMatthias Ringwald 
140368437d83SMatthias Ringwald static void sm_log_ec_keypair(void){
14042e6217a0SMatthias Ringwald     log_info("Elliptic curve: X");
1405fc5bff5fSMatthias Ringwald     log_info_hexdump(&ec_q[0],32);
14062e6217a0SMatthias Ringwald     log_info("Elliptic curve: Y");
1407fc5bff5fSMatthias Ringwald     log_info_hexdump(&ec_q[32],32);
140868437d83SMatthias Ringwald }
140968437d83SMatthias Ringwald 
1410b35a3de2SMatthias Ringwald static void sm_sc_start_calculating_local_confirm(sm_connection_t * sm_conn){
1411b35a3de2SMatthias Ringwald     if (sm_passkey_used(setup->sm_stk_generation_method)){
1412b35a3de2SMatthias Ringwald         sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
1413b35a3de2SMatthias Ringwald     } else {
14141f9d84e9SMatthias Ringwald         sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
1415b35a3de2SMatthias Ringwald     }
1416b35a3de2SMatthias Ringwald }
1417b35a3de2SMatthias Ringwald 
1418688a08f9SMatthias Ringwald static void sm_sc_state_after_receiving_random(sm_connection_t * sm_conn){
141942134bc6SMatthias Ringwald     if (IS_RESPONDER(sm_conn->sm_role)){
1420688a08f9SMatthias Ringwald         // Responder
1421688a08f9SMatthias Ringwald         sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
1422688a08f9SMatthias Ringwald     } else {
1423688a08f9SMatthias Ringwald         // Initiator role
1424688a08f9SMatthias Ringwald         switch (setup->sm_stk_generation_method){
1425688a08f9SMatthias Ringwald             case JUST_WORKS:
1426dc300847SMatthias Ringwald                 sm_sc_prepare_dhkey_check(sm_conn);
1427688a08f9SMatthias Ringwald                 break;
1428688a08f9SMatthias Ringwald 
1429f92edc8eSMatthias Ringwald             case NK_BOTH_INPUT:
1430bd57ffebSMatthias Ringwald                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_G2;
1431688a08f9SMatthias Ringwald                 break;
1432688a08f9SMatthias Ringwald             case PK_INIT_INPUT:
1433688a08f9SMatthias Ringwald             case PK_RESP_INPUT:
1434688a08f9SMatthias Ringwald             case OK_BOTH_INPUT:
1435688a08f9SMatthias Ringwald                 if (setup->sm_passkey_bit < 20) {
1436b35a3de2SMatthias Ringwald                     sm_sc_start_calculating_local_confirm(sm_conn);
1437688a08f9SMatthias Ringwald                 } else {
1438dc300847SMatthias Ringwald                     sm_sc_prepare_dhkey_check(sm_conn);
1439688a08f9SMatthias Ringwald                 }
1440688a08f9SMatthias Ringwald                 break;
1441688a08f9SMatthias Ringwald             case OOB:
1442688a08f9SMatthias Ringwald                 // TODO: implement SC OOB
1443688a08f9SMatthias Ringwald                 break;
1444688a08f9SMatthias Ringwald         }
1445688a08f9SMatthias Ringwald     }
1446688a08f9SMatthias Ringwald }
1447688a08f9SMatthias Ringwald 
1448aec94140SMatthias Ringwald static uint8_t sm_sc_cmac_get_byte(uint16_t offset){
1449aec94140SMatthias Ringwald     return sm_cmac_sc_buffer[offset];
1450aec94140SMatthias Ringwald }
1451688a08f9SMatthias Ringwald 
1452aec94140SMatthias Ringwald static void sm_sc_cmac_done(uint8_t * hash){
1453688a08f9SMatthias Ringwald     log_info("sm_sc_cmac_done: ");
1454688a08f9SMatthias Ringwald     log_info_hexdump(hash, 16);
1455688a08f9SMatthias Ringwald 
1456bd57ffebSMatthias Ringwald     sm_connection_t * sm_conn = sm_cmac_connection;
1457bd57ffebSMatthias Ringwald     sm_cmac_connection = NULL;
14582bacf595SMatthias Ringwald     link_key_type_t link_key_type;
1459bd57ffebSMatthias Ringwald 
1460bd57ffebSMatthias Ringwald     switch (sm_conn->sm_engine_state){
1461aec94140SMatthias Ringwald         case SM_SC_W4_CMAC_FOR_CONFIRMATION:
1462aec94140SMatthias Ringwald             memcpy(setup->sm_local_confirm, hash, 16);
1463bd57ffebSMatthias Ringwald             sm_conn->sm_engine_state = SM_SC_SEND_CONFIRMATION;
1464aec94140SMatthias Ringwald             break;
1465688a08f9SMatthias Ringwald         case SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION:
1466688a08f9SMatthias Ringwald             // check
1467688a08f9SMatthias Ringwald             if (0 != memcmp(hash, setup->sm_peer_confirm, 16)){
1468bd57ffebSMatthias Ringwald                 sm_pairing_error(sm_conn, SM_REASON_CONFIRM_VALUE_FAILED);
1469688a08f9SMatthias Ringwald                 break;
1470688a08f9SMatthias Ringwald             }
1471bd57ffebSMatthias Ringwald             sm_sc_state_after_receiving_random(sm_conn);
1472688a08f9SMatthias Ringwald             break;
1473901c000fSMatthias Ringwald         case SM_SC_W4_CALCULATE_G2: {
1474901c000fSMatthias Ringwald             uint32_t vab = big_endian_read_32(hash, 12) % 1000000;
1475901c000fSMatthias Ringwald             big_endian_store_32(setup->sm_tk, 12, vab);
1476901c000fSMatthias Ringwald             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
1477901c000fSMatthias Ringwald             sm_trigger_user_response(sm_conn);
1478019005a0SMatthias Ringwald             break;
1479019005a0SMatthias Ringwald         }
14800346c37cSMatthias Ringwald         case SM_SC_W4_CALCULATE_F5_SALT:
14810346c37cSMatthias Ringwald             memcpy(setup->sm_t, hash, 16);
1482bd57ffebSMatthias Ringwald             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_MACKEY;
14830346c37cSMatthias Ringwald             break;
14840346c37cSMatthias Ringwald         case SM_SC_W4_CALCULATE_F5_MACKEY:
14850346c37cSMatthias Ringwald             memcpy(setup->sm_mackey, hash, 16);
1486bd57ffebSMatthias Ringwald             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_LTK;
14870346c37cSMatthias Ringwald             break;
14880346c37cSMatthias Ringwald         case SM_SC_W4_CALCULATE_F5_LTK:
1489b18300a6SMatthias Ringwald             // truncate sm_ltk, but keep full LTK for cross-transport key derivation in sm_local_ltk
1490b18300a6SMatthias Ringwald             // Errata Service Release to the Bluetooth Specification: ESR09
1491b18300a6SMatthias Ringwald             //   E6405 – Cross transport key derivation from a key of size less than 128 bits
1492b18300a6SMatthias Ringwald             //   Note: When the BR/EDR link key is being derived from the LTK, the derivation is done before the LTK gets masked."
14930346c37cSMatthias Ringwald             memcpy(setup->sm_ltk, hash, 16);
1494aa7d4d9cSMatthias Ringwald             memcpy(setup->sm_local_ltk, hash, 16);
1495893e9333SMatthias Ringwald             sm_truncate_key(setup->sm_ltk, sm_conn->sm_actual_encryption_key_size);
1496bd57ffebSMatthias Ringwald             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK;
1497019005a0SMatthias Ringwald             break;
1498901c000fSMatthias Ringwald         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
1499901c000fSMatthias Ringwald             memcpy(setup->sm_local_dhkey_check, hash, 16);
150042134bc6SMatthias Ringwald             if (IS_RESPONDER(sm_conn->sm_role)){
1501901c000fSMatthias Ringwald                 // responder
1502901c000fSMatthias Ringwald                 if (setup->sm_state_vars & SM_STATE_VAR_DHKEY_COMMAND_RECEIVED){
1503901c000fSMatthias Ringwald                     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
1504901c000fSMatthias Ringwald                 } else {
1505901c000fSMatthias Ringwald                     sm_conn->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
1506901c000fSMatthias Ringwald                 }
1507901c000fSMatthias Ringwald             } else {
1508901c000fSMatthias Ringwald                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1509901c000fSMatthias Ringwald             }
1510901c000fSMatthias Ringwald             break;
1511901c000fSMatthias Ringwald         case SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
1512901c000fSMatthias Ringwald             if (0 != memcmp(hash, setup->sm_peer_dhkey_check, 16) ){
1513901c000fSMatthias Ringwald                 sm_pairing_error(sm_conn, SM_REASON_DHKEY_CHECK_FAILED);
1514aec94140SMatthias Ringwald                 break;
1515aec94140SMatthias Ringwald             }
151642134bc6SMatthias Ringwald             if (IS_RESPONDER(sm_conn->sm_role)){
1517901c000fSMatthias Ringwald                 // responder
1518901c000fSMatthias Ringwald                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1519901c000fSMatthias Ringwald             } else {
1520901c000fSMatthias Ringwald                 // initiator
1521901c000fSMatthias Ringwald                 sm_conn->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
1522bd57ffebSMatthias Ringwald             }
1523901c000fSMatthias Ringwald             break;
15242bacf595SMatthias Ringwald         case SM_SC_W4_CALCULATE_H6_ILK:
15252bacf595SMatthias Ringwald             memcpy(setup->sm_t, hash, 16);
15262bacf595SMatthias Ringwald             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_H6_BR_EDR_LINK_KEY;
15272bacf595SMatthias Ringwald             break;
15282bacf595SMatthias Ringwald         case SM_SC_W4_CALCULATE_H6_BR_EDR_LINK_KEY:
15298974e43fSMatthias Ringwald #ifdef ENABLE_CLASSIC
15302bacf595SMatthias Ringwald             reverse_128(hash, setup->sm_t);
15312bacf595SMatthias Ringwald             link_key_type = sm_conn->sm_connection_authenticated ?
15322bacf595SMatthias Ringwald                 AUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256 : UNAUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256;
15338974e43fSMatthias Ringwald             log_info("Derived classic link key from LE using h6, type %u", (int) link_key_type);
153442134bc6SMatthias Ringwald             if (IS_RESPONDER(sm_conn->sm_role)){
15352bacf595SMatthias Ringwald                 gap_store_link_key_for_bd_addr(setup->sm_m_address, setup->sm_t, link_key_type);
15368974e43fSMatthias Ringwald             } else {
15378974e43fSMatthias Ringwald                 gap_store_link_key_for_bd_addr(setup->sm_s_address, setup->sm_t, link_key_type);
15388974e43fSMatthias Ringwald             }
153935454696SMatthias Ringwald #endif
15408974e43fSMatthias Ringwald             if (IS_RESPONDER(sm_conn->sm_role)){
15412bacf595SMatthias Ringwald                 sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
15422bacf595SMatthias Ringwald             } else {
15432bacf595SMatthias Ringwald                 gap_store_link_key_for_bd_addr(setup->sm_s_address, setup->sm_t, link_key_type);
15442bacf595SMatthias Ringwald                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
15452bacf595SMatthias Ringwald             }
15462bacf595SMatthias Ringwald             sm_done_for_handle(sm_conn->sm_handle);
15472bacf595SMatthias Ringwald             break;
1548bd57ffebSMatthias Ringwald         default:
1549bd57ffebSMatthias Ringwald             log_error("sm_sc_cmac_done in state %u", sm_conn->sm_engine_state);
1550bd57ffebSMatthias Ringwald             break;
1551bd57ffebSMatthias Ringwald     }
1552aec94140SMatthias Ringwald     sm_run();
1553aec94140SMatthias Ringwald }
1554aec94140SMatthias Ringwald 
1555688a08f9SMatthias Ringwald static void f4_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, uint8_t z){
1556dc300847SMatthias Ringwald     const uint16_t message_len = 65;
1557aec94140SMatthias Ringwald     sm_cmac_connection = sm_conn;
1558aec94140SMatthias Ringwald     memcpy(sm_cmac_sc_buffer, u, 32);
1559aec94140SMatthias Ringwald     memcpy(sm_cmac_sc_buffer+32, v, 32);
1560aec94140SMatthias Ringwald     sm_cmac_sc_buffer[64] = z;
1561aec94140SMatthias Ringwald     log_info("f4 key");
1562aec94140SMatthias Ringwald     log_info_hexdump(x, 16);
1563aec94140SMatthias Ringwald     log_info("f4 message");
1564dc300847SMatthias Ringwald     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1565dc300847SMatthias Ringwald     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1566aec94140SMatthias Ringwald }
1567aec94140SMatthias Ringwald 
15680346c37cSMatthias Ringwald static const sm_key_t f5_salt = { 0x6C ,0x88, 0x83, 0x91, 0xAA, 0xF5, 0xA5, 0x38, 0x60, 0x37, 0x0B, 0xDB, 0x5A, 0x60, 0x83, 0xBE};
15690346c37cSMatthias Ringwald static const uint8_t f5_key_id[] = { 0x62, 0x74, 0x6c, 0x65 };
15700346c37cSMatthias Ringwald static const uint8_t f5_length[] = { 0x01, 0x00};
15710346c37cSMatthias Ringwald 
15720346c37cSMatthias Ringwald static void sm_sc_calculate_dhkey(sm_key256_t dhkey){
15734b8ec5bcSMatthias Ringwald     memset(dhkey, 0, 32);
1574c692d776SMatthias Ringwald #ifdef USE_MICROECC_FOR_ECDH
15754b8ec5bcSMatthias Ringwald #if uECC_SUPPORTS_secp256r1
15764b8ec5bcSMatthias Ringwald     // standard version
15774b8ec5bcSMatthias Ringwald     uECC_shared_secret(setup->sm_peer_q, ec_d, dhkey, uECC_secp256r1());
15784b8ec5bcSMatthias Ringwald #else
15794b8ec5bcSMatthias Ringwald     // static version
1580c692d776SMatthias Ringwald     uECC_shared_secret(setup->sm_peer_q, ec_d, dhkey);
1581c692d776SMatthias Ringwald #endif
15824b8ec5bcSMatthias Ringwald #endif
15830346c37cSMatthias Ringwald     log_info("dhkey");
15840346c37cSMatthias Ringwald     log_info_hexdump(dhkey, 32);
15850346c37cSMatthias Ringwald }
15860346c37cSMatthias Ringwald 
15870346c37cSMatthias Ringwald static void f5_calculate_salt(sm_connection_t * sm_conn){
15880346c37cSMatthias Ringwald     // calculate DHKEY
15890346c37cSMatthias Ringwald     sm_key256_t dhkey;
15900346c37cSMatthias Ringwald     sm_sc_calculate_dhkey(dhkey);
15910346c37cSMatthias Ringwald 
15920346c37cSMatthias Ringwald     // calculate salt for f5
15930346c37cSMatthias Ringwald     const uint16_t message_len = 32;
15940346c37cSMatthias Ringwald     sm_cmac_connection = sm_conn;
15950346c37cSMatthias Ringwald     memcpy(sm_cmac_sc_buffer, dhkey, message_len);
15960346c37cSMatthias Ringwald     sm_cmac_general_start(f5_salt, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
15970346c37cSMatthias Ringwald }
15980346c37cSMatthias Ringwald 
15990346c37cSMatthias Ringwald static inline void f5_mackkey(sm_connection_t * sm_conn, sm_key_t t, const sm_key_t n1, const sm_key_t n2, const sm_key56_t a1, const sm_key56_t a2){
16000346c37cSMatthias Ringwald     const uint16_t message_len = 53;
16010346c37cSMatthias Ringwald     sm_cmac_connection = sm_conn;
16020346c37cSMatthias Ringwald 
16030346c37cSMatthias Ringwald     // f5(W, N1, N2, A1, A2) = AES-CMACT (Counter = 0 || keyID || N1 || N2|| A1|| A2 || Length = 256) -- this is the MacKey
16040346c37cSMatthias Ringwald     sm_cmac_sc_buffer[0] = 0;
16050346c37cSMatthias Ringwald     memcpy(sm_cmac_sc_buffer+01, f5_key_id, 4);
16060346c37cSMatthias Ringwald     memcpy(sm_cmac_sc_buffer+05, n1, 16);
16070346c37cSMatthias Ringwald     memcpy(sm_cmac_sc_buffer+21, n2, 16);
16080346c37cSMatthias Ringwald     memcpy(sm_cmac_sc_buffer+37, a1, 7);
16090346c37cSMatthias Ringwald     memcpy(sm_cmac_sc_buffer+44, a2, 7);
16100346c37cSMatthias Ringwald     memcpy(sm_cmac_sc_buffer+51, f5_length, 2);
16110346c37cSMatthias Ringwald     log_info("f5 key");
16120346c37cSMatthias Ringwald     log_info_hexdump(t, 16);
16130346c37cSMatthias Ringwald     log_info("f5 message for MacKey");
16140346c37cSMatthias Ringwald     log_info_hexdump(sm_cmac_sc_buffer, message_len);
16150346c37cSMatthias Ringwald     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
16160346c37cSMatthias Ringwald }
16170346c37cSMatthias Ringwald 
16180346c37cSMatthias Ringwald static void f5_calculate_mackey(sm_connection_t * sm_conn){
16190346c37cSMatthias Ringwald     sm_key56_t bd_addr_master, bd_addr_slave;
16200346c37cSMatthias Ringwald     bd_addr_master[0] =  setup->sm_m_addr_type;
16210346c37cSMatthias Ringwald     bd_addr_slave[0]  =  setup->sm_s_addr_type;
16220346c37cSMatthias Ringwald     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
16230346c37cSMatthias Ringwald     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
162442134bc6SMatthias Ringwald     if (IS_RESPONDER(sm_conn->sm_role)){
16250346c37cSMatthias Ringwald         // responder
16260346c37cSMatthias Ringwald         f5_mackkey(sm_conn, setup->sm_t, setup->sm_peer_nonce, setup->sm_local_nonce, bd_addr_master, bd_addr_slave);
16270346c37cSMatthias Ringwald     } else {
16280346c37cSMatthias Ringwald         // initiator
16290346c37cSMatthias Ringwald         f5_mackkey(sm_conn, setup->sm_t, setup->sm_local_nonce, setup->sm_peer_nonce, bd_addr_master, bd_addr_slave);
16300346c37cSMatthias Ringwald     }
16310346c37cSMatthias Ringwald }
16320346c37cSMatthias Ringwald 
16330346c37cSMatthias Ringwald // note: must be called right after f5_mackey, as sm_cmac_buffer[1..52] will be reused
16340346c37cSMatthias Ringwald static inline void f5_ltk(sm_connection_t * sm_conn, sm_key_t t){
16350346c37cSMatthias Ringwald     const uint16_t message_len = 53;
16360346c37cSMatthias Ringwald     sm_cmac_connection = sm_conn;
16370346c37cSMatthias Ringwald     sm_cmac_sc_buffer[0] = 1;
16380346c37cSMatthias Ringwald     // 1..52 setup before
16390346c37cSMatthias Ringwald     log_info("f5 key");
16400346c37cSMatthias Ringwald     log_info_hexdump(t, 16);
16410346c37cSMatthias Ringwald     log_info("f5 message for LTK");
16420346c37cSMatthias Ringwald     log_info_hexdump(sm_cmac_sc_buffer, message_len);
16430346c37cSMatthias Ringwald     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
16440346c37cSMatthias Ringwald }
1645f92edc8eSMatthias Ringwald 
16460346c37cSMatthias Ringwald static void f5_calculate_ltk(sm_connection_t * sm_conn){
16470346c37cSMatthias Ringwald     f5_ltk(sm_conn, setup->sm_t);
16480346c37cSMatthias Ringwald }
16490346c37cSMatthias Ringwald 
165027163002SMatthias Ringwald static void f6_engine(sm_connection_t * sm_conn, const sm_key_t w, const sm_key_t n1, const sm_key_t n2, const sm_key_t r, const sm_key24_t io_cap, const sm_key56_t a1, const sm_key56_t a2){
1651dc300847SMatthias Ringwald     const uint16_t message_len = 65;
165227163002SMatthias Ringwald     sm_cmac_connection = sm_conn;
1653dc300847SMatthias Ringwald     memcpy(sm_cmac_sc_buffer, n1, 16);
1654dc300847SMatthias Ringwald     memcpy(sm_cmac_sc_buffer+16, n2, 16);
1655dc300847SMatthias Ringwald     memcpy(sm_cmac_sc_buffer+32, r, 16);
1656dc300847SMatthias Ringwald     memcpy(sm_cmac_sc_buffer+48, io_cap, 3);
1657dc300847SMatthias Ringwald     memcpy(sm_cmac_sc_buffer+51, a1, 7);
1658dc300847SMatthias Ringwald     memcpy(sm_cmac_sc_buffer+58, a2, 7);
1659dc300847SMatthias Ringwald     log_info("f6 key");
1660dc300847SMatthias Ringwald     log_info_hexdump(w, 16);
1661dc300847SMatthias Ringwald     log_info("f6 message");
1662dc300847SMatthias Ringwald     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1663dc300847SMatthias Ringwald     sm_cmac_general_start(w, 65, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1664dc300847SMatthias Ringwald }
1665dc300847SMatthias Ringwald 
1666f92edc8eSMatthias Ringwald // g2(U, V, X, Y) = AES-CMACX(U || V || Y) mod 2^32
1667f92edc8eSMatthias Ringwald // - U is 256 bits
1668f92edc8eSMatthias Ringwald // - V is 256 bits
1669f92edc8eSMatthias Ringwald // - X is 128 bits
1670f92edc8eSMatthias Ringwald // - Y is 128 bits
1671bd57ffebSMatthias Ringwald static void g2_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, const sm_key_t y){
1672bd57ffebSMatthias Ringwald     const uint16_t message_len = 80;
1673bd57ffebSMatthias Ringwald     sm_cmac_connection = sm_conn;
1674bd57ffebSMatthias Ringwald     memcpy(sm_cmac_sc_buffer, u, 32);
1675bd57ffebSMatthias Ringwald     memcpy(sm_cmac_sc_buffer+32, v, 32);
1676bd57ffebSMatthias Ringwald     memcpy(sm_cmac_sc_buffer+64, y, 16);
1677f92edc8eSMatthias Ringwald     log_info("g2 key");
1678f92edc8eSMatthias Ringwald     log_info_hexdump(x, 16);
1679f92edc8eSMatthias Ringwald     log_info("g2 message");
16802bacf595SMatthias Ringwald     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1681bd57ffebSMatthias Ringwald     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1682f92edc8eSMatthias Ringwald }
1683f92edc8eSMatthias Ringwald 
1684b35a3de2SMatthias Ringwald static void g2_calculate(sm_connection_t * sm_conn) {
1685f92edc8eSMatthias Ringwald     // calc Va if numeric comparison
168642134bc6SMatthias Ringwald     if (IS_RESPONDER(sm_conn->sm_role)){
1687f92edc8eSMatthias Ringwald         // responder
1688fc5bff5fSMatthias Ringwald         g2_engine(sm_conn, setup->sm_peer_q, ec_q, setup->sm_peer_nonce, setup->sm_local_nonce);;
1689f92edc8eSMatthias Ringwald     } else {
1690f92edc8eSMatthias Ringwald         // initiator
1691fc5bff5fSMatthias Ringwald         g2_engine(sm_conn, ec_q, setup->sm_peer_q, setup->sm_local_nonce, setup->sm_peer_nonce);
1692f92edc8eSMatthias Ringwald     }
1693f92edc8eSMatthias Ringwald }
1694f92edc8eSMatthias Ringwald 
1695945888f5SMatthias Ringwald static void sm_sc_calculate_local_confirm(sm_connection_t * sm_conn){
16969af0f475SMatthias Ringwald     uint8_t z = 0;
16979af0f475SMatthias Ringwald     if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT){
16989af0f475SMatthias Ringwald         // some form of passkey
16999af0f475SMatthias Ringwald         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
17009af0f475SMatthias Ringwald         z = 0x80 | ((pk >> setup->sm_passkey_bit) & 1);
17019af0f475SMatthias Ringwald         setup->sm_passkey_bit++;
17029af0f475SMatthias Ringwald     }
1703fc5bff5fSMatthias Ringwald     f4_engine(sm_conn, ec_q, setup->sm_peer_q, setup->sm_local_nonce, z);
17049af0f475SMatthias Ringwald }
1705688a08f9SMatthias Ringwald 
1706688a08f9SMatthias Ringwald static void sm_sc_calculate_remote_confirm(sm_connection_t * sm_conn){
1707688a08f9SMatthias Ringwald     uint8_t z = 0;
1708688a08f9SMatthias Ringwald     if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT){
1709688a08f9SMatthias Ringwald         // some form of passkey
1710688a08f9SMatthias Ringwald         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1711688a08f9SMatthias Ringwald         // sm_passkey_bit was increased before sending confirm value
1712688a08f9SMatthias Ringwald         z = 0x80 | ((pk >> (setup->sm_passkey_bit-1)) & 1);
1713688a08f9SMatthias Ringwald     }
1714fc5bff5fSMatthias Ringwald     f4_engine(sm_conn, setup->sm_peer_q, ec_q, setup->sm_peer_nonce, z);
1715688a08f9SMatthias Ringwald }
1716688a08f9SMatthias Ringwald 
17170346c37cSMatthias Ringwald static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn){
17180346c37cSMatthias Ringwald     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_SALT;
1719dc300847SMatthias Ringwald }
1720dc300847SMatthias Ringwald 
1721dc300847SMatthias Ringwald static void sm_sc_calculate_f6_for_dhkey_check(sm_connection_t * sm_conn){
1722dc300847SMatthias Ringwald     // calculate DHKCheck
1723dc300847SMatthias Ringwald     sm_key56_t bd_addr_master, bd_addr_slave;
1724dc300847SMatthias Ringwald     bd_addr_master[0] =  setup->sm_m_addr_type;
1725dc300847SMatthias Ringwald     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1726dc300847SMatthias Ringwald     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1727dc300847SMatthias Ringwald     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1728dc300847SMatthias Ringwald     uint8_t iocap_a[3];
1729dc300847SMatthias Ringwald     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1730dc300847SMatthias Ringwald     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1731dc300847SMatthias Ringwald     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1732dc300847SMatthias Ringwald     uint8_t iocap_b[3];
1733dc300847SMatthias Ringwald     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1734dc300847SMatthias Ringwald     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1735dc300847SMatthias Ringwald     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
173642134bc6SMatthias Ringwald     if (IS_RESPONDER(sm_conn->sm_role)){
1737dc300847SMatthias Ringwald         // responder
173827163002SMatthias Ringwald         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1739dc300847SMatthias Ringwald     } else {
1740dc300847SMatthias Ringwald         // initiator
174127163002SMatthias Ringwald         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1742dc300847SMatthias Ringwald     }
1743dc300847SMatthias Ringwald }
1744dc300847SMatthias Ringwald 
1745019005a0SMatthias Ringwald static void sm_sc_calculate_f6_to_verify_dhkey_check(sm_connection_t * sm_conn){
1746019005a0SMatthias Ringwald     // validate E = f6()
1747019005a0SMatthias Ringwald     sm_key56_t bd_addr_master, bd_addr_slave;
1748019005a0SMatthias Ringwald     bd_addr_master[0] =  setup->sm_m_addr_type;
1749019005a0SMatthias Ringwald     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1750019005a0SMatthias Ringwald     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1751019005a0SMatthias Ringwald     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1752019005a0SMatthias Ringwald 
1753019005a0SMatthias Ringwald     uint8_t iocap_a[3];
1754019005a0SMatthias Ringwald     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1755019005a0SMatthias Ringwald     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1756019005a0SMatthias Ringwald     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1757019005a0SMatthias Ringwald     uint8_t iocap_b[3];
1758019005a0SMatthias Ringwald     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1759019005a0SMatthias Ringwald     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1760019005a0SMatthias Ringwald     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
176142134bc6SMatthias Ringwald     if (IS_RESPONDER(sm_conn->sm_role)){
1762019005a0SMatthias Ringwald         // responder
1763019005a0SMatthias Ringwald         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1764019005a0SMatthias Ringwald     } else {
1765019005a0SMatthias Ringwald         // initiator
1766019005a0SMatthias Ringwald         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1767019005a0SMatthias Ringwald     }
1768019005a0SMatthias Ringwald }
17692bacf595SMatthias Ringwald 
17702bacf595SMatthias Ringwald 
17712bacf595SMatthias Ringwald //
17722bacf595SMatthias Ringwald // Link Key Conversion Function h6
17732bacf595SMatthias Ringwald //
17742bacf595SMatthias Ringwald // h6(W, keyID) = AES-CMACW(keyID)
17752bacf595SMatthias Ringwald // - W is 128 bits
17762bacf595SMatthias Ringwald // - keyID is 32 bits
17772bacf595SMatthias Ringwald static void h6_engine(sm_connection_t * sm_conn, const sm_key_t w, const uint32_t key_id){
17782bacf595SMatthias Ringwald     const uint16_t message_len = 4;
17792bacf595SMatthias Ringwald     sm_cmac_connection = sm_conn;
17802bacf595SMatthias Ringwald     big_endian_store_32(sm_cmac_sc_buffer, 0, key_id);
17812bacf595SMatthias Ringwald     log_info("h6 key");
17822bacf595SMatthias Ringwald     log_info_hexdump(w, 16);
17832bacf595SMatthias Ringwald     log_info("h6 message");
17842bacf595SMatthias Ringwald     log_info_hexdump(sm_cmac_sc_buffer, message_len);
17852bacf595SMatthias Ringwald     sm_cmac_general_start(w, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
17862bacf595SMatthias Ringwald }
17872bacf595SMatthias Ringwald 
1788b18300a6SMatthias Ringwald // For SC, setup->sm_local_ltk holds full LTK (sm_ltk is already truncated)
1789b18300a6SMatthias Ringwald // Errata Service Release to the Bluetooth Specification: ESR09
1790b18300a6SMatthias Ringwald //   E6405 – Cross transport key derivation from a key of size less than 128 bits
1791b18300a6SMatthias Ringwald //   "Note: When the BR/EDR link key is being derived from the LTK, the derivation is done before the LTK gets masked."
17922bacf595SMatthias Ringwald static void h6_calculate_ilk(sm_connection_t * sm_conn){
1793b18300a6SMatthias Ringwald     h6_engine(sm_conn, setup->sm_local_ltk, 0x746D7031);    // "tmp1"
17942bacf595SMatthias Ringwald }
17952bacf595SMatthias Ringwald 
17962bacf595SMatthias Ringwald static void h6_calculate_br_edr_link_key(sm_connection_t * sm_conn){
17972bacf595SMatthias Ringwald     h6_engine(sm_conn, setup->sm_t, 0x6c656272);    // "lebr"
17982bacf595SMatthias Ringwald }
17992bacf595SMatthias Ringwald 
18009af0f475SMatthias Ringwald #endif
18019af0f475SMatthias Ringwald 
1802613da3deSMatthias Ringwald // key management legacy connections:
1803613da3deSMatthias Ringwald // - potentially two different LTKs based on direction. each device stores LTK provided by peer
1804613da3deSMatthias Ringwald // - master stores LTK, EDIV, RAND. responder optionally stored master LTK (only if it needs to reconnect)
1805613da3deSMatthias Ringwald // - initiators reconnects: initiator uses stored LTK, EDIV, RAND generated by responder
1806613da3deSMatthias Ringwald // - responder  reconnects: responder uses LTK receveived from master
1807613da3deSMatthias Ringwald 
1808613da3deSMatthias Ringwald // key management secure connections:
1809613da3deSMatthias Ringwald // - both devices store same LTK from ECDH key exchange.
1810613da3deSMatthias Ringwald 
181142134bc6SMatthias Ringwald #if defined(ENABLE_LE_SECURE_CONNECTIONS) || defined(ENABLE_LE_CENTRAL)
18125829ebe2SMatthias Ringwald static void sm_load_security_info(sm_connection_t * sm_connection){
18135829ebe2SMatthias Ringwald     int encryption_key_size;
18145829ebe2SMatthias Ringwald     int authenticated;
18155829ebe2SMatthias Ringwald     int authorized;
18165829ebe2SMatthias Ringwald 
18175829ebe2SMatthias Ringwald     // fetch data from device db - incl. authenticated/authorized/key size. Note all sm_connection_X require encryption enabled
18185829ebe2SMatthias Ringwald     le_device_db_encryption_get(sm_connection->sm_le_db_index, &setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
18195829ebe2SMatthias Ringwald                                 &encryption_key_size, &authenticated, &authorized);
18205829ebe2SMatthias Ringwald     log_info("db index %u, key size %u, authenticated %u, authorized %u", sm_connection->sm_le_db_index, encryption_key_size, authenticated, authorized);
18215829ebe2SMatthias Ringwald     sm_connection->sm_actual_encryption_key_size = encryption_key_size;
18225829ebe2SMatthias Ringwald     sm_connection->sm_connection_authenticated = authenticated;
18235829ebe2SMatthias Ringwald     sm_connection->sm_connection_authorization_state = authorized ? AUTHORIZATION_GRANTED : AUTHORIZATION_UNKNOWN;
18245829ebe2SMatthias Ringwald }
182542134bc6SMatthias Ringwald #endif
1826bd57ffebSMatthias Ringwald 
182742134bc6SMatthias Ringwald #ifdef ENABLE_LE_PERIPHERAL
182859066796SMatthias Ringwald static void sm_start_calculating_ltk_from_ediv_and_rand(sm_connection_t * sm_connection){
182959066796SMatthias Ringwald     memcpy(setup->sm_local_rand, sm_connection->sm_local_rand, 8);
183059066796SMatthias Ringwald     setup->sm_local_ediv = sm_connection->sm_local_ediv;
183159066796SMatthias Ringwald     // re-establish used key encryption size
183259066796SMatthias Ringwald     // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
183359066796SMatthias Ringwald     sm_connection->sm_actual_encryption_key_size = (setup->sm_local_rand[7] & 0x0f) + 1;
183459066796SMatthias Ringwald     // no db for authenticated flag hack: flag is stored in bit 4 of LSB
183559066796SMatthias Ringwald     sm_connection->sm_connection_authenticated = (setup->sm_local_rand[7] & 0x10) >> 4;
183659066796SMatthias Ringwald     log_info("sm: received ltk request with key size %u, authenticated %u",
183759066796SMatthias Ringwald             sm_connection->sm_actual_encryption_key_size, sm_connection->sm_connection_authenticated);
183859066796SMatthias Ringwald     sm_connection->sm_engine_state = SM_RESPONDER_PH4_Y_GET_ENC;
183959066796SMatthias Ringwald }
184042134bc6SMatthias Ringwald #endif
184159066796SMatthias Ringwald 
18423deb3ec6SMatthias Ringwald static void sm_run(void){
18433deb3ec6SMatthias Ringwald 
1844665d90f2SMatthias Ringwald     btstack_linked_list_iterator_t it;
18453deb3ec6SMatthias Ringwald 
18461b1c95e9SMatthias Ringwald     // assert that stack has already bootet
18471b1c95e9SMatthias Ringwald     if (hci_get_state() != HCI_STATE_WORKING) return;
18481b1c95e9SMatthias Ringwald 
18493deb3ec6SMatthias Ringwald     // assert that we can send at least commands
18503deb3ec6SMatthias Ringwald     if (!hci_can_send_command_packet_now()) return;
18513deb3ec6SMatthias Ringwald 
18523deb3ec6SMatthias Ringwald     //
18533deb3ec6SMatthias Ringwald     // non-connection related behaviour
18543deb3ec6SMatthias Ringwald     //
18553deb3ec6SMatthias Ringwald 
18563deb3ec6SMatthias Ringwald     // distributed key generation
18573deb3ec6SMatthias Ringwald     switch (dkg_state){
18583deb3ec6SMatthias Ringwald         case DKG_CALC_IRK:
18593deb3ec6SMatthias Ringwald             // already busy?
18603deb3ec6SMatthias Ringwald             if (sm_aes128_state == SM_AES128_IDLE) {
18613deb3ec6SMatthias Ringwald                 // IRK = d1(IR, 1, 0)
18623deb3ec6SMatthias Ringwald                 sm_key_t d1_prime;
18633deb3ec6SMatthias Ringwald                 sm_d1_d_prime(1, 0, d1_prime);  // plaintext
18643deb3ec6SMatthias Ringwald                 dkg_next_state();
18653deb3ec6SMatthias Ringwald                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
18663deb3ec6SMatthias Ringwald                 return;
18673deb3ec6SMatthias Ringwald             }
18683deb3ec6SMatthias Ringwald             break;
18693deb3ec6SMatthias Ringwald         case DKG_CALC_DHK:
18703deb3ec6SMatthias Ringwald             // already busy?
18713deb3ec6SMatthias Ringwald             if (sm_aes128_state == SM_AES128_IDLE) {
18723deb3ec6SMatthias Ringwald                 // DHK = d1(IR, 3, 0)
18733deb3ec6SMatthias Ringwald                 sm_key_t d1_prime;
18743deb3ec6SMatthias Ringwald                 sm_d1_d_prime(3, 0, d1_prime);  // plaintext
18753deb3ec6SMatthias Ringwald                 dkg_next_state();
18763deb3ec6SMatthias Ringwald                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
18773deb3ec6SMatthias Ringwald                 return;
18783deb3ec6SMatthias Ringwald             }
18793deb3ec6SMatthias Ringwald             break;
18803deb3ec6SMatthias Ringwald         default:
18813deb3ec6SMatthias Ringwald             break;
18823deb3ec6SMatthias Ringwald     }
18833deb3ec6SMatthias Ringwald 
188409e4d397SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
18857df18c15SMatthias Ringwald     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
1886c692d776SMatthias Ringwald #ifndef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
18877df18c15SMatthias Ringwald         sm_random_start(NULL);
188809e4d397SMatthias Ringwald #else
188909e4d397SMatthias Ringwald         ec_key_generation_state = EC_KEY_GENERATION_W4_KEY;
189009e4d397SMatthias Ringwald         hci_send_cmd(&hci_le_read_local_p256_public_key);
189109e4d397SMatthias Ringwald #endif
18927df18c15SMatthias Ringwald         return;
18937df18c15SMatthias Ringwald     }
18947df18c15SMatthias Ringwald #endif
18957df18c15SMatthias Ringwald 
18963deb3ec6SMatthias Ringwald     // random address updates
18973deb3ec6SMatthias Ringwald     switch (rau_state){
18983deb3ec6SMatthias Ringwald         case RAU_GET_RANDOM:
18993deb3ec6SMatthias Ringwald             rau_next_state();
19003deb3ec6SMatthias Ringwald             sm_random_start(NULL);
19013deb3ec6SMatthias Ringwald             return;
19023deb3ec6SMatthias Ringwald         case RAU_GET_ENC:
19033deb3ec6SMatthias Ringwald             // already busy?
19043deb3ec6SMatthias Ringwald             if (sm_aes128_state == SM_AES128_IDLE) {
19053deb3ec6SMatthias Ringwald                 sm_key_t r_prime;
19063deb3ec6SMatthias Ringwald                 sm_ah_r_prime(sm_random_address, r_prime);
19073deb3ec6SMatthias Ringwald                 rau_next_state();
19083deb3ec6SMatthias Ringwald                 sm_aes128_start(sm_persistent_irk, r_prime, NULL);
19093deb3ec6SMatthias Ringwald                 return;
19103deb3ec6SMatthias Ringwald             }
19113deb3ec6SMatthias Ringwald             break;
19123deb3ec6SMatthias Ringwald         case RAU_SET_ADDRESS:
19133deb3ec6SMatthias Ringwald             log_info("New random address: %s", bd_addr_to_str(sm_random_address));
19143deb3ec6SMatthias Ringwald             rau_state = RAU_IDLE;
19153deb3ec6SMatthias Ringwald             hci_send_cmd(&hci_le_set_random_address, sm_random_address);
19163deb3ec6SMatthias Ringwald             return;
19173deb3ec6SMatthias Ringwald         default:
19183deb3ec6SMatthias Ringwald             break;
19193deb3ec6SMatthias Ringwald     }
19203deb3ec6SMatthias Ringwald 
19217a766ebfSMatthias Ringwald #ifdef ENABLE_CMAC_ENGINE
19223deb3ec6SMatthias Ringwald     // CMAC
19233deb3ec6SMatthias Ringwald     switch (sm_cmac_state){
19243deb3ec6SMatthias Ringwald         case CMAC_CALC_SUBKEYS:
19253deb3ec6SMatthias Ringwald         case CMAC_CALC_MI:
19263deb3ec6SMatthias Ringwald         case CMAC_CALC_MLAST:
19273deb3ec6SMatthias Ringwald             // already busy?
19283deb3ec6SMatthias Ringwald             if (sm_aes128_state == SM_AES128_ACTIVE) break;
19293deb3ec6SMatthias Ringwald             sm_cmac_handle_aes_engine_ready();
19303deb3ec6SMatthias Ringwald             return;
19313deb3ec6SMatthias Ringwald         default:
19323deb3ec6SMatthias Ringwald             break;
19333deb3ec6SMatthias Ringwald     }
19347a766ebfSMatthias Ringwald #endif
19353deb3ec6SMatthias Ringwald 
19363deb3ec6SMatthias Ringwald     // CSRK Lookup
19373deb3ec6SMatthias Ringwald     // -- if csrk lookup ready, find connection that require csrk lookup
19383deb3ec6SMatthias Ringwald     if (sm_address_resolution_idle()){
19393deb3ec6SMatthias Ringwald         hci_connections_get_iterator(&it);
1940665d90f2SMatthias Ringwald         while(btstack_linked_list_iterator_has_next(&it)){
1941665d90f2SMatthias Ringwald             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
19423deb3ec6SMatthias Ringwald             sm_connection_t  * sm_connection  = &hci_connection->sm_connection;
19433deb3ec6SMatthias Ringwald             if (sm_connection->sm_irk_lookup_state == IRK_LOOKUP_W4_READY){
19443deb3ec6SMatthias Ringwald                 // and start lookup
19453deb3ec6SMatthias Ringwald                 sm_address_resolution_start_lookup(sm_connection->sm_peer_addr_type, sm_connection->sm_handle, sm_connection->sm_peer_address, ADDRESS_RESOLUTION_FOR_CONNECTION, sm_connection);
19463deb3ec6SMatthias Ringwald                 sm_connection->sm_irk_lookup_state = IRK_LOOKUP_STARTED;
19473deb3ec6SMatthias Ringwald                 break;
19483deb3ec6SMatthias Ringwald             }
19493deb3ec6SMatthias Ringwald         }
19503deb3ec6SMatthias Ringwald     }
19513deb3ec6SMatthias Ringwald 
19523deb3ec6SMatthias Ringwald     // -- if csrk lookup ready, resolved addresses for received addresses
19533deb3ec6SMatthias Ringwald     if (sm_address_resolution_idle()) {
1954665d90f2SMatthias Ringwald         if (!btstack_linked_list_empty(&sm_address_resolution_general_queue)){
19553deb3ec6SMatthias Ringwald             sm_lookup_entry_t * entry = (sm_lookup_entry_t *) sm_address_resolution_general_queue;
1956665d90f2SMatthias Ringwald             btstack_linked_list_remove(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
19573deb3ec6SMatthias Ringwald             sm_address_resolution_start_lookup(entry->address_type, 0, entry->address, ADDRESS_RESOLUTION_GENERAL, NULL);
19583deb3ec6SMatthias Ringwald             btstack_memory_sm_lookup_entry_free(entry);
19593deb3ec6SMatthias Ringwald         }
19603deb3ec6SMatthias Ringwald     }
19613deb3ec6SMatthias Ringwald 
19623deb3ec6SMatthias Ringwald     // -- Continue with CSRK device lookup by public or resolvable private address
19633deb3ec6SMatthias Ringwald     if (!sm_address_resolution_idle()){
19643deb3ec6SMatthias Ringwald         log_info("LE Device Lookup: device %u/%u", sm_address_resolution_test, le_device_db_count());
19653deb3ec6SMatthias Ringwald         while (sm_address_resolution_test < le_device_db_count()){
19663deb3ec6SMatthias Ringwald             int addr_type;
19673deb3ec6SMatthias Ringwald             bd_addr_t addr;
19683deb3ec6SMatthias Ringwald             sm_key_t irk;
19693deb3ec6SMatthias Ringwald             le_device_db_info(sm_address_resolution_test, &addr_type, addr, irk);
19703deb3ec6SMatthias Ringwald             log_info("device type %u, addr: %s", addr_type, bd_addr_to_str(addr));
19713deb3ec6SMatthias Ringwald 
19723deb3ec6SMatthias Ringwald             if (sm_address_resolution_addr_type == addr_type && memcmp(addr, sm_address_resolution_address, 6) == 0){
19733deb3ec6SMatthias Ringwald                 log_info("LE Device Lookup: found CSRK by { addr_type, address} ");
19743deb3ec6SMatthias Ringwald                 sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
19753deb3ec6SMatthias Ringwald                 break;
19763deb3ec6SMatthias Ringwald             }
19773deb3ec6SMatthias Ringwald 
19783deb3ec6SMatthias Ringwald             if (sm_address_resolution_addr_type == 0){
19793deb3ec6SMatthias Ringwald                 sm_address_resolution_test++;
19803deb3ec6SMatthias Ringwald                 continue;
19813deb3ec6SMatthias Ringwald             }
19823deb3ec6SMatthias Ringwald 
19833deb3ec6SMatthias Ringwald             if (sm_aes128_state == SM_AES128_ACTIVE) break;
19843deb3ec6SMatthias Ringwald 
19853deb3ec6SMatthias Ringwald             log_info("LE Device Lookup: calculate AH");
19868314c363SMatthias Ringwald             log_info_key("IRK", irk);
19873deb3ec6SMatthias Ringwald 
19883deb3ec6SMatthias Ringwald             sm_key_t r_prime;
19893deb3ec6SMatthias Ringwald             sm_ah_r_prime(sm_address_resolution_address, r_prime);
19903deb3ec6SMatthias Ringwald             sm_address_resolution_ah_calculation_active = 1;
19913deb3ec6SMatthias Ringwald             sm_aes128_start(irk, r_prime, sm_address_resolution_context);   // keep context
19923deb3ec6SMatthias Ringwald             return;
19933deb3ec6SMatthias Ringwald         }
19943deb3ec6SMatthias Ringwald 
19953deb3ec6SMatthias Ringwald         if (sm_address_resolution_test >= le_device_db_count()){
19963deb3ec6SMatthias Ringwald             log_info("LE Device Lookup: not found");
19973deb3ec6SMatthias Ringwald             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_FAILED);
19983deb3ec6SMatthias Ringwald         }
19993deb3ec6SMatthias Ringwald     }
20003deb3ec6SMatthias Ringwald 
200141d32297SMatthias Ringwald     // handle basic actions that don't requires the full context
200241d32297SMatthias Ringwald     hci_connections_get_iterator(&it);
20037149bde5SMatthias Ringwald     while((sm_active_connection_handle == HCI_CON_HANDLE_INVALID) && btstack_linked_list_iterator_has_next(&it)){
200441d32297SMatthias Ringwald         hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
200541d32297SMatthias Ringwald         sm_connection_t  * sm_connection = &hci_connection->sm_connection;
200641d32297SMatthias Ringwald         switch(sm_connection->sm_engine_state){
200741d32297SMatthias Ringwald             // responder side
200841d32297SMatthias Ringwald             case SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY:
200941d32297SMatthias Ringwald                 sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
201041d32297SMatthias Ringwald                 hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
201141d32297SMatthias Ringwald                 return;
20124b8b5afeSMatthias Ringwald 
20134b8b5afeSMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
20144b8b5afeSMatthias Ringwald             case SM_SC_RECEIVED_LTK_REQUEST:
20154b8b5afeSMatthias Ringwald                 switch (sm_connection->sm_irk_lookup_state){
20164b8b5afeSMatthias Ringwald                     case IRK_LOOKUP_FAILED:
20174b8b5afeSMatthias Ringwald                         log_info("LTK Request: ediv & random are empty, but no stored LTK (IRK Lookup Failed)");
20184b8b5afeSMatthias Ringwald                         sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
20194b8b5afeSMatthias Ringwald                         hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
20204b8b5afeSMatthias Ringwald                         return;
20214b8b5afeSMatthias Ringwald                     default:
20224b8b5afeSMatthias Ringwald                         break;
20234b8b5afeSMatthias Ringwald                 }
20244b8b5afeSMatthias Ringwald                 break;
20254b8b5afeSMatthias Ringwald #endif
202641d32297SMatthias Ringwald             default:
202741d32297SMatthias Ringwald                 break;
202841d32297SMatthias Ringwald         }
202941d32297SMatthias Ringwald     }
20303deb3ec6SMatthias Ringwald 
20313deb3ec6SMatthias Ringwald     //
20323deb3ec6SMatthias Ringwald     // active connection handling
20333deb3ec6SMatthias Ringwald     // -- use loop to handle next connection if lock on setup context is released
20343deb3ec6SMatthias Ringwald 
20353deb3ec6SMatthias Ringwald     while (1) {
20363deb3ec6SMatthias Ringwald 
20373deb3ec6SMatthias Ringwald         // Find connections that requires setup context and make active if no other is locked
20383deb3ec6SMatthias Ringwald         hci_connections_get_iterator(&it);
20397149bde5SMatthias Ringwald         while((sm_active_connection_handle == HCI_CON_HANDLE_INVALID) && btstack_linked_list_iterator_has_next(&it)){
2040665d90f2SMatthias Ringwald             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
20413deb3ec6SMatthias Ringwald             sm_connection_t  * sm_connection = &hci_connection->sm_connection;
20423deb3ec6SMatthias Ringwald             // - if no connection locked and we're ready/waiting for setup context, fetch it and start
20433deb3ec6SMatthias Ringwald             int done = 1;
20443deb3ec6SMatthias Ringwald             int err;
204542134bc6SMatthias Ringwald             UNUSED(err);
20463deb3ec6SMatthias Ringwald             switch (sm_connection->sm_engine_state) {
204742134bc6SMatthias Ringwald #ifdef ENABLE_LE_PERIPHERAL
20483deb3ec6SMatthias Ringwald                 case SM_RESPONDER_SEND_SECURITY_REQUEST:
20493deb3ec6SMatthias Ringwald                     // send packet if possible,
2050adbe29e8SMatthias Ringwald                     if (l2cap_can_send_fixed_channel_packet_now(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)){
2051b170b20fSMatthias Ringwald                         const uint8_t buffer[2] = { SM_CODE_SECURITY_REQUEST, SM_AUTHREQ_BONDING};
20523deb3ec6SMatthias Ringwald                         sm_connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_REQUEST;
20533deb3ec6SMatthias Ringwald                         l2cap_send_connectionless(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2054b170b20fSMatthias Ringwald                     } else {
2055b170b20fSMatthias Ringwald                         l2cap_request_can_send_fix_channel_now_event(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
20563deb3ec6SMatthias Ringwald                     }
20575829ebe2SMatthias Ringwald                     // don't lock sxetup context yet
20583deb3ec6SMatthias Ringwald                     done = 0;
20593deb3ec6SMatthias Ringwald                     break;
20603deb3ec6SMatthias Ringwald                 case SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED:
2061d7471931SMatthias Ringwald                     sm_reset_setup();
20623deb3ec6SMatthias Ringwald                     sm_init_setup(sm_connection);
20633deb3ec6SMatthias Ringwald                     // recover pairing request
20643deb3ec6SMatthias Ringwald                     memcpy(&setup->sm_m_preq, &sm_connection->sm_m_preq, sizeof(sm_pairing_packet_t));
20653deb3ec6SMatthias Ringwald                     err = sm_stk_generation_init(sm_connection);
20663deb3ec6SMatthias Ringwald                     if (err){
20673deb3ec6SMatthias Ringwald                         setup->sm_pairing_failed_reason = err;
20683deb3ec6SMatthias Ringwald                         sm_connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
20693deb3ec6SMatthias Ringwald                         break;
20703deb3ec6SMatthias Ringwald                     }
20713deb3ec6SMatthias Ringwald                     sm_timeout_start(sm_connection);
20723deb3ec6SMatthias Ringwald                     // generate random number first, if we need to show passkey
20733deb3ec6SMatthias Ringwald                     if (setup->sm_stk_generation_method == PK_INIT_INPUT){
20743deb3ec6SMatthias Ringwald                         sm_connection->sm_engine_state = SM_PH2_GET_RANDOM_TK;
20753deb3ec6SMatthias Ringwald                         break;
20763deb3ec6SMatthias Ringwald                     }
20773deb3ec6SMatthias Ringwald                     sm_connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
20783deb3ec6SMatthias Ringwald                     break;
207942134bc6SMatthias Ringwald                 case SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST:
208042134bc6SMatthias Ringwald                     sm_reset_setup();
208142134bc6SMatthias Ringwald                     sm_start_calculating_ltk_from_ediv_and_rand(sm_connection);
208242134bc6SMatthias Ringwald                     break;
208342134bc6SMatthias Ringwald #endif
208442134bc6SMatthias Ringwald #ifdef ENABLE_LE_CENTRAL
20853deb3ec6SMatthias Ringwald                 case SM_INITIATOR_PH0_HAS_LTK:
2086d7471931SMatthias Ringwald                     sm_reset_setup();
20875829ebe2SMatthias Ringwald                     sm_load_security_info(sm_connection);
20883deb3ec6SMatthias Ringwald                     sm_connection->sm_engine_state = SM_INITIATOR_PH0_SEND_START_ENCRYPTION;
20893deb3ec6SMatthias Ringwald                     break;
209006cd539fSMatthias Ringwald                 case SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST:
209106cd539fSMatthias Ringwald                     sm_reset_setup();
209206cd539fSMatthias Ringwald                     sm_init_setup(sm_connection);
209306cd539fSMatthias Ringwald                     sm_timeout_start(sm_connection);
209406cd539fSMatthias Ringwald                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_SEND_PAIRING_REQUEST;
209506cd539fSMatthias Ringwald                     break;
209642134bc6SMatthias Ringwald #endif
209706cd539fSMatthias Ringwald 
2098549ad5d2SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
209906cd539fSMatthias Ringwald                 case SM_SC_RECEIVED_LTK_REQUEST:
21005829ebe2SMatthias Ringwald                     switch (sm_connection->sm_irk_lookup_state){
2101549ad5d2SMatthias Ringwald                         case IRK_LOOKUP_SUCCEEDED:
2102549ad5d2SMatthias Ringwald                             // assuming Secure Connection, we have a stored LTK and the EDIV/RAND are null
210341d32297SMatthias Ringwald                             // start using context by loading security info
2104d7471931SMatthias Ringwald                             sm_reset_setup();
21055829ebe2SMatthias Ringwald                             sm_load_security_info(sm_connection);
2106549ad5d2SMatthias Ringwald                             if (setup->sm_peer_ediv == 0 && sm_is_null_random(setup->sm_peer_rand) && !sm_is_null_key(setup->sm_peer_ltk)){
2107d7471931SMatthias Ringwald                                 memcpy(setup->sm_ltk, setup->sm_peer_ltk, 16);
2108d7471931SMatthias Ringwald                                 sm_connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK_REPLY;
21095829ebe2SMatthias Ringwald                                 break;
21105829ebe2SMatthias Ringwald                             }
2111549ad5d2SMatthias Ringwald                             log_info("LTK Request: ediv & random are empty, but no stored LTK (IRK Lookup Succeeded)");
21124b8b5afeSMatthias Ringwald                             sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
21134b8b5afeSMatthias Ringwald                             hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
21144b8b5afeSMatthias Ringwald                             // don't lock setup context yet
21154b8b5afeSMatthias Ringwald                             return;
21165829ebe2SMatthias Ringwald                         default:
21175829ebe2SMatthias Ringwald                             // just wait until IRK lookup is completed
211859066796SMatthias Ringwald                             // don't lock setup context yet
21195829ebe2SMatthias Ringwald                             done = 0;
21205829ebe2SMatthias Ringwald                             break;
21215829ebe2SMatthias Ringwald                     }
212206cd539fSMatthias Ringwald                     break;
2123549ad5d2SMatthias Ringwald #endif
21243deb3ec6SMatthias Ringwald                 default:
21253deb3ec6SMatthias Ringwald                     done = 0;
21263deb3ec6SMatthias Ringwald                     break;
21273deb3ec6SMatthias Ringwald             }
21283deb3ec6SMatthias Ringwald             if (done){
21297149bde5SMatthias Ringwald                 sm_active_connection_handle = sm_connection->sm_handle;
21307149bde5SMatthias Ringwald                 log_info("sm: connection 0x%04x locked setup context as %s, state %u", sm_active_connection_handle, sm_connection->sm_role ? "responder" : "initiator", sm_connection->sm_engine_state);
21313deb3ec6SMatthias Ringwald             }
21323deb3ec6SMatthias Ringwald         }
21333deb3ec6SMatthias Ringwald 
21343deb3ec6SMatthias Ringwald         //
21353deb3ec6SMatthias Ringwald         // active connection handling
21363deb3ec6SMatthias Ringwald         //
21373deb3ec6SMatthias Ringwald 
21387149bde5SMatthias Ringwald         if (sm_active_connection_handle == HCI_CON_HANDLE_INVALID) return;
21393deb3ec6SMatthias Ringwald 
21403deb3ec6SMatthias Ringwald         // assert that we could send a SM PDU - not needed for all of the following
21417149bde5SMatthias Ringwald         if (!l2cap_can_send_fixed_channel_packet_now(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)) {
21427149bde5SMatthias Ringwald             log_info("cannot send now, requesting can send now event");
21437149bde5SMatthias Ringwald             l2cap_request_can_send_fix_channel_now_event(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
2144b170b20fSMatthias Ringwald             return;
2145b170b20fSMatthias Ringwald         }
21463deb3ec6SMatthias Ringwald 
21477149bde5SMatthias Ringwald         sm_connection_t * connection = sm_get_connection_for_handle(sm_active_connection_handle);
21487149bde5SMatthias Ringwald         if (!connection) {
21497149bde5SMatthias Ringwald             log_info("no connection for handle 0x%04x", sm_active_connection_handle);
21507149bde5SMatthias Ringwald             return;
21517149bde5SMatthias Ringwald         }
21523deb3ec6SMatthias Ringwald 
21533d7fe1e9SMatthias Ringwald         // send keypress notifications
21543d7fe1e9SMatthias Ringwald         if (setup->sm_keypress_notification != 0xff){
21553d7fe1e9SMatthias Ringwald             uint8_t buffer[2];
21563d7fe1e9SMatthias Ringwald             buffer[0] = SM_CODE_KEYPRESS_NOTIFICATION;
21573d7fe1e9SMatthias Ringwald             buffer[1] = setup->sm_keypress_notification;
21583d7fe1e9SMatthias Ringwald             setup->sm_keypress_notification = 0xff;
21593d7fe1e9SMatthias Ringwald             l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2160d7471931SMatthias Ringwald             return;
21613d7fe1e9SMatthias Ringwald         }
21623d7fe1e9SMatthias Ringwald 
21633deb3ec6SMatthias Ringwald         sm_key_t plaintext;
21643deb3ec6SMatthias Ringwald         int key_distribution_flags;
216542134bc6SMatthias Ringwald         UNUSED(key_distribution_flags);
21663deb3ec6SMatthias Ringwald 
21673deb3ec6SMatthias Ringwald         log_info("sm_run: state %u", connection->sm_engine_state);
21683deb3ec6SMatthias Ringwald 
21693deb3ec6SMatthias Ringwald         switch (connection->sm_engine_state){
21703deb3ec6SMatthias Ringwald 
21713deb3ec6SMatthias Ringwald             // general
21723deb3ec6SMatthias Ringwald             case SM_GENERAL_SEND_PAIRING_FAILED: {
21733deb3ec6SMatthias Ringwald                 uint8_t buffer[2];
21743deb3ec6SMatthias Ringwald                 buffer[0] = SM_CODE_PAIRING_FAILED;
21753deb3ec6SMatthias Ringwald                 buffer[1] = setup->sm_pairing_failed_reason;
21763deb3ec6SMatthias Ringwald                 connection->sm_engine_state = connection->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
21773deb3ec6SMatthias Ringwald                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
21783deb3ec6SMatthias Ringwald                 sm_done_for_handle(connection->sm_handle);
21793deb3ec6SMatthias Ringwald                 break;
21803deb3ec6SMatthias Ringwald             }
21813deb3ec6SMatthias Ringwald 
218241d32297SMatthias Ringwald             // responding state
2183aec94140SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
2184f1c1783eSMatthias Ringwald             case SM_SC_W2_GET_RANDOM_A:
2185f1c1783eSMatthias Ringwald                 sm_random_start(connection);
2186f1c1783eSMatthias Ringwald                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_A;
2187f1c1783eSMatthias Ringwald                 break;
2188f1c1783eSMatthias Ringwald             case SM_SC_W2_GET_RANDOM_B:
2189f1c1783eSMatthias Ringwald                 sm_random_start(connection);
2190f1c1783eSMatthias Ringwald                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_B;
2191f1c1783eSMatthias Ringwald                 break;
2192aec94140SMatthias Ringwald             case SM_SC_W2_CMAC_FOR_CONFIRMATION:
2193aec94140SMatthias Ringwald                 if (!sm_cmac_ready()) break;
2194aec94140SMatthias Ringwald                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CONFIRMATION;
2195aec94140SMatthias Ringwald                 sm_sc_calculate_local_confirm(connection);
2196aec94140SMatthias Ringwald                 break;
2197688a08f9SMatthias Ringwald             case SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION:
2198688a08f9SMatthias Ringwald                 if (!sm_cmac_ready()) break;
2199688a08f9SMatthias Ringwald                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION;
2200688a08f9SMatthias Ringwald                 sm_sc_calculate_remote_confirm(connection);
2201688a08f9SMatthias Ringwald                 break;
2202dc300847SMatthias Ringwald             case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
2203dc300847SMatthias Ringwald                 if (!sm_cmac_ready()) break;
2204dc300847SMatthias Ringwald                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK;
2205dc300847SMatthias Ringwald                 sm_sc_calculate_f6_for_dhkey_check(connection);
2206dc300847SMatthias Ringwald                 break;
2207019005a0SMatthias Ringwald             case SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
2208b35a3de2SMatthias Ringwald                 if (!sm_cmac_ready()) break;
2209019005a0SMatthias Ringwald                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
22100346c37cSMatthias Ringwald                 sm_sc_calculate_f6_to_verify_dhkey_check(connection);
22110346c37cSMatthias Ringwald                 break;
22120346c37cSMatthias Ringwald             case SM_SC_W2_CALCULATE_F5_SALT:
2213b35a3de2SMatthias Ringwald                 if (!sm_cmac_ready()) break;
22140346c37cSMatthias Ringwald                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_SALT;
22150346c37cSMatthias Ringwald                 f5_calculate_salt(connection);
22160346c37cSMatthias Ringwald                 break;
22170346c37cSMatthias Ringwald             case SM_SC_W2_CALCULATE_F5_MACKEY:
2218b35a3de2SMatthias Ringwald                 if (!sm_cmac_ready()) break;
22190346c37cSMatthias Ringwald                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_MACKEY;
22200346c37cSMatthias Ringwald                 f5_calculate_mackey(connection);
22210346c37cSMatthias Ringwald                 break;
22220346c37cSMatthias Ringwald             case SM_SC_W2_CALCULATE_F5_LTK:
2223b35a3de2SMatthias Ringwald                 if (!sm_cmac_ready()) break;
22240346c37cSMatthias Ringwald                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_LTK;
22250346c37cSMatthias Ringwald                 f5_calculate_ltk(connection);
2226019005a0SMatthias Ringwald                 break;
2227bd57ffebSMatthias Ringwald             case SM_SC_W2_CALCULATE_G2:
2228b35a3de2SMatthias Ringwald                 if (!sm_cmac_ready()) break;
2229bd57ffebSMatthias Ringwald                 connection->sm_engine_state = SM_SC_W4_CALCULATE_G2;
2230b35a3de2SMatthias Ringwald                 g2_calculate(connection);
2231bd57ffebSMatthias Ringwald                 break;
22322bacf595SMatthias Ringwald             case SM_SC_W2_CALCULATE_H6_ILK:
22332bacf595SMatthias Ringwald                 if (!sm_cmac_ready()) break;
22342bacf595SMatthias Ringwald                 connection->sm_engine_state = SM_SC_W4_CALCULATE_H6_ILK;
22352bacf595SMatthias Ringwald                 h6_calculate_ilk(connection);
22362bacf595SMatthias Ringwald                 break;
22372bacf595SMatthias Ringwald             case SM_SC_W2_CALCULATE_H6_BR_EDR_LINK_KEY:
22382bacf595SMatthias Ringwald                 if (!sm_cmac_ready()) break;
22392bacf595SMatthias Ringwald                 connection->sm_engine_state = SM_SC_W4_CALCULATE_H6_BR_EDR_LINK_KEY;
22402bacf595SMatthias Ringwald                 h6_calculate_br_edr_link_key(connection);
22412bacf595SMatthias Ringwald                 break;
2242aec94140SMatthias Ringwald #endif
224341d32297SMatthias Ringwald 
224442134bc6SMatthias Ringwald #ifdef ENABLE_LE_CENTRAL
22453deb3ec6SMatthias Ringwald             // initiator side
22463deb3ec6SMatthias Ringwald             case SM_INITIATOR_PH0_SEND_START_ENCRYPTION: {
22473deb3ec6SMatthias Ringwald                 sm_key_t peer_ltk_flipped;
22489c80e4ccSMatthias Ringwald                 reverse_128(setup->sm_peer_ltk, peer_ltk_flipped);
22493deb3ec6SMatthias Ringwald                 connection->sm_engine_state = SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED;
22503deb3ec6SMatthias Ringwald                 log_info("sm: hci_le_start_encryption ediv 0x%04x", setup->sm_peer_ediv);
2251c9b8fdd9SMatthias Ringwald                 uint32_t rand_high = big_endian_read_32(setup->sm_peer_rand, 0);
2252c9b8fdd9SMatthias Ringwald                 uint32_t rand_low  = big_endian_read_32(setup->sm_peer_rand, 4);
22533deb3ec6SMatthias Ringwald                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle,rand_low, rand_high, setup->sm_peer_ediv, peer_ltk_flipped);
22543deb3ec6SMatthias Ringwald                 return;
22553deb3ec6SMatthias Ringwald             }
22563deb3ec6SMatthias Ringwald 
22573deb3ec6SMatthias Ringwald             case SM_INITIATOR_PH1_SEND_PAIRING_REQUEST:
22581ad129beSMatthias Ringwald                 sm_pairing_packet_set_code(setup->sm_m_preq, SM_CODE_PAIRING_REQUEST);
22593deb3ec6SMatthias Ringwald                 connection->sm_engine_state = SM_INITIATOR_PH1_W4_PAIRING_RESPONSE;
22603deb3ec6SMatthias Ringwald                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_m_preq, sizeof(sm_pairing_packet_t));
22613deb3ec6SMatthias Ringwald                 sm_timeout_reset(connection);
22623deb3ec6SMatthias Ringwald                 break;
226342134bc6SMatthias Ringwald #endif
22643deb3ec6SMatthias Ringwald 
226527c32905SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
226641d32297SMatthias Ringwald 
2267c6b7cbd9SMatthias Ringwald             case SM_SC_SEND_PUBLIC_KEY_COMMAND: {
226827c32905SMatthias Ringwald                 uint8_t buffer[65];
226927c32905SMatthias Ringwald                 buffer[0] = SM_CODE_PAIRING_PUBLIC_KEY;
227027c32905SMatthias Ringwald                 //
2271fc5bff5fSMatthias Ringwald                 reverse_256(&ec_q[0],  &buffer[1]);
2272fc5bff5fSMatthias Ringwald                 reverse_256(&ec_q[32], &buffer[33]);
2273e53be891SMatthias Ringwald 
227445a61d50SMatthias Ringwald                 // stk generation method
227545a61d50SMatthias Ringwald                 // passkey entry: notify app to show passkey or to request passkey
227645a61d50SMatthias Ringwald                 switch (setup->sm_stk_generation_method){
227745a61d50SMatthias Ringwald                     case JUST_WORKS:
227845a61d50SMatthias Ringwald                     case NK_BOTH_INPUT:
227942134bc6SMatthias Ringwald                         if (IS_RESPONDER(connection->sm_role)){
228007036a04SMatthias Ringwald                             // responder
2281b35a3de2SMatthias Ringwald                             sm_sc_start_calculating_local_confirm(connection);
228227c32905SMatthias Ringwald                         } else {
228307036a04SMatthias Ringwald                             // initiator
2284c6b7cbd9SMatthias Ringwald                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
228527c32905SMatthias Ringwald                         }
228645a61d50SMatthias Ringwald                         break;
228745a61d50SMatthias Ringwald                     case PK_INIT_INPUT:
228845a61d50SMatthias Ringwald                     case PK_RESP_INPUT:
228945a61d50SMatthias Ringwald                     case OK_BOTH_INPUT:
229007036a04SMatthias Ringwald                         // use random TK for display
229145a61d50SMatthias Ringwald                         memcpy(setup->sm_ra, setup->sm_tk, 16);
229245a61d50SMatthias Ringwald                         memcpy(setup->sm_rb, setup->sm_tk, 16);
229345a61d50SMatthias Ringwald                         setup->sm_passkey_bit = 0;
229407036a04SMatthias Ringwald 
229542134bc6SMatthias Ringwald                         if (IS_RESPONDER(connection->sm_role)){
229645a61d50SMatthias Ringwald                             // responder
2297c6b7cbd9SMatthias Ringwald                             connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
229845a61d50SMatthias Ringwald                         } else {
229945a61d50SMatthias Ringwald                             // initiator
2300c6b7cbd9SMatthias Ringwald                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
230145a61d50SMatthias Ringwald                         }
230245a61d50SMatthias Ringwald                         sm_trigger_user_response(connection);
230345a61d50SMatthias Ringwald                         break;
230445a61d50SMatthias Ringwald                     case OOB:
230545a61d50SMatthias Ringwald                         // TODO: implement SC OOB
230645a61d50SMatthias Ringwald                         break;
230745a61d50SMatthias Ringwald                 }
230845a61d50SMatthias Ringwald 
230927c32905SMatthias Ringwald                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
231027c32905SMatthias Ringwald                 sm_timeout_reset(connection);
231127c32905SMatthias Ringwald                 break;
231227c32905SMatthias Ringwald             }
2313c6b7cbd9SMatthias Ringwald             case SM_SC_SEND_CONFIRMATION: {
2314e53be891SMatthias Ringwald                 uint8_t buffer[17];
2315e53be891SMatthias Ringwald                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
23169af0f475SMatthias Ringwald                 reverse_128(setup->sm_local_confirm, &buffer[1]);
231742134bc6SMatthias Ringwald                 if (IS_RESPONDER(connection->sm_role)){
2318c6b7cbd9SMatthias Ringwald                     connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2319e53be891SMatthias Ringwald                 } else {
2320c6b7cbd9SMatthias Ringwald                     connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2321e53be891SMatthias Ringwald                 }
2322e53be891SMatthias Ringwald                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2323e53be891SMatthias Ringwald                 sm_timeout_reset(connection);
2324e53be891SMatthias Ringwald                 break;
2325e53be891SMatthias Ringwald             }
2326c6b7cbd9SMatthias Ringwald             case SM_SC_SEND_PAIRING_RANDOM: {
2327e53be891SMatthias Ringwald                 uint8_t buffer[17];
2328e53be891SMatthias Ringwald                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2329e53be891SMatthias Ringwald                 reverse_128(setup->sm_local_nonce, &buffer[1]);
233045a61d50SMatthias Ringwald                 if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT && setup->sm_passkey_bit < 20){
233142134bc6SMatthias Ringwald                     if (IS_RESPONDER(connection->sm_role)){
233245a61d50SMatthias Ringwald                         // responder
2333c6b7cbd9SMatthias Ringwald                         connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
233445a61d50SMatthias Ringwald                     } else {
233545a61d50SMatthias Ringwald                         // initiator
2336c6b7cbd9SMatthias Ringwald                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
233745a61d50SMatthias Ringwald                     }
233845a61d50SMatthias Ringwald                 } else {
233942134bc6SMatthias Ringwald                     if (IS_RESPONDER(connection->sm_role)){
2340e53be891SMatthias Ringwald                         // responder
2341446a8c36SMatthias Ringwald                         if (setup->sm_stk_generation_method == NK_BOTH_INPUT){
2342901c000fSMatthias Ringwald                             connection->sm_engine_state = SM_SC_W2_CALCULATE_G2;
23432886623dSMatthias Ringwald                         } else {
23442886623dSMatthias Ringwald                             sm_sc_prepare_dhkey_check(connection);
2345446a8c36SMatthias Ringwald                         }
2346e53be891SMatthias Ringwald                     } else {
2347136d331aSMatthias Ringwald                         // initiator
2348c6b7cbd9SMatthias Ringwald                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2349e53be891SMatthias Ringwald                     }
235045a61d50SMatthias Ringwald                 }
2351e53be891SMatthias Ringwald                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2352e53be891SMatthias Ringwald                 sm_timeout_reset(connection);
2353e53be891SMatthias Ringwald                 break;
2354e53be891SMatthias Ringwald             }
2355c6b7cbd9SMatthias Ringwald             case SM_SC_SEND_DHKEY_CHECK_COMMAND: {
2356e083ca23SMatthias Ringwald                 uint8_t buffer[17];
2357e083ca23SMatthias Ringwald                 buffer[0] = SM_CODE_PAIRING_DHKEY_CHECK;
2358e53be891SMatthias Ringwald                 reverse_128(setup->sm_local_dhkey_check, &buffer[1]);
2359dc300847SMatthias Ringwald 
236042134bc6SMatthias Ringwald                 if (IS_RESPONDER(connection->sm_role)){
2361c6b7cbd9SMatthias Ringwald                     connection->sm_engine_state = SM_SC_W4_LTK_REQUEST_SC;
2362e53be891SMatthias Ringwald                 } else {
2363c6b7cbd9SMatthias Ringwald                     connection->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
2364e53be891SMatthias Ringwald                 }
2365e083ca23SMatthias Ringwald 
2366e53be891SMatthias Ringwald                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2367e53be891SMatthias Ringwald                 sm_timeout_reset(connection);
2368e53be891SMatthias Ringwald                 break;
2369e53be891SMatthias Ringwald             }
2370e53be891SMatthias Ringwald 
2371e53be891SMatthias Ringwald #endif
237242134bc6SMatthias Ringwald 
237342134bc6SMatthias Ringwald #ifdef ENABLE_LE_PERIPHERAL
23743deb3ec6SMatthias Ringwald             case SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE:
23753deb3ec6SMatthias Ringwald                 // echo initiator for now
23761ad129beSMatthias Ringwald                 sm_pairing_packet_set_code(setup->sm_s_pres,SM_CODE_PAIRING_RESPONSE);
23773deb3ec6SMatthias Ringwald                 key_distribution_flags = sm_key_distribution_flags_for_auth_req();
23781ad129beSMatthias Ringwald 
237927c32905SMatthias Ringwald                 if (setup->sm_use_secure_connections){
2380c6b7cbd9SMatthias Ringwald                     connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
238152f9cf63SMatthias Ringwald                     // skip LTK/EDIV for SC
2382bbf8db22SMatthias Ringwald                     log_info("sm: dropping encryption information flag");
238352f9cf63SMatthias Ringwald                     key_distribution_flags &= ~SM_KEYDIST_ENC_KEY;
23840b8af2a5SMatthias Ringwald                 } else {
23850b8af2a5SMatthias Ringwald                     connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_CONFIRM;
238627c32905SMatthias Ringwald                 }
23870b8af2a5SMatthias Ringwald 
238852f9cf63SMatthias Ringwald                 sm_pairing_packet_set_initiator_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_initiator_key_distribution(setup->sm_m_preq) & key_distribution_flags);
238952f9cf63SMatthias Ringwald                 sm_pairing_packet_set_responder_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2390bbf8db22SMatthias Ringwald                 // update key distribution after ENC was dropped
2391cfd5ff74SMatthias Ringwald                 sm_setup_key_distribution(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
239252f9cf63SMatthias Ringwald 
23933deb3ec6SMatthias Ringwald                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_s_pres, sizeof(sm_pairing_packet_t));
23943deb3ec6SMatthias Ringwald                 sm_timeout_reset(connection);
2395446a8c36SMatthias Ringwald                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
23960b8af2a5SMatthias Ringwald                 if (!setup->sm_use_secure_connections || setup->sm_stk_generation_method == JUST_WORKS){
23973deb3ec6SMatthias Ringwald                     sm_trigger_user_response(connection);
2398446a8c36SMatthias Ringwald                 }
23993deb3ec6SMatthias Ringwald                 return;
240042134bc6SMatthias Ringwald #endif
24013deb3ec6SMatthias Ringwald 
24023deb3ec6SMatthias Ringwald             case SM_PH2_SEND_PAIRING_RANDOM: {
24033deb3ec6SMatthias Ringwald                 uint8_t buffer[17];
24043deb3ec6SMatthias Ringwald                 buffer[0] = SM_CODE_PAIRING_RANDOM;
24059c80e4ccSMatthias Ringwald                 reverse_128(setup->sm_local_random, &buffer[1]);
240642134bc6SMatthias Ringwald                 if (IS_RESPONDER(connection->sm_role)){
24073deb3ec6SMatthias Ringwald                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_LTK_REQUEST;
24083deb3ec6SMatthias Ringwald                 } else {
24093deb3ec6SMatthias Ringwald                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_RANDOM;
24103deb3ec6SMatthias Ringwald                 }
24113deb3ec6SMatthias Ringwald                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
24123deb3ec6SMatthias Ringwald                 sm_timeout_reset(connection);
24133deb3ec6SMatthias Ringwald                 break;
24143deb3ec6SMatthias Ringwald             }
24153deb3ec6SMatthias Ringwald 
24163deb3ec6SMatthias Ringwald             case SM_PH2_GET_RANDOM_TK:
24173deb3ec6SMatthias Ringwald             case SM_PH2_C1_GET_RANDOM_A:
24183deb3ec6SMatthias Ringwald             case SM_PH2_C1_GET_RANDOM_B:
24193deb3ec6SMatthias Ringwald             case SM_PH3_GET_RANDOM:
24203deb3ec6SMatthias Ringwald             case SM_PH3_GET_DIV:
24213deb3ec6SMatthias Ringwald                 sm_next_responding_state(connection);
24223deb3ec6SMatthias Ringwald                 sm_random_start(connection);
24233deb3ec6SMatthias Ringwald                 return;
24243deb3ec6SMatthias Ringwald 
24253deb3ec6SMatthias Ringwald             case SM_PH2_C1_GET_ENC_B:
24263deb3ec6SMatthias Ringwald             case SM_PH2_C1_GET_ENC_D:
24273deb3ec6SMatthias Ringwald                 // already busy?
24283deb3ec6SMatthias Ringwald                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
24293deb3ec6SMatthias Ringwald                 sm_next_responding_state(connection);
24303deb3ec6SMatthias Ringwald                 sm_aes128_start(setup->sm_tk, setup->sm_c1_t3_value, connection);
24313deb3ec6SMatthias Ringwald                 return;
24323deb3ec6SMatthias Ringwald 
24333deb3ec6SMatthias Ringwald             case SM_PH3_LTK_GET_ENC:
24343deb3ec6SMatthias Ringwald             case SM_RESPONDER_PH4_LTK_GET_ENC:
24353deb3ec6SMatthias Ringwald                 // already busy?
24363deb3ec6SMatthias Ringwald                 if (sm_aes128_state == SM_AES128_IDLE) {
24373deb3ec6SMatthias Ringwald                     sm_key_t d_prime;
24383deb3ec6SMatthias Ringwald                     sm_d1_d_prime(setup->sm_local_div, 0, d_prime);
24393deb3ec6SMatthias Ringwald                     sm_next_responding_state(connection);
24403deb3ec6SMatthias Ringwald                     sm_aes128_start(sm_persistent_er, d_prime, connection);
24413deb3ec6SMatthias Ringwald                     return;
24423deb3ec6SMatthias Ringwald                 }
24433deb3ec6SMatthias Ringwald                 break;
24443deb3ec6SMatthias Ringwald 
24453deb3ec6SMatthias Ringwald             case SM_PH3_CSRK_GET_ENC:
24463deb3ec6SMatthias Ringwald                 // already busy?
24473deb3ec6SMatthias Ringwald                 if (sm_aes128_state == SM_AES128_IDLE) {
24483deb3ec6SMatthias Ringwald                     sm_key_t d_prime;
24493deb3ec6SMatthias Ringwald                     sm_d1_d_prime(setup->sm_local_div, 1, d_prime);
24503deb3ec6SMatthias Ringwald                     sm_next_responding_state(connection);
24513deb3ec6SMatthias Ringwald                     sm_aes128_start(sm_persistent_er, d_prime, connection);
24523deb3ec6SMatthias Ringwald                     return;
24533deb3ec6SMatthias Ringwald                 }
24543deb3ec6SMatthias Ringwald                 break;
24553deb3ec6SMatthias Ringwald 
24563deb3ec6SMatthias Ringwald             case SM_PH2_C1_GET_ENC_C:
24573deb3ec6SMatthias Ringwald                 // already busy?
24583deb3ec6SMatthias Ringwald                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
24593deb3ec6SMatthias Ringwald                 // calculate m_confirm using aes128 engine - step 1
24603deb3ec6SMatthias Ringwald                 sm_c1_t1(setup->sm_peer_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
24613deb3ec6SMatthias Ringwald                 sm_next_responding_state(connection);
24623deb3ec6SMatthias Ringwald                 sm_aes128_start(setup->sm_tk, plaintext, connection);
24633deb3ec6SMatthias Ringwald                 break;
24643deb3ec6SMatthias Ringwald             case SM_PH2_C1_GET_ENC_A:
24653deb3ec6SMatthias Ringwald                 // already busy?
24663deb3ec6SMatthias Ringwald                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
24673deb3ec6SMatthias Ringwald                 // calculate confirm using aes128 engine - step 1
24683deb3ec6SMatthias Ringwald                 sm_c1_t1(setup->sm_local_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
24693deb3ec6SMatthias Ringwald                 sm_next_responding_state(connection);
24703deb3ec6SMatthias Ringwald                 sm_aes128_start(setup->sm_tk, plaintext, connection);
24713deb3ec6SMatthias Ringwald                 break;
24723deb3ec6SMatthias Ringwald             case SM_PH2_CALC_STK:
24733deb3ec6SMatthias Ringwald                 // already busy?
24743deb3ec6SMatthias Ringwald                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
24753deb3ec6SMatthias Ringwald                 // calculate STK
247642134bc6SMatthias Ringwald                 if (IS_RESPONDER(connection->sm_role)){
24773deb3ec6SMatthias Ringwald                     sm_s1_r_prime(setup->sm_local_random, setup->sm_peer_random, plaintext);
24783deb3ec6SMatthias Ringwald                 } else {
24793deb3ec6SMatthias Ringwald                     sm_s1_r_prime(setup->sm_peer_random, setup->sm_local_random, plaintext);
24803deb3ec6SMatthias Ringwald                 }
24813deb3ec6SMatthias Ringwald                 sm_next_responding_state(connection);
24823deb3ec6SMatthias Ringwald                 sm_aes128_start(setup->sm_tk, plaintext, connection);
24833deb3ec6SMatthias Ringwald                 break;
24843deb3ec6SMatthias Ringwald             case SM_PH3_Y_GET_ENC:
24853deb3ec6SMatthias Ringwald                 // already busy?
24863deb3ec6SMatthias Ringwald                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
24873deb3ec6SMatthias Ringwald                 // PH3B2 - calculate Y from      - enc
24883deb3ec6SMatthias Ringwald                 // Y = dm(DHK, Rand)
24893deb3ec6SMatthias Ringwald                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
24903deb3ec6SMatthias Ringwald                 sm_next_responding_state(connection);
24913deb3ec6SMatthias Ringwald                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
24923deb3ec6SMatthias Ringwald                 return;
24933deb3ec6SMatthias Ringwald             case SM_PH2_C1_SEND_PAIRING_CONFIRM: {
24943deb3ec6SMatthias Ringwald                 uint8_t buffer[17];
24953deb3ec6SMatthias Ringwald                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
24969c80e4ccSMatthias Ringwald                 reverse_128(setup->sm_local_confirm, &buffer[1]);
249742134bc6SMatthias Ringwald                 if (IS_RESPONDER(connection->sm_role)){
24983deb3ec6SMatthias Ringwald                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_PAIRING_RANDOM;
24993deb3ec6SMatthias Ringwald                 } else {
25003deb3ec6SMatthias Ringwald                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_CONFIRM;
25013deb3ec6SMatthias Ringwald                 }
25023deb3ec6SMatthias Ringwald                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
25033deb3ec6SMatthias Ringwald                 sm_timeout_reset(connection);
25043deb3ec6SMatthias Ringwald                 return;
25053deb3ec6SMatthias Ringwald             }
250642134bc6SMatthias Ringwald #ifdef ENABLE_LE_PERIPHERAL
25073deb3ec6SMatthias Ringwald             case SM_RESPONDER_PH2_SEND_LTK_REPLY: {
25083deb3ec6SMatthias Ringwald                 sm_key_t stk_flipped;
25099c80e4ccSMatthias Ringwald                 reverse_128(setup->sm_ltk, stk_flipped);
25103deb3ec6SMatthias Ringwald                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
25113deb3ec6SMatthias Ringwald                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, stk_flipped);
25123deb3ec6SMatthias Ringwald                 return;
25133deb3ec6SMatthias Ringwald             }
2514d7471931SMatthias Ringwald             case SM_RESPONDER_PH4_SEND_LTK_REPLY: {
25153deb3ec6SMatthias Ringwald                 sm_key_t ltk_flipped;
25169c80e4ccSMatthias Ringwald                 reverse_128(setup->sm_ltk, ltk_flipped);
25173deb3ec6SMatthias Ringwald                 connection->sm_engine_state = SM_RESPONDER_IDLE;
25183deb3ec6SMatthias Ringwald                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, ltk_flipped);
25193deb3ec6SMatthias Ringwald                 return;
25203deb3ec6SMatthias Ringwald             }
25213deb3ec6SMatthias Ringwald             case SM_RESPONDER_PH4_Y_GET_ENC:
25223deb3ec6SMatthias Ringwald                 // already busy?
25233deb3ec6SMatthias Ringwald                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
25243deb3ec6SMatthias Ringwald                 log_info("LTK Request: recalculating with ediv 0x%04x", setup->sm_local_ediv);
25253deb3ec6SMatthias Ringwald                 // Y = dm(DHK, Rand)
25263deb3ec6SMatthias Ringwald                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
25273deb3ec6SMatthias Ringwald                 sm_next_responding_state(connection);
25283deb3ec6SMatthias Ringwald                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
25293deb3ec6SMatthias Ringwald                 return;
253042134bc6SMatthias Ringwald #endif
253142134bc6SMatthias Ringwald #ifdef ENABLE_LE_CENTRAL
253242134bc6SMatthias Ringwald             case SM_INITIATOR_PH3_SEND_START_ENCRYPTION: {
253342134bc6SMatthias Ringwald                 sm_key_t stk_flipped;
253442134bc6SMatthias Ringwald                 reverse_128(setup->sm_ltk, stk_flipped);
253542134bc6SMatthias Ringwald                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
253642134bc6SMatthias Ringwald                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle, 0, 0, 0, stk_flipped);
253742134bc6SMatthias Ringwald                 return;
253842134bc6SMatthias Ringwald             }
253942134bc6SMatthias Ringwald #endif
25403deb3ec6SMatthias Ringwald 
25413deb3ec6SMatthias Ringwald             case SM_PH3_DISTRIBUTE_KEYS:
25423deb3ec6SMatthias Ringwald                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION){
25433deb3ec6SMatthias Ringwald                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
25443deb3ec6SMatthias Ringwald                     uint8_t buffer[17];
25453deb3ec6SMatthias Ringwald                     buffer[0] = SM_CODE_ENCRYPTION_INFORMATION;
25469c80e4ccSMatthias Ringwald                     reverse_128(setup->sm_ltk, &buffer[1]);
25473deb3ec6SMatthias Ringwald                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
25483deb3ec6SMatthias Ringwald                     sm_timeout_reset(connection);
25493deb3ec6SMatthias Ringwald                     return;
25503deb3ec6SMatthias Ringwald                 }
25513deb3ec6SMatthias Ringwald                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_MASTER_IDENTIFICATION){
25523deb3ec6SMatthias Ringwald                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
25533deb3ec6SMatthias Ringwald                     uint8_t buffer[11];
25543deb3ec6SMatthias Ringwald                     buffer[0] = SM_CODE_MASTER_IDENTIFICATION;
2555f8fbdce0SMatthias Ringwald                     little_endian_store_16(buffer, 1, setup->sm_local_ediv);
25569c80e4ccSMatthias Ringwald                     reverse_64(setup->sm_local_rand, &buffer[3]);
25573deb3ec6SMatthias Ringwald                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
25583deb3ec6SMatthias Ringwald                     sm_timeout_reset(connection);
25593deb3ec6SMatthias Ringwald                     return;
25603deb3ec6SMatthias Ringwald                 }
25613deb3ec6SMatthias Ringwald                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
25623deb3ec6SMatthias Ringwald                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
25633deb3ec6SMatthias Ringwald                     uint8_t buffer[17];
25643deb3ec6SMatthias Ringwald                     buffer[0] = SM_CODE_IDENTITY_INFORMATION;
25659c80e4ccSMatthias Ringwald                     reverse_128(sm_persistent_irk, &buffer[1]);
25663deb3ec6SMatthias Ringwald                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
25673deb3ec6SMatthias Ringwald                     sm_timeout_reset(connection);
25683deb3ec6SMatthias Ringwald                     return;
25693deb3ec6SMatthias Ringwald                 }
25703deb3ec6SMatthias Ringwald                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION){
25713deb3ec6SMatthias Ringwald                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
25723deb3ec6SMatthias Ringwald                     bd_addr_t local_address;
25733deb3ec6SMatthias Ringwald                     uint8_t buffer[8];
25743deb3ec6SMatthias Ringwald                     buffer[0] = SM_CODE_IDENTITY_ADDRESS_INFORMATION;
2575*4cd5c7b4SMatthias Ringwald                     switch (gap_random_address_get_mode()){
2576*4cd5c7b4SMatthias Ringwald                         case GAP_RANDOM_ADDRESS_TYPE_OFF:
2577*4cd5c7b4SMatthias Ringwald                         case GAP_RANDOM_ADDRESS_TYPE_STATIC:
2578*4cd5c7b4SMatthias Ringwald                             // public or static random
2579b95a5a35SMatthias Ringwald                             gap_le_get_own_address(&buffer[1], local_address);
2580*4cd5c7b4SMatthias Ringwald                             break;
2581*4cd5c7b4SMatthias Ringwald                         case GAP_RANDOM_ADDRESS_NON_RESOLVABLE:
2582*4cd5c7b4SMatthias Ringwald                         case GAP_RANDOM_ADDRESS_RESOLVABLE:
2583*4cd5c7b4SMatthias Ringwald                             // fallback to public
2584*4cd5c7b4SMatthias Ringwald                             gap_local_bd_addr(local_address);
2585*4cd5c7b4SMatthias Ringwald                             buffer[1] = 0;
2586*4cd5c7b4SMatthias Ringwald                             break;
2587*4cd5c7b4SMatthias Ringwald                     }
2588724d70a2SMatthias Ringwald                     reverse_bd_addr(local_address, &buffer[2]);
25893deb3ec6SMatthias Ringwald                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
25903deb3ec6SMatthias Ringwald                     sm_timeout_reset(connection);
25913deb3ec6SMatthias Ringwald                     return;
25923deb3ec6SMatthias Ringwald                 }
25933deb3ec6SMatthias Ringwald                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
25943deb3ec6SMatthias Ringwald                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
25953deb3ec6SMatthias Ringwald 
25963deb3ec6SMatthias Ringwald                     // hack to reproduce test runs
25973deb3ec6SMatthias Ringwald                     if (test_use_fixed_local_csrk){
25983deb3ec6SMatthias Ringwald                         memset(setup->sm_local_csrk, 0xcc, 16);
25993deb3ec6SMatthias Ringwald                     }
26003deb3ec6SMatthias Ringwald 
26013deb3ec6SMatthias Ringwald                     uint8_t buffer[17];
26023deb3ec6SMatthias Ringwald                     buffer[0] = SM_CODE_SIGNING_INFORMATION;
26039c80e4ccSMatthias Ringwald                     reverse_128(setup->sm_local_csrk, &buffer[1]);
26043deb3ec6SMatthias Ringwald                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
26053deb3ec6SMatthias Ringwald                     sm_timeout_reset(connection);
26063deb3ec6SMatthias Ringwald                     return;
26073deb3ec6SMatthias Ringwald                 }
26083deb3ec6SMatthias Ringwald 
26093deb3ec6SMatthias Ringwald                 // keys are sent
261042134bc6SMatthias Ringwald                 if (IS_RESPONDER(connection->sm_role)){
26113deb3ec6SMatthias Ringwald                     // slave -> receive master keys if any
26123deb3ec6SMatthias Ringwald                     if (sm_key_distribution_all_received(connection)){
26133deb3ec6SMatthias Ringwald                         sm_key_distribution_handle_all_received(connection);
26143deb3ec6SMatthias Ringwald                         connection->sm_engine_state = SM_RESPONDER_IDLE;
26153deb3ec6SMatthias Ringwald                         sm_done_for_handle(connection->sm_handle);
26163deb3ec6SMatthias Ringwald                     } else {
26173deb3ec6SMatthias Ringwald                         connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
26183deb3ec6SMatthias Ringwald                     }
26193deb3ec6SMatthias Ringwald                 } else {
26203deb3ec6SMatthias Ringwald                     // master -> all done
26213deb3ec6SMatthias Ringwald                     connection->sm_engine_state = SM_INITIATOR_CONNECTED;
26223deb3ec6SMatthias Ringwald                     sm_done_for_handle(connection->sm_handle);
26233deb3ec6SMatthias Ringwald                 }
26243deb3ec6SMatthias Ringwald                 break;
26253deb3ec6SMatthias Ringwald 
26263deb3ec6SMatthias Ringwald             default:
26273deb3ec6SMatthias Ringwald                 break;
26283deb3ec6SMatthias Ringwald         }
26293deb3ec6SMatthias Ringwald 
26303deb3ec6SMatthias Ringwald         // check again if active connection was released
26317149bde5SMatthias Ringwald         if (sm_active_connection_handle != HCI_CON_HANDLE_INVALID) break;
26323deb3ec6SMatthias Ringwald     }
26333deb3ec6SMatthias Ringwald }
26343deb3ec6SMatthias Ringwald 
26353deb3ec6SMatthias Ringwald // note: aes engine is ready as we just got the aes result
26363deb3ec6SMatthias Ringwald static void sm_handle_encryption_result(uint8_t * data){
26373deb3ec6SMatthias Ringwald 
26383deb3ec6SMatthias Ringwald     sm_aes128_state = SM_AES128_IDLE;
26393deb3ec6SMatthias Ringwald 
26403deb3ec6SMatthias Ringwald     if (sm_address_resolution_ah_calculation_active){
26413deb3ec6SMatthias Ringwald         sm_address_resolution_ah_calculation_active = 0;
26423deb3ec6SMatthias Ringwald         // compare calulated address against connecting device
26433deb3ec6SMatthias Ringwald         uint8_t hash[3];
26449c80e4ccSMatthias Ringwald         reverse_24(data, hash);
26453deb3ec6SMatthias Ringwald         if (memcmp(&sm_address_resolution_address[3], hash, 3) == 0){
26463deb3ec6SMatthias Ringwald             log_info("LE Device Lookup: matched resolvable private address");
26473deb3ec6SMatthias Ringwald             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
26483deb3ec6SMatthias Ringwald             return;
26493deb3ec6SMatthias Ringwald         }
26503deb3ec6SMatthias Ringwald         // no match, try next
26513deb3ec6SMatthias Ringwald         sm_address_resolution_test++;
26523deb3ec6SMatthias Ringwald         return;
26533deb3ec6SMatthias Ringwald     }
26543deb3ec6SMatthias Ringwald 
26553deb3ec6SMatthias Ringwald     switch (dkg_state){
26563deb3ec6SMatthias Ringwald         case DKG_W4_IRK:
26579c80e4ccSMatthias Ringwald             reverse_128(data, sm_persistent_irk);
26588314c363SMatthias Ringwald             log_info_key("irk", sm_persistent_irk);
26593deb3ec6SMatthias Ringwald             dkg_next_state();
26603deb3ec6SMatthias Ringwald             return;
26613deb3ec6SMatthias Ringwald         case DKG_W4_DHK:
26629c80e4ccSMatthias Ringwald             reverse_128(data, sm_persistent_dhk);
26638314c363SMatthias Ringwald             log_info_key("dhk", sm_persistent_dhk);
26643deb3ec6SMatthias Ringwald             dkg_next_state();
26656f792faaSMatthias Ringwald             // SM Init Finished
26663deb3ec6SMatthias Ringwald             return;
26673deb3ec6SMatthias Ringwald         default:
26683deb3ec6SMatthias Ringwald             break;
26693deb3ec6SMatthias Ringwald     }
26703deb3ec6SMatthias Ringwald 
26713deb3ec6SMatthias Ringwald     switch (rau_state){
26723deb3ec6SMatthias Ringwald         case RAU_W4_ENC:
26739c80e4ccSMatthias Ringwald             reverse_24(data, &sm_random_address[3]);
26743deb3ec6SMatthias Ringwald             rau_next_state();
26753deb3ec6SMatthias Ringwald             return;
26763deb3ec6SMatthias Ringwald         default:
26773deb3ec6SMatthias Ringwald             break;
26783deb3ec6SMatthias Ringwald     }
26793deb3ec6SMatthias Ringwald 
26807a766ebfSMatthias Ringwald #ifdef ENABLE_CMAC_ENGINE
26813deb3ec6SMatthias Ringwald     switch (sm_cmac_state){
26823deb3ec6SMatthias Ringwald         case CMAC_W4_SUBKEYS:
26833deb3ec6SMatthias Ringwald         case CMAC_W4_MI:
26843deb3ec6SMatthias Ringwald         case CMAC_W4_MLAST:
26853deb3ec6SMatthias Ringwald             {
26863deb3ec6SMatthias Ringwald             sm_key_t t;
26879c80e4ccSMatthias Ringwald             reverse_128(data, t);
26883deb3ec6SMatthias Ringwald             sm_cmac_handle_encryption_result(t);
26893deb3ec6SMatthias Ringwald             }
26903deb3ec6SMatthias Ringwald             return;
26913deb3ec6SMatthias Ringwald         default:
26923deb3ec6SMatthias Ringwald             break;
26933deb3ec6SMatthias Ringwald     }
26947a766ebfSMatthias Ringwald #endif
26953deb3ec6SMatthias Ringwald 
26963deb3ec6SMatthias Ringwald     // retrieve sm_connection provided to sm_aes128_start_encryption
26973deb3ec6SMatthias Ringwald     sm_connection_t * connection = (sm_connection_t*) sm_aes128_context;
26983deb3ec6SMatthias Ringwald     if (!connection) return;
26993deb3ec6SMatthias Ringwald     switch (connection->sm_engine_state){
27003deb3ec6SMatthias Ringwald         case SM_PH2_C1_W4_ENC_A:
27013deb3ec6SMatthias Ringwald         case SM_PH2_C1_W4_ENC_C:
27023deb3ec6SMatthias Ringwald             {
27033deb3ec6SMatthias Ringwald             sm_key_t t2;
27049c80e4ccSMatthias Ringwald             reverse_128(data, t2);
27053deb3ec6SMatthias Ringwald             sm_c1_t3(t2, setup->sm_m_address, setup->sm_s_address, setup->sm_c1_t3_value);
27063deb3ec6SMatthias Ringwald             }
27073deb3ec6SMatthias Ringwald             sm_next_responding_state(connection);
27083deb3ec6SMatthias Ringwald             return;
27093deb3ec6SMatthias Ringwald         case SM_PH2_C1_W4_ENC_B:
27109c80e4ccSMatthias Ringwald             reverse_128(data, setup->sm_local_confirm);
27118314c363SMatthias Ringwald             log_info_key("c1!", setup->sm_local_confirm);
27123deb3ec6SMatthias Ringwald             connection->sm_engine_state = SM_PH2_C1_SEND_PAIRING_CONFIRM;
27133deb3ec6SMatthias Ringwald             return;
27143deb3ec6SMatthias Ringwald         case SM_PH2_C1_W4_ENC_D:
27153deb3ec6SMatthias Ringwald             {
27163deb3ec6SMatthias Ringwald             sm_key_t peer_confirm_test;
27179c80e4ccSMatthias Ringwald             reverse_128(data, peer_confirm_test);
27188314c363SMatthias Ringwald             log_info_key("c1!", peer_confirm_test);
27193deb3ec6SMatthias Ringwald             if (memcmp(setup->sm_peer_confirm, peer_confirm_test, 16) != 0){
27203deb3ec6SMatthias Ringwald                 setup->sm_pairing_failed_reason = SM_REASON_CONFIRM_VALUE_FAILED;
27213deb3ec6SMatthias Ringwald                 connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
27223deb3ec6SMatthias Ringwald                 return;
27233deb3ec6SMatthias Ringwald             }
272442134bc6SMatthias Ringwald             if (IS_RESPONDER(connection->sm_role)){
27253deb3ec6SMatthias Ringwald                 connection->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
27263deb3ec6SMatthias Ringwald             } else {
27273deb3ec6SMatthias Ringwald                 connection->sm_engine_state = SM_PH2_CALC_STK;
27283deb3ec6SMatthias Ringwald             }
27293deb3ec6SMatthias Ringwald             }
27303deb3ec6SMatthias Ringwald             return;
27313deb3ec6SMatthias Ringwald         case SM_PH2_W4_STK:
27329c80e4ccSMatthias Ringwald             reverse_128(data, setup->sm_ltk);
27333deb3ec6SMatthias Ringwald             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
27348314c363SMatthias Ringwald             log_info_key("stk", setup->sm_ltk);
273542134bc6SMatthias Ringwald             if (IS_RESPONDER(connection->sm_role)){
27363deb3ec6SMatthias Ringwald                 connection->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
27373deb3ec6SMatthias Ringwald             } else {
27383deb3ec6SMatthias Ringwald                 connection->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
27393deb3ec6SMatthias Ringwald             }
27403deb3ec6SMatthias Ringwald             return;
27413deb3ec6SMatthias Ringwald         case SM_PH3_Y_W4_ENC:{
27423deb3ec6SMatthias Ringwald             sm_key_t y128;
27439c80e4ccSMatthias Ringwald             reverse_128(data, y128);
2744f8fbdce0SMatthias Ringwald             setup->sm_local_y = big_endian_read_16(y128, 14);
27453deb3ec6SMatthias Ringwald             log_info_hex16("y", setup->sm_local_y);
27463deb3ec6SMatthias Ringwald             // PH3B3 - calculate EDIV
27473deb3ec6SMatthias Ringwald             setup->sm_local_ediv = setup->sm_local_y ^ setup->sm_local_div;
27483deb3ec6SMatthias Ringwald             log_info_hex16("ediv", setup->sm_local_ediv);
27493deb3ec6SMatthias Ringwald             // PH3B4 - calculate LTK         - enc
27503deb3ec6SMatthias Ringwald             // LTK = d1(ER, DIV, 0))
27513deb3ec6SMatthias Ringwald             connection->sm_engine_state = SM_PH3_LTK_GET_ENC;
27523deb3ec6SMatthias Ringwald             return;
27533deb3ec6SMatthias Ringwald         }
27543deb3ec6SMatthias Ringwald         case SM_RESPONDER_PH4_Y_W4_ENC:{
27553deb3ec6SMatthias Ringwald             sm_key_t y128;
27569c80e4ccSMatthias Ringwald             reverse_128(data, y128);
2757f8fbdce0SMatthias Ringwald             setup->sm_local_y = big_endian_read_16(y128, 14);
27583deb3ec6SMatthias Ringwald             log_info_hex16("y", setup->sm_local_y);
27593deb3ec6SMatthias Ringwald 
27603deb3ec6SMatthias Ringwald             // PH3B3 - calculate DIV
27613deb3ec6SMatthias Ringwald             setup->sm_local_div = setup->sm_local_y ^ setup->sm_local_ediv;
27623deb3ec6SMatthias Ringwald             log_info_hex16("ediv", setup->sm_local_ediv);
27633deb3ec6SMatthias Ringwald             // PH3B4 - calculate LTK         - enc
27643deb3ec6SMatthias Ringwald             // LTK = d1(ER, DIV, 0))
27653deb3ec6SMatthias Ringwald             connection->sm_engine_state = SM_RESPONDER_PH4_LTK_GET_ENC;
27663deb3ec6SMatthias Ringwald             return;
27673deb3ec6SMatthias Ringwald         }
27683deb3ec6SMatthias Ringwald         case SM_PH3_LTK_W4_ENC:
27699c80e4ccSMatthias Ringwald             reverse_128(data, setup->sm_ltk);
27708314c363SMatthias Ringwald             log_info_key("ltk", setup->sm_ltk);
27713deb3ec6SMatthias Ringwald             // calc CSRK next
27723deb3ec6SMatthias Ringwald             connection->sm_engine_state = SM_PH3_CSRK_GET_ENC;
27733deb3ec6SMatthias Ringwald             return;
27743deb3ec6SMatthias Ringwald         case SM_PH3_CSRK_W4_ENC:
27759c80e4ccSMatthias Ringwald             reverse_128(data, setup->sm_local_csrk);
27768314c363SMatthias Ringwald             log_info_key("csrk", setup->sm_local_csrk);
27773deb3ec6SMatthias Ringwald             if (setup->sm_key_distribution_send_set){
27783deb3ec6SMatthias Ringwald                 connection->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
27793deb3ec6SMatthias Ringwald             } else {
27803deb3ec6SMatthias Ringwald                 // no keys to send, just continue
278142134bc6SMatthias Ringwald                 if (IS_RESPONDER(connection->sm_role)){
27823deb3ec6SMatthias Ringwald                     // slave -> receive master keys
27833deb3ec6SMatthias Ringwald                     connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
27843deb3ec6SMatthias Ringwald                 } else {
27852bacf595SMatthias Ringwald                     if (setup->sm_use_secure_connections && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION)){
27862bacf595SMatthias Ringwald                         connection->sm_engine_state = SM_SC_W2_CALCULATE_H6_ILK;
27872bacf595SMatthias Ringwald                     } else {
27883deb3ec6SMatthias Ringwald                         // master -> all done
27893deb3ec6SMatthias Ringwald                         connection->sm_engine_state = SM_INITIATOR_CONNECTED;
27903deb3ec6SMatthias Ringwald                         sm_done_for_handle(connection->sm_handle);
27913deb3ec6SMatthias Ringwald                     }
27923deb3ec6SMatthias Ringwald                 }
27932bacf595SMatthias Ringwald             }
27943deb3ec6SMatthias Ringwald             return;
279542134bc6SMatthias Ringwald #ifdef ENABLE_LE_PERIPHERAL
27963deb3ec6SMatthias Ringwald         case SM_RESPONDER_PH4_LTK_W4_ENC:
27979c80e4ccSMatthias Ringwald             reverse_128(data, setup->sm_ltk);
27983deb3ec6SMatthias Ringwald             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
27998314c363SMatthias Ringwald             log_info_key("ltk", setup->sm_ltk);
2800d7471931SMatthias Ringwald             connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK_REPLY;
28013deb3ec6SMatthias Ringwald             return;
280242134bc6SMatthias Ringwald #endif
28033deb3ec6SMatthias Ringwald         default:
28043deb3ec6SMatthias Ringwald             break;
28053deb3ec6SMatthias Ringwald     }
28063deb3ec6SMatthias Ringwald }
28073deb3ec6SMatthias Ringwald 
280888011322SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
2809c692d776SMatthias Ringwald #ifndef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
28100c92bcc6SMatthias Ringwald #if !defined(WICED_VERSION)
28115198fffaSMatthias Ringwald // @return OK
2812c692d776SMatthias Ringwald static int sm_generate_f_rng(unsigned char * buffer, unsigned size){
28135198fffaSMatthias Ringwald     if (ec_key_generation_state != EC_KEY_GENERATION_ACTIVE) return 0;
28147df18c15SMatthias Ringwald     int offset = setup->sm_passkey_bit;
28157df18c15SMatthias Ringwald     log_info("sm_generate_f_rng: size %u - offset %u", (int) size, offset);
28167df18c15SMatthias Ringwald     while (size) {
2817fc5bff5fSMatthias Ringwald         *buffer++ = setup->sm_peer_q[offset++];
28187df18c15SMatthias Ringwald         size--;
28197df18c15SMatthias Ringwald     }
28207df18c15SMatthias Ringwald     setup->sm_passkey_bit = offset;
28215198fffaSMatthias Ringwald     return 1;
28227df18c15SMatthias Ringwald }
2823cdb8bfaeSMatthias Ringwald #endif
28247df18c15SMatthias Ringwald #endif
282588011322SMatthias Ringwald #endif
28267df18c15SMatthias Ringwald 
28273deb3ec6SMatthias Ringwald // note: random generator is ready. this doesn NOT imply that aes engine is unused!
28283deb3ec6SMatthias Ringwald static void sm_handle_random_result(uint8_t * data){
28293deb3ec6SMatthias Ringwald 
283088011322SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
2831c692d776SMatthias Ringwald #ifndef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
2832c692d776SMatthias Ringwald 
28337df18c15SMatthias Ringwald     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
28347df18c15SMatthias Ringwald         int num_bytes = setup->sm_passkey_bit;
2835fc5bff5fSMatthias Ringwald         memcpy(&setup->sm_peer_q[num_bytes], data, 8);
28367df18c15SMatthias Ringwald         num_bytes += 8;
28377df18c15SMatthias Ringwald         setup->sm_passkey_bit = num_bytes;
28387df18c15SMatthias Ringwald 
28397df18c15SMatthias Ringwald         if (num_bytes >= 64){
2840ae4aa2b6SMatthias Ringwald 
2841c692d776SMatthias Ringwald             // init pre-generated random data from sm_peer_q
28427df18c15SMatthias Ringwald             setup->sm_passkey_bit = 0;
2843c692d776SMatthias Ringwald 
2844c692d776SMatthias Ringwald             // generate EC key
2845c692d776SMatthias Ringwald #ifdef USE_MICROECC_FOR_ECDH
2846cdb8bfaeSMatthias Ringwald #ifndef WICED_VERSION
28478974e43fSMatthias Ringwald             log_info("set uECC RNG for initial key generation with 64 random bytes");
28487149bde5SMatthias Ringwald             // micro-ecc from WICED SDK uses its wiced_crypto_get_random by default - no need to set it
2849c692d776SMatthias Ringwald             uECC_set_rng(&sm_generate_f_rng);
28507149bde5SMatthias Ringwald #endif /* WICED_VERSION */
28514b8ec5bcSMatthias Ringwald 
28524b8ec5bcSMatthias Ringwald #if uECC_SUPPORTS_secp256r1
28534b8ec5bcSMatthias Ringwald             // standard version
28544b8ec5bcSMatthias Ringwald             uECC_make_key(ec_q, ec_d, uECC_secp256r1());
2855e6343eb6SMatthias Ringwald 
2856e6343eb6SMatthias Ringwald             // disable RNG again, as returning no randmon data lets shared key generation fail
2857e6343eb6SMatthias Ringwald             log_info("disable uECC RNG in standard version after key generation");
2858e6343eb6SMatthias Ringwald             uECC_set_rng(NULL);
28594b8ec5bcSMatthias Ringwald #else
28604b8ec5bcSMatthias Ringwald             // static version
2861c692d776SMatthias Ringwald             uECC_make_key(ec_q, ec_d);
2862add51d72SMatthias Ringwald #endif /* USE_MICROECC_FOR_ECDH */
28634b8ec5bcSMatthias Ringwald 
28647149bde5SMatthias Ringwald #endif /* USE_MICROECC_FOR_ECDH */
28657df18c15SMatthias Ringwald             ec_key_generation_state = EC_KEY_GENERATION_DONE;
286609e4d397SMatthias Ringwald             log_info("Elliptic curve: d");
286709e4d397SMatthias Ringwald             log_info_hexdump(ec_d,32);
28682e6217a0SMatthias Ringwald             sm_log_ec_keypair();
28697df18c15SMatthias Ringwald         }
28707df18c15SMatthias Ringwald     }
28717df18c15SMatthias Ringwald #endif
287288011322SMatthias Ringwald #endif
28737df18c15SMatthias Ringwald 
28743deb3ec6SMatthias Ringwald     switch (rau_state){
28753deb3ec6SMatthias Ringwald         case RAU_W4_RANDOM:
28763deb3ec6SMatthias Ringwald             // non-resolvable vs. resolvable
28773deb3ec6SMatthias Ringwald             switch (gap_random_adress_type){
28783deb3ec6SMatthias Ringwald                 case GAP_RANDOM_ADDRESS_RESOLVABLE:
28793deb3ec6SMatthias Ringwald                     // resolvable: use random as prand and calc address hash
28803deb3ec6SMatthias Ringwald                     // "The two most significant bits of prand shall be equal to ‘0’ and ‘1"
28813deb3ec6SMatthias Ringwald                     memcpy(sm_random_address, data, 3);
28823deb3ec6SMatthias Ringwald                     sm_random_address[0] &= 0x3f;
28833deb3ec6SMatthias Ringwald                     sm_random_address[0] |= 0x40;
28843deb3ec6SMatthias Ringwald                     rau_state = RAU_GET_ENC;
28853deb3ec6SMatthias Ringwald                     break;
28863deb3ec6SMatthias Ringwald                 case GAP_RANDOM_ADDRESS_NON_RESOLVABLE:
28873deb3ec6SMatthias Ringwald                 default:
28883deb3ec6SMatthias Ringwald                     // "The two most significant bits of the address shall be equal to ‘0’""
28893deb3ec6SMatthias Ringwald                     memcpy(sm_random_address, data, 6);
28903deb3ec6SMatthias Ringwald                     sm_random_address[0] &= 0x3f;
28913deb3ec6SMatthias Ringwald                     rau_state = RAU_SET_ADDRESS;
28923deb3ec6SMatthias Ringwald                     break;
28933deb3ec6SMatthias Ringwald             }
28943deb3ec6SMatthias Ringwald             return;
28953deb3ec6SMatthias Ringwald         default:
28963deb3ec6SMatthias Ringwald             break;
28973deb3ec6SMatthias Ringwald     }
28983deb3ec6SMatthias Ringwald 
28993deb3ec6SMatthias Ringwald     // retrieve sm_connection provided to sm_random_start
29003deb3ec6SMatthias Ringwald     sm_connection_t * connection = (sm_connection_t *) sm_random_context;
29013deb3ec6SMatthias Ringwald     if (!connection) return;
29023deb3ec6SMatthias Ringwald     switch (connection->sm_engine_state){
2903f1c1783eSMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
2904f1c1783eSMatthias Ringwald         case SM_SC_W4_GET_RANDOM_A:
2905f1c1783eSMatthias Ringwald             memcpy(&setup->sm_local_nonce[0], data, 8);
2906f1c1783eSMatthias Ringwald             connection->sm_engine_state = SM_SC_W2_GET_RANDOM_B;
2907f1c1783eSMatthias Ringwald             break;
2908f1c1783eSMatthias Ringwald         case SM_SC_W4_GET_RANDOM_B:
2909f1c1783eSMatthias Ringwald             memcpy(&setup->sm_local_nonce[8], data, 8);
2910f1c1783eSMatthias Ringwald             // initiator & jw/nc -> send pairing random
2911f1c1783eSMatthias Ringwald             if (connection->sm_role == 0 && sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
2912f1c1783eSMatthias Ringwald                 connection->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
2913f1c1783eSMatthias Ringwald                 break;
2914b35a3de2SMatthias Ringwald             } else {
2915b35a3de2SMatthias Ringwald                 connection->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
2916f1c1783eSMatthias Ringwald             }
2917f1c1783eSMatthias Ringwald             break;
2918f1c1783eSMatthias Ringwald #endif
2919f1c1783eSMatthias Ringwald 
29203deb3ec6SMatthias Ringwald         case SM_PH2_W4_RANDOM_TK:
29213deb3ec6SMatthias Ringwald         {
29223deb3ec6SMatthias Ringwald             // map random to 0-999999 without speding much cycles on a modulus operation
2923f8fbdce0SMatthias Ringwald             uint32_t tk = little_endian_read_32(data,0);
29243deb3ec6SMatthias Ringwald             tk = tk & 0xfffff;  // 1048575
29253deb3ec6SMatthias Ringwald             if (tk >= 999999){
29263deb3ec6SMatthias Ringwald                 tk = tk - 999999;
29273deb3ec6SMatthias Ringwald             }
29283deb3ec6SMatthias Ringwald             sm_reset_tk();
2929f8fbdce0SMatthias Ringwald             big_endian_store_32(setup->sm_tk, 12, tk);
293042134bc6SMatthias Ringwald             if (IS_RESPONDER(connection->sm_role)){
29313deb3ec6SMatthias Ringwald                 connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
29323deb3ec6SMatthias Ringwald             } else {
2933b41539d5SMatthias Ringwald                 if (setup->sm_use_secure_connections){
2934b41539d5SMatthias Ringwald                     connection->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
2935b41539d5SMatthias Ringwald                 } else {
29363deb3ec6SMatthias Ringwald                     connection->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
29373deb3ec6SMatthias Ringwald                     sm_trigger_user_response(connection);
29383deb3ec6SMatthias Ringwald                     // response_idle == nothing <--> sm_trigger_user_response() did not require response
29393deb3ec6SMatthias Ringwald                     if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
29403deb3ec6SMatthias Ringwald                         connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
29413deb3ec6SMatthias Ringwald                     }
29423deb3ec6SMatthias Ringwald                 }
2943b41539d5SMatthias Ringwald             }
29443deb3ec6SMatthias Ringwald             return;
29453deb3ec6SMatthias Ringwald         }
29463deb3ec6SMatthias Ringwald         case SM_PH2_C1_W4_RANDOM_A:
29473deb3ec6SMatthias Ringwald             memcpy(&setup->sm_local_random[0], data, 8); // random endinaness
29483deb3ec6SMatthias Ringwald             connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_B;
29493deb3ec6SMatthias Ringwald             return;
29503deb3ec6SMatthias Ringwald         case SM_PH2_C1_W4_RANDOM_B:
29513deb3ec6SMatthias Ringwald             memcpy(&setup->sm_local_random[8], data, 8); // random endinaness
29523deb3ec6SMatthias Ringwald             connection->sm_engine_state = SM_PH2_C1_GET_ENC_A;
29533deb3ec6SMatthias Ringwald             return;
29543deb3ec6SMatthias Ringwald         case SM_PH3_W4_RANDOM:
29559c80e4ccSMatthias Ringwald             reverse_64(data, setup->sm_local_rand);
29563deb3ec6SMatthias Ringwald             // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
29573deb3ec6SMatthias Ringwald             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xf0) + (connection->sm_actual_encryption_key_size - 1);
29583deb3ec6SMatthias Ringwald             // no db for authenticated flag hack: store flag in bit 4 of LSB
29593deb3ec6SMatthias Ringwald             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xef) + (connection->sm_connection_authenticated << 4);
29603deb3ec6SMatthias Ringwald             connection->sm_engine_state = SM_PH3_GET_DIV;
29613deb3ec6SMatthias Ringwald             return;
29623deb3ec6SMatthias Ringwald         case SM_PH3_W4_DIV:
29633deb3ec6SMatthias Ringwald             // use 16 bit from random value as div
2964f8fbdce0SMatthias Ringwald             setup->sm_local_div = big_endian_read_16(data, 0);
29653deb3ec6SMatthias Ringwald             log_info_hex16("div", setup->sm_local_div);
29663deb3ec6SMatthias Ringwald             connection->sm_engine_state = SM_PH3_Y_GET_ENC;
29673deb3ec6SMatthias Ringwald             return;
29683deb3ec6SMatthias Ringwald         default:
29693deb3ec6SMatthias Ringwald             break;
29703deb3ec6SMatthias Ringwald     }
29713deb3ec6SMatthias Ringwald }
29723deb3ec6SMatthias Ringwald 
2973d9a7306aSMatthias Ringwald static void sm_event_packet_handler (uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
29743deb3ec6SMatthias Ringwald 
29759ec2630cSMatthias Ringwald     UNUSED(channel);
29769ec2630cSMatthias Ringwald     UNUSED(size);
29779ec2630cSMatthias Ringwald 
29783deb3ec6SMatthias Ringwald     sm_connection_t  * sm_conn;
2979711e6c80SMatthias Ringwald     hci_con_handle_t con_handle;
29803deb3ec6SMatthias Ringwald 
29813deb3ec6SMatthias Ringwald     switch (packet_type) {
29823deb3ec6SMatthias Ringwald 
29833deb3ec6SMatthias Ringwald 		case HCI_EVENT_PACKET:
29840e2df43fSMatthias Ringwald 			switch (hci_event_packet_get_type(packet)) {
29853deb3ec6SMatthias Ringwald 
29863deb3ec6SMatthias Ringwald                 case BTSTACK_EVENT_STATE:
29873deb3ec6SMatthias Ringwald 					// bt stack activated, get started
2988be7cc9a0SMilanka Ringwald 					if (btstack_event_state_get_state(packet) == HCI_STATE_WORKING){
29893deb3ec6SMatthias Ringwald                         log_info("HCI Working!");
2990f33ad81dSMatthias Ringwald 
2991f33ad81dSMatthias Ringwald                         // set local addr for le device db
2992f33ad81dSMatthias Ringwald                         bd_addr_t local_bd_addr;
2993f33ad81dSMatthias Ringwald                         gap_local_bd_addr(local_bd_addr);
2994f33ad81dSMatthias Ringwald                         le_device_db_set_local_bd_addr(local_bd_addr);
2995f33ad81dSMatthias Ringwald 
29963deb3ec6SMatthias Ringwald                         dkg_state = sm_persistent_irk_ready ? DKG_CALC_DHK : DKG_CALC_IRK;
299709e4d397SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
2998df86eb96SMatthias Ringwald                         if (!sm_have_ec_keypair){
29997df18c15SMatthias Ringwald                             setup->sm_passkey_bit = 0;
30007df18c15SMatthias Ringwald                             ec_key_generation_state = EC_KEY_GENERATION_ACTIVE;
30017df18c15SMatthias Ringwald                         }
30027df18c15SMatthias Ringwald #endif
300352b551c3SMatthias Ringwald                         // trigger Random Address generation if requested before
30048f57b085SMatthias Ringwald                         switch (gap_random_adress_type){
30058f57b085SMatthias Ringwald                             case GAP_RANDOM_ADDRESS_TYPE_OFF:
300652b551c3SMatthias Ringwald                                 rau_state = RAU_IDLE;
30078f57b085SMatthias Ringwald                                 break;
30088f57b085SMatthias Ringwald                             case GAP_RANDOM_ADDRESS_TYPE_STATIC:
30098f57b085SMatthias Ringwald                                 rau_state = RAU_SET_ADDRESS;
30108f57b085SMatthias Ringwald                                 break;
30118f57b085SMatthias Ringwald                             default:
30125777861bSMatthias Ringwald                                 rau_state = RAU_GET_RANDOM;
30138f57b085SMatthias Ringwald                                 break;
301452b551c3SMatthias Ringwald                         }
30153deb3ec6SMatthias Ringwald                         sm_run();
30163deb3ec6SMatthias Ringwald 					}
30173deb3ec6SMatthias Ringwald 					break;
30183deb3ec6SMatthias Ringwald 
30193deb3ec6SMatthias Ringwald                 case HCI_EVENT_LE_META:
30203deb3ec6SMatthias Ringwald                     switch (packet[2]) {
30213deb3ec6SMatthias Ringwald                         case HCI_SUBEVENT_LE_CONNECTION_COMPLETE:
30223deb3ec6SMatthias Ringwald 
30233deb3ec6SMatthias Ringwald                             log_info("sm: connected");
30243deb3ec6SMatthias Ringwald 
30253deb3ec6SMatthias Ringwald                             if (packet[3]) return; // connection failed
30263deb3ec6SMatthias Ringwald 
3027711e6c80SMatthias Ringwald                             con_handle = little_endian_read_16(packet, 4);
3028711e6c80SMatthias Ringwald                             sm_conn = sm_get_connection_for_handle(con_handle);
30293deb3ec6SMatthias Ringwald                             if (!sm_conn) break;
30303deb3ec6SMatthias Ringwald 
3031711e6c80SMatthias Ringwald                             sm_conn->sm_handle = con_handle;
30323deb3ec6SMatthias Ringwald                             sm_conn->sm_role = packet[6];
30333deb3ec6SMatthias Ringwald                             sm_conn->sm_peer_addr_type = packet[7];
303413377825SMatthias Ringwald                             reverse_bd_addr(&packet[8], sm_conn->sm_peer_address);
30353deb3ec6SMatthias Ringwald 
30363deb3ec6SMatthias Ringwald                             log_info("New sm_conn, role %s", sm_conn->sm_role ? "slave" : "master");
30373deb3ec6SMatthias Ringwald 
30383deb3ec6SMatthias Ringwald                             // reset security properties
30393deb3ec6SMatthias Ringwald                             sm_conn->sm_connection_encrypted = 0;
30403deb3ec6SMatthias Ringwald                             sm_conn->sm_connection_authenticated = 0;
30413deb3ec6SMatthias Ringwald                             sm_conn->sm_connection_authorization_state = AUTHORIZATION_UNKNOWN;
30423deb3ec6SMatthias Ringwald                             sm_conn->sm_le_db_index = -1;
30433deb3ec6SMatthias Ringwald 
30443deb3ec6SMatthias Ringwald                             // prepare CSRK lookup (does not involve setup)
30453deb3ec6SMatthias Ringwald                             sm_conn->sm_irk_lookup_state = IRK_LOOKUP_W4_READY;
30463deb3ec6SMatthias Ringwald 
30473deb3ec6SMatthias Ringwald                             // just connected -> everything else happens in sm_run()
304842134bc6SMatthias Ringwald                             if (IS_RESPONDER(sm_conn->sm_role)){
30493deb3ec6SMatthias Ringwald                                 // slave - state already could be SM_RESPONDER_SEND_SECURITY_REQUEST instead
30503deb3ec6SMatthias Ringwald                                 if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
30513deb3ec6SMatthias Ringwald                                     if (sm_slave_request_security) {
30523deb3ec6SMatthias Ringwald                                         // request security if requested by app
30533deb3ec6SMatthias Ringwald                                         sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
30543deb3ec6SMatthias Ringwald                                     } else {
30553deb3ec6SMatthias Ringwald                                         // otherwise, wait for pairing request
30563deb3ec6SMatthias Ringwald                                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
30573deb3ec6SMatthias Ringwald                                     }
30583deb3ec6SMatthias Ringwald                                 }
30593deb3ec6SMatthias Ringwald                                 break;
30603deb3ec6SMatthias Ringwald                             } else {
30613deb3ec6SMatthias Ringwald                                 // master
30623deb3ec6SMatthias Ringwald                                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
30633deb3ec6SMatthias Ringwald                             }
30643deb3ec6SMatthias Ringwald                             break;
30653deb3ec6SMatthias Ringwald 
30663deb3ec6SMatthias Ringwald                         case HCI_SUBEVENT_LE_LONG_TERM_KEY_REQUEST:
3067711e6c80SMatthias Ringwald                             con_handle = little_endian_read_16(packet, 3);
3068711e6c80SMatthias Ringwald                             sm_conn = sm_get_connection_for_handle(con_handle);
30693deb3ec6SMatthias Ringwald                             if (!sm_conn) break;
30703deb3ec6SMatthias Ringwald 
30713deb3ec6SMatthias Ringwald                             log_info("LTK Request: state %u", sm_conn->sm_engine_state);
30723deb3ec6SMatthias Ringwald                             if (sm_conn->sm_engine_state == SM_RESPONDER_PH2_W4_LTK_REQUEST){
30733deb3ec6SMatthias Ringwald                                 sm_conn->sm_engine_state = SM_PH2_CALC_STK;
30743deb3ec6SMatthias Ringwald                                 break;
30753deb3ec6SMatthias Ringwald                             }
3076c6b7cbd9SMatthias Ringwald                             if (sm_conn->sm_engine_state == SM_SC_W4_LTK_REQUEST_SC){
3077778b6aadSMatthias Ringwald                                 // PH2 SEND LTK as we need to exchange keys in PH3
3078778b6aadSMatthias Ringwald                                 sm_conn->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
3079e53be891SMatthias Ringwald                                 break;
3080e53be891SMatthias Ringwald                             }
30813deb3ec6SMatthias Ringwald 
30823deb3ec6SMatthias Ringwald                             // store rand and ediv
30839c80e4ccSMatthias Ringwald                             reverse_64(&packet[5], sm_conn->sm_local_rand);
3084f8fbdce0SMatthias Ringwald                             sm_conn->sm_local_ediv = little_endian_read_16(packet, 13);
3085549ad5d2SMatthias Ringwald 
3086549ad5d2SMatthias Ringwald                             // For Legacy Pairing (<=> EDIV != 0 || RAND != NULL), we need to recalculated our LTK as a
3087549ad5d2SMatthias Ringwald                             // potentially stored LTK is from the master
3088549ad5d2SMatthias Ringwald                             if (sm_conn->sm_local_ediv != 0 || !sm_is_null_random(sm_conn->sm_local_rand)){
308906cd539fSMatthias Ringwald                                 sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST;
3090549ad5d2SMatthias Ringwald                                 break;
3091549ad5d2SMatthias Ringwald                             }
3092549ad5d2SMatthias Ringwald 
3093549ad5d2SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
309406cd539fSMatthias Ringwald                             sm_conn->sm_engine_state = SM_SC_RECEIVED_LTK_REQUEST;
3095549ad5d2SMatthias Ringwald #else
3096549ad5d2SMatthias Ringwald                             log_info("LTK Request: ediv & random are empty, but LE Secure Connections not supported");
3097549ad5d2SMatthias Ringwald                             sm_conn->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
3098549ad5d2SMatthias Ringwald #endif
30993deb3ec6SMatthias Ringwald                             break;
3100804d3e67SMatthias Ringwald 
3101804d3e67SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
310209e4d397SMatthias Ringwald                         case HCI_SUBEVENT_LE_READ_LOCAL_P256_PUBLIC_KEY_COMPLETE:
310309e4d397SMatthias Ringwald                             if (hci_subevent_le_read_local_p256_public_key_complete_get_status(packet)){
310409e4d397SMatthias Ringwald                                 log_error("Read Local P256 Public Key failed");
310509e4d397SMatthias Ringwald                                 break;
310609e4d397SMatthias Ringwald                             }
3107fc5bff5fSMatthias Ringwald                             hci_subevent_le_read_local_p256_public_key_complete_get_dhkey_x(packet, &ec_q[0]);
3108fc5bff5fSMatthias Ringwald                             hci_subevent_le_read_local_p256_public_key_complete_get_dhkey_y(packet, &ec_q[32]);
310909e4d397SMatthias Ringwald                             ec_key_generation_state = EC_KEY_GENERATION_DONE;
311009e4d397SMatthias Ringwald                             sm_log_ec_keypair();
311109e4d397SMatthias Ringwald                             break;
3112804d3e67SMatthias Ringwald #endif
31133deb3ec6SMatthias Ringwald                         default:
31143deb3ec6SMatthias Ringwald                             break;
31153deb3ec6SMatthias Ringwald                     }
31163deb3ec6SMatthias Ringwald                     break;
31173deb3ec6SMatthias Ringwald 
31183deb3ec6SMatthias Ringwald                 case HCI_EVENT_ENCRYPTION_CHANGE:
3119711e6c80SMatthias Ringwald                     con_handle = little_endian_read_16(packet, 3);
3120711e6c80SMatthias Ringwald                     sm_conn = sm_get_connection_for_handle(con_handle);
31213deb3ec6SMatthias Ringwald                     if (!sm_conn) break;
31223deb3ec6SMatthias Ringwald 
31233deb3ec6SMatthias Ringwald                     sm_conn->sm_connection_encrypted = packet[5];
31243deb3ec6SMatthias Ringwald                     log_info("Encryption state change: %u, key size %u", sm_conn->sm_connection_encrypted,
31253deb3ec6SMatthias Ringwald                         sm_conn->sm_actual_encryption_key_size);
31263deb3ec6SMatthias Ringwald                     log_info("event handler, state %u", sm_conn->sm_engine_state);
31273deb3ec6SMatthias Ringwald                     if (!sm_conn->sm_connection_encrypted) break;
31283deb3ec6SMatthias Ringwald                     // continue if part of initial pairing
31293deb3ec6SMatthias Ringwald                     switch (sm_conn->sm_engine_state){
31303deb3ec6SMatthias Ringwald                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
31313deb3ec6SMatthias Ringwald                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
31323deb3ec6SMatthias Ringwald                             sm_done_for_handle(sm_conn->sm_handle);
31333deb3ec6SMatthias Ringwald                             break;
31343deb3ec6SMatthias Ringwald                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
313542134bc6SMatthias Ringwald                             if (IS_RESPONDER(sm_conn->sm_role)){
31363deb3ec6SMatthias Ringwald                                 // slave
3137bbf8db22SMatthias Ringwald                                 if (setup->sm_use_secure_connections){
3138bbf8db22SMatthias Ringwald                                     sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
3139bbf8db22SMatthias Ringwald                                 } else {
31403deb3ec6SMatthias Ringwald                                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3141bbf8db22SMatthias Ringwald                                 }
31423deb3ec6SMatthias Ringwald                             } else {
31433deb3ec6SMatthias Ringwald                                 // master
31443deb3ec6SMatthias Ringwald                                 if (sm_key_distribution_all_received(sm_conn)){
31453deb3ec6SMatthias Ringwald                                     // skip receiving keys as there are none
31463deb3ec6SMatthias Ringwald                                     sm_key_distribution_handle_all_received(sm_conn);
31473deb3ec6SMatthias Ringwald                                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
31483deb3ec6SMatthias Ringwald                                 } else {
31493deb3ec6SMatthias Ringwald                                     sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
31503deb3ec6SMatthias Ringwald                                 }
31513deb3ec6SMatthias Ringwald                             }
31523deb3ec6SMatthias Ringwald                             break;
31533deb3ec6SMatthias Ringwald                         default:
31543deb3ec6SMatthias Ringwald                             break;
31553deb3ec6SMatthias Ringwald                     }
31563deb3ec6SMatthias Ringwald                     break;
31573deb3ec6SMatthias Ringwald 
31583deb3ec6SMatthias Ringwald                 case HCI_EVENT_ENCRYPTION_KEY_REFRESH_COMPLETE:
3159711e6c80SMatthias Ringwald                     con_handle = little_endian_read_16(packet, 3);
3160711e6c80SMatthias Ringwald                     sm_conn = sm_get_connection_for_handle(con_handle);
31613deb3ec6SMatthias Ringwald                     if (!sm_conn) break;
31623deb3ec6SMatthias Ringwald 
31633deb3ec6SMatthias Ringwald                     log_info("Encryption key refresh complete, key size %u", sm_conn->sm_actual_encryption_key_size);
31643deb3ec6SMatthias Ringwald                     log_info("event handler, state %u", sm_conn->sm_engine_state);
31653deb3ec6SMatthias Ringwald                     // continue if part of initial pairing
31663deb3ec6SMatthias Ringwald                     switch (sm_conn->sm_engine_state){
31673deb3ec6SMatthias Ringwald                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
31683deb3ec6SMatthias Ringwald                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
31693deb3ec6SMatthias Ringwald                             sm_done_for_handle(sm_conn->sm_handle);
31703deb3ec6SMatthias Ringwald                             break;
31713deb3ec6SMatthias Ringwald                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
317242134bc6SMatthias Ringwald                             if (IS_RESPONDER(sm_conn->sm_role)){
31733deb3ec6SMatthias Ringwald                                 // slave
31743deb3ec6SMatthias Ringwald                                 sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
31753deb3ec6SMatthias Ringwald                             } else {
31763deb3ec6SMatthias Ringwald                                 // master
31773deb3ec6SMatthias Ringwald                                 sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
31783deb3ec6SMatthias Ringwald                             }
31793deb3ec6SMatthias Ringwald                             break;
31803deb3ec6SMatthias Ringwald                         default:
31813deb3ec6SMatthias Ringwald                             break;
31823deb3ec6SMatthias Ringwald                     }
31833deb3ec6SMatthias Ringwald                     break;
31843deb3ec6SMatthias Ringwald 
31853deb3ec6SMatthias Ringwald 
31863deb3ec6SMatthias Ringwald                 case HCI_EVENT_DISCONNECTION_COMPLETE:
3187711e6c80SMatthias Ringwald                     con_handle = little_endian_read_16(packet, 3);
3188711e6c80SMatthias Ringwald                     sm_done_for_handle(con_handle);
3189711e6c80SMatthias Ringwald                     sm_conn = sm_get_connection_for_handle(con_handle);
31903deb3ec6SMatthias Ringwald                     if (!sm_conn) break;
31913deb3ec6SMatthias Ringwald 
31923deb3ec6SMatthias Ringwald                     // delete stored bonding on disconnect with authentication failure in ph0
31933deb3ec6SMatthias Ringwald                     if (sm_conn->sm_role == 0
31943deb3ec6SMatthias Ringwald                         && sm_conn->sm_engine_state == SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED
31953deb3ec6SMatthias Ringwald                         && packet[2] == ERROR_CODE_AUTHENTICATION_FAILURE){
31963deb3ec6SMatthias Ringwald                         le_device_db_remove(sm_conn->sm_le_db_index);
31973deb3ec6SMatthias Ringwald                     }
31983deb3ec6SMatthias Ringwald 
31993deb3ec6SMatthias Ringwald                     sm_conn->sm_engine_state = SM_GENERAL_IDLE;
32003deb3ec6SMatthias Ringwald                     sm_conn->sm_handle = 0;
32013deb3ec6SMatthias Ringwald                     break;
32023deb3ec6SMatthias Ringwald 
32033deb3ec6SMatthias Ringwald 				case HCI_EVENT_COMMAND_COMPLETE:
3204073bd0faSMatthias Ringwald                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_encrypt)){
32053deb3ec6SMatthias Ringwald                         sm_handle_encryption_result(&packet[6]);
32063deb3ec6SMatthias Ringwald                         break;
32073deb3ec6SMatthias Ringwald                     }
3208073bd0faSMatthias Ringwald                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_rand)){
32093deb3ec6SMatthias Ringwald                         sm_handle_random_result(&packet[6]);
32103deb3ec6SMatthias Ringwald                         break;
32113deb3ec6SMatthias Ringwald                     }
321233373e40SMatthias Ringwald                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_read_bd_addr)){
321333373e40SMatthias Ringwald                         // Hack for Nordic nRF5 series that doesn't have public address:
321433373e40SMatthias Ringwald                         // - with patches from port/nrf5-zephyr, hci_read_bd_addr returns random static address
321533373e40SMatthias Ringwald                         // - we use this as default for advertisements/connections
321661f37892SMatthias Ringwald                         if (hci_get_manufacturer() == BLUETOOTH_COMPANY_ID_NORDIC_SEMICONDUCTOR_ASA){
321733373e40SMatthias Ringwald                             log_info("nRF5: using (fake) public address as random static address");
321833373e40SMatthias Ringwald                             bd_addr_t addr;
321933373e40SMatthias Ringwald                             reverse_bd_addr(&packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE + 1], addr);
322033373e40SMatthias Ringwald                             gap_random_address_set(addr);
322133373e40SMatthias Ringwald                         }
322233373e40SMatthias Ringwald                     }
322365b44ffdSMatthias Ringwald                     break;
322465b44ffdSMatthias Ringwald                 default:
322565b44ffdSMatthias Ringwald                     break;
32263deb3ec6SMatthias Ringwald 			}
322765b44ffdSMatthias Ringwald             break;
322865b44ffdSMatthias Ringwald         default:
322965b44ffdSMatthias Ringwald             break;
32303deb3ec6SMatthias Ringwald 	}
32313deb3ec6SMatthias Ringwald 
32323deb3ec6SMatthias Ringwald     sm_run();
32333deb3ec6SMatthias Ringwald }
32343deb3ec6SMatthias Ringwald 
32353deb3ec6SMatthias Ringwald static inline int sm_calc_actual_encryption_key_size(int other){
32363deb3ec6SMatthias Ringwald     if (other < sm_min_encryption_key_size) return 0;
32373deb3ec6SMatthias Ringwald     if (other < sm_max_encryption_key_size) return other;
32383deb3ec6SMatthias Ringwald     return sm_max_encryption_key_size;
32393deb3ec6SMatthias Ringwald }
32403deb3ec6SMatthias Ringwald 
3241945888f5SMatthias Ringwald 
324231c09488SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
3243945888f5SMatthias Ringwald static int sm_just_works_or_numeric_comparison(stk_generation_method_t method){
3244945888f5SMatthias Ringwald     switch (method){
3245945888f5SMatthias Ringwald         case JUST_WORKS:
3246945888f5SMatthias Ringwald         case NK_BOTH_INPUT:
3247945888f5SMatthias Ringwald             return 1;
3248945888f5SMatthias Ringwald         default:
3249945888f5SMatthias Ringwald             return 0;
3250945888f5SMatthias Ringwald     }
3251945888f5SMatthias Ringwald }
325207036a04SMatthias Ringwald // responder
3253945888f5SMatthias Ringwald 
3254688a08f9SMatthias Ringwald static int sm_passkey_used(stk_generation_method_t method){
3255688a08f9SMatthias Ringwald     switch (method){
3256688a08f9SMatthias Ringwald         case PK_RESP_INPUT:
3257688a08f9SMatthias Ringwald             return 1;
3258688a08f9SMatthias Ringwald         default:
3259688a08f9SMatthias Ringwald             return 0;
3260688a08f9SMatthias Ringwald     }
3261688a08f9SMatthias Ringwald }
326231c09488SMatthias Ringwald #endif
3263688a08f9SMatthias Ringwald 
32643deb3ec6SMatthias Ringwald /**
32653deb3ec6SMatthias Ringwald  * @return ok
32663deb3ec6SMatthias Ringwald  */
32673deb3ec6SMatthias Ringwald static int sm_validate_stk_generation_method(void){
32683deb3ec6SMatthias Ringwald     // check if STK generation method is acceptable by client
32693deb3ec6SMatthias Ringwald     switch (setup->sm_stk_generation_method){
32703deb3ec6SMatthias Ringwald         case JUST_WORKS:
32713deb3ec6SMatthias Ringwald             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_JUST_WORKS) != 0;
32723deb3ec6SMatthias Ringwald         case PK_RESP_INPUT:
32733deb3ec6SMatthias Ringwald         case PK_INIT_INPUT:
32743deb3ec6SMatthias Ringwald         case OK_BOTH_INPUT:
32753deb3ec6SMatthias Ringwald             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_PASSKEY) != 0;
32763deb3ec6SMatthias Ringwald         case OOB:
32773deb3ec6SMatthias Ringwald             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_OOB) != 0;
3278446a8c36SMatthias Ringwald         case NK_BOTH_INPUT:
3279b4343428SMatthias Ringwald             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON) != 0;
3280446a8c36SMatthias Ringwald             return 1;
32813deb3ec6SMatthias Ringwald         default:
32823deb3ec6SMatthias Ringwald             return 0;
32833deb3ec6SMatthias Ringwald     }
32843deb3ec6SMatthias Ringwald }
32853deb3ec6SMatthias Ringwald 
3286711e6c80SMatthias Ringwald static void sm_pdu_handler(uint8_t packet_type, hci_con_handle_t con_handle, uint8_t *packet, uint16_t size){
32873deb3ec6SMatthias Ringwald 
32889ec2630cSMatthias Ringwald     UNUSED(size);
32899ec2630cSMatthias Ringwald 
3290b170b20fSMatthias Ringwald     if (packet_type == HCI_EVENT_PACKET && packet[0] == L2CAP_EVENT_CAN_SEND_NOW){
3291b170b20fSMatthias Ringwald         sm_run();
3292b170b20fSMatthias Ringwald     }
3293b170b20fSMatthias Ringwald 
32943deb3ec6SMatthias Ringwald     if (packet_type != SM_DATA_PACKET) return;
32953deb3ec6SMatthias Ringwald 
3296711e6c80SMatthias Ringwald     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
32973deb3ec6SMatthias Ringwald     if (!sm_conn) return;
32983deb3ec6SMatthias Ringwald 
32993deb3ec6SMatthias Ringwald     if (packet[0] == SM_CODE_PAIRING_FAILED){
33003deb3ec6SMatthias Ringwald         sm_conn->sm_engine_state = sm_conn->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
33013deb3ec6SMatthias Ringwald         return;
33023deb3ec6SMatthias Ringwald     }
33033deb3ec6SMatthias Ringwald 
3304e03e489aSMatthias Ringwald     log_debug("sm_pdu_handler: state %u, pdu 0x%02x", sm_conn->sm_engine_state, packet[0]);
33053deb3ec6SMatthias Ringwald 
33063deb3ec6SMatthias Ringwald     int err;
330742134bc6SMatthias Ringwald     UNUSED(err);
33083deb3ec6SMatthias Ringwald 
33093d7fe1e9SMatthias Ringwald     if (packet[0] == SM_CODE_KEYPRESS_NOTIFICATION){
33103d7fe1e9SMatthias Ringwald         uint8_t buffer[5];
33113d7fe1e9SMatthias Ringwald         buffer[0] = SM_EVENT_KEYPRESS_NOTIFICATION;
33123d7fe1e9SMatthias Ringwald         buffer[1] = 3;
33133d7fe1e9SMatthias Ringwald         little_endian_store_16(buffer, 2, con_handle);
33143d7fe1e9SMatthias Ringwald         buffer[4] = packet[1];
33153d7fe1e9SMatthias Ringwald         sm_dispatch_event(HCI_EVENT_PACKET, 0, buffer, sizeof(buffer));
33163d7fe1e9SMatthias Ringwald         return;
33173d7fe1e9SMatthias Ringwald     }
33183d7fe1e9SMatthias Ringwald 
33193deb3ec6SMatthias Ringwald     switch (sm_conn->sm_engine_state){
33203deb3ec6SMatthias Ringwald 
33213deb3ec6SMatthias Ringwald         // a sm timeout requries a new physical connection
33223deb3ec6SMatthias Ringwald         case SM_GENERAL_TIMEOUT:
33233deb3ec6SMatthias Ringwald             return;
33243deb3ec6SMatthias Ringwald 
332542134bc6SMatthias Ringwald #ifdef ENABLE_LE_CENTRAL
332642134bc6SMatthias Ringwald 
33273deb3ec6SMatthias Ringwald         // Initiator
33283deb3ec6SMatthias Ringwald         case SM_INITIATOR_CONNECTED:
33293deb3ec6SMatthias Ringwald             if ((packet[0] != SM_CODE_SECURITY_REQUEST) || (sm_conn->sm_role)){
33303deb3ec6SMatthias Ringwald                 sm_pdu_received_in_wrong_state(sm_conn);
33313deb3ec6SMatthias Ringwald                 break;
33323deb3ec6SMatthias Ringwald             }
33333deb3ec6SMatthias Ringwald             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_FAILED){
33343deb3ec6SMatthias Ringwald                 sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
33353deb3ec6SMatthias Ringwald                 break;
33363deb3ec6SMatthias Ringwald             }
33373deb3ec6SMatthias Ringwald             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_SUCCEEDED){
33383764b551SMatthias Ringwald                 sm_key_t ltk;
333959066796SMatthias Ringwald                 le_device_db_encryption_get(sm_conn->sm_le_db_index, NULL, NULL, ltk, NULL, NULL, NULL);
334059066796SMatthias Ringwald                 if (!sm_is_null_key(ltk)){
33413deb3ec6SMatthias Ringwald                     log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
33423deb3ec6SMatthias Ringwald                     sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
33433deb3ec6SMatthias Ringwald                 } else {
33443deb3ec6SMatthias Ringwald                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
33453deb3ec6SMatthias Ringwald                 }
33463deb3ec6SMatthias Ringwald                 break;
33473deb3ec6SMatthias Ringwald             }
33483deb3ec6SMatthias Ringwald             // otherwise, store security request
33493deb3ec6SMatthias Ringwald             sm_conn->sm_security_request_received = 1;
33503deb3ec6SMatthias Ringwald             break;
33513deb3ec6SMatthias Ringwald 
33523deb3ec6SMatthias Ringwald         case SM_INITIATOR_PH1_W4_PAIRING_RESPONSE:
33533deb3ec6SMatthias Ringwald             if (packet[0] != SM_CODE_PAIRING_RESPONSE){
33543deb3ec6SMatthias Ringwald                 sm_pdu_received_in_wrong_state(sm_conn);
33553deb3ec6SMatthias Ringwald                 break;
33563deb3ec6SMatthias Ringwald             }
33573deb3ec6SMatthias Ringwald             // store pairing request
33583deb3ec6SMatthias Ringwald             memcpy(&setup->sm_s_pres, packet, sizeof(sm_pairing_packet_t));
33593deb3ec6SMatthias Ringwald             err = sm_stk_generation_init(sm_conn);
33603deb3ec6SMatthias Ringwald             if (err){
33613deb3ec6SMatthias Ringwald                 setup->sm_pairing_failed_reason = err;
33623deb3ec6SMatthias Ringwald                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
33633deb3ec6SMatthias Ringwald                 break;
33643deb3ec6SMatthias Ringwald             }
3365b41539d5SMatthias Ringwald 
3366b41539d5SMatthias Ringwald             // generate random number first, if we need to show passkey
3367b41539d5SMatthias Ringwald             if (setup->sm_stk_generation_method == PK_RESP_INPUT){
3368b41539d5SMatthias Ringwald                 sm_conn->sm_engine_state = SM_PH2_GET_RANDOM_TK;
3369b41539d5SMatthias Ringwald                 break;
3370b41539d5SMatthias Ringwald             }
3371b41539d5SMatthias Ringwald 
3372136d331aSMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
3373136d331aSMatthias Ringwald             if (setup->sm_use_secure_connections){
33748cba5ca3SMatthias Ringwald                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
33758cba5ca3SMatthias Ringwald                 if (setup->sm_stk_generation_method == JUST_WORKS){
3376136d331aSMatthias Ringwald                     sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3377136d331aSMatthias Ringwald                     sm_trigger_user_response(sm_conn);
3378136d331aSMatthias Ringwald                     if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3379c6b7cbd9SMatthias Ringwald                         sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3380136d331aSMatthias Ringwald                     }
33818cba5ca3SMatthias Ringwald                 } else {
3382c6b7cbd9SMatthias Ringwald                     sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
33838cba5ca3SMatthias Ringwald                 }
3384136d331aSMatthias Ringwald                 break;
3385136d331aSMatthias Ringwald             }
3386136d331aSMatthias Ringwald #endif
33873deb3ec6SMatthias Ringwald             sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
33883deb3ec6SMatthias Ringwald             sm_trigger_user_response(sm_conn);
33893deb3ec6SMatthias Ringwald             // response_idle == nothing <--> sm_trigger_user_response() did not require response
33903deb3ec6SMatthias Ringwald             if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
33913deb3ec6SMatthias Ringwald                 sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
33923deb3ec6SMatthias Ringwald             }
33933deb3ec6SMatthias Ringwald             break;
33943deb3ec6SMatthias Ringwald 
33953deb3ec6SMatthias Ringwald         case SM_INITIATOR_PH2_W4_PAIRING_CONFIRM:
33963deb3ec6SMatthias Ringwald             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
33973deb3ec6SMatthias Ringwald                 sm_pdu_received_in_wrong_state(sm_conn);
33983deb3ec6SMatthias Ringwald                 break;
33993deb3ec6SMatthias Ringwald             }
34003deb3ec6SMatthias Ringwald 
34013deb3ec6SMatthias Ringwald             // store s_confirm
34029c80e4ccSMatthias Ringwald             reverse_128(&packet[1], setup->sm_peer_confirm);
34033deb3ec6SMatthias Ringwald             sm_conn->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
34043deb3ec6SMatthias Ringwald             break;
34053deb3ec6SMatthias Ringwald 
34063deb3ec6SMatthias Ringwald         case SM_INITIATOR_PH2_W4_PAIRING_RANDOM:
34073deb3ec6SMatthias Ringwald             if (packet[0] != SM_CODE_PAIRING_RANDOM){
34083deb3ec6SMatthias Ringwald                 sm_pdu_received_in_wrong_state(sm_conn);
34093deb3ec6SMatthias Ringwald                 break;;
34103deb3ec6SMatthias Ringwald             }
34113deb3ec6SMatthias Ringwald 
34123deb3ec6SMatthias Ringwald             // received random value
34139c80e4ccSMatthias Ringwald             reverse_128(&packet[1], setup->sm_peer_random);
34143deb3ec6SMatthias Ringwald             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
34153deb3ec6SMatthias Ringwald             break;
341642134bc6SMatthias Ringwald #endif
34173deb3ec6SMatthias Ringwald 
341842134bc6SMatthias Ringwald #ifdef ENABLE_LE_PERIPHERAL
34193deb3ec6SMatthias Ringwald         // Responder
34203deb3ec6SMatthias Ringwald         case SM_RESPONDER_IDLE:
34213deb3ec6SMatthias Ringwald         case SM_RESPONDER_SEND_SECURITY_REQUEST:
34223deb3ec6SMatthias Ringwald         case SM_RESPONDER_PH1_W4_PAIRING_REQUEST:
34233deb3ec6SMatthias Ringwald             if (packet[0] != SM_CODE_PAIRING_REQUEST){
34243deb3ec6SMatthias Ringwald                 sm_pdu_received_in_wrong_state(sm_conn);
34253deb3ec6SMatthias Ringwald                 break;;
34263deb3ec6SMatthias Ringwald             }
34273deb3ec6SMatthias Ringwald 
34283deb3ec6SMatthias Ringwald             // store pairing request
34293deb3ec6SMatthias Ringwald             memcpy(&sm_conn->sm_m_preq, packet, sizeof(sm_pairing_packet_t));
34303deb3ec6SMatthias Ringwald             sm_conn->sm_engine_state = SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED;
34313deb3ec6SMatthias Ringwald             break;
343242134bc6SMatthias Ringwald #endif
34333deb3ec6SMatthias Ringwald 
343427c32905SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
3435c6b7cbd9SMatthias Ringwald         case SM_SC_W4_PUBLIC_KEY_COMMAND:
343627c32905SMatthias Ringwald             if (packet[0] != SM_CODE_PAIRING_PUBLIC_KEY){
343727c32905SMatthias Ringwald                 sm_pdu_received_in_wrong_state(sm_conn);
343827c32905SMatthias Ringwald                 break;
343927c32905SMatthias Ringwald             }
3440bccf5e67SMatthias Ringwald 
3441e53be891SMatthias Ringwald             // store public key for DH Key calculation
3442fc5bff5fSMatthias Ringwald             reverse_256(&packet[01], &setup->sm_peer_q[0]);
3443fc5bff5fSMatthias Ringwald             reverse_256(&packet[33], &setup->sm_peer_q[32]);
3444bccf5e67SMatthias Ringwald 
3445bccf5e67SMatthias Ringwald             // validate public key
3446c692d776SMatthias Ringwald             err = 0;
3447c692d776SMatthias Ringwald 
3448c692d776SMatthias Ringwald #ifdef USE_MICROECC_FOR_ECDH
34494b8ec5bcSMatthias Ringwald #if uECC_SUPPORTS_secp256r1
34504b8ec5bcSMatthias Ringwald             // standard version
34514b8ec5bcSMatthias Ringwald             err = uECC_valid_public_key(setup->sm_peer_q, uECC_secp256r1()) == 0;
34524b8ec5bcSMatthias Ringwald #else
34534b8ec5bcSMatthias Ringwald             // static version
3454c692d776SMatthias Ringwald             err = uECC_valid_public_key(setup->sm_peer_q) == 0;
3455c692d776SMatthias Ringwald #endif
34564b8ec5bcSMatthias Ringwald #endif
3457c692d776SMatthias Ringwald 
3458bccf5e67SMatthias Ringwald             if (err){
3459bccf5e67SMatthias Ringwald                 log_error("sm: peer public key invalid %x", err);
3460bccf5e67SMatthias Ringwald                 // uses "unspecified reason", there is no "public key invalid" error code
3461bccf5e67SMatthias Ringwald                 sm_pdu_received_in_wrong_state(sm_conn);
3462bccf5e67SMatthias Ringwald                 break;
3463bccf5e67SMatthias Ringwald             }
3464891bb64aSMatthias Ringwald 
346542134bc6SMatthias Ringwald             if (IS_RESPONDER(sm_conn->sm_role)){
3466136d331aSMatthias Ringwald                 // responder
3467c6b7cbd9SMatthias Ringwald                 sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3468136d331aSMatthias Ringwald             } else {
3469136d331aSMatthias Ringwald                 // initiator
3470a1e31e9cSMatthias Ringwald                 // stk generation method
3471a1e31e9cSMatthias Ringwald                 // passkey entry: notify app to show passkey or to request passkey
3472a1e31e9cSMatthias Ringwald                 switch (setup->sm_stk_generation_method){
3473a1e31e9cSMatthias Ringwald                     case JUST_WORKS:
3474a1e31e9cSMatthias Ringwald                     case NK_BOTH_INPUT:
3475c6b7cbd9SMatthias Ringwald                         sm_conn->sm_engine_state = SM_SC_W4_CONFIRMATION;
3476a1e31e9cSMatthias Ringwald                         break;
3477a1e31e9cSMatthias Ringwald                     case PK_RESP_INPUT:
347807036a04SMatthias Ringwald                         sm_sc_start_calculating_local_confirm(sm_conn);
347907036a04SMatthias Ringwald                         break;
348007036a04SMatthias Ringwald                     case PK_INIT_INPUT:
3481a1e31e9cSMatthias Ringwald                     case OK_BOTH_INPUT:
348207036a04SMatthias Ringwald                         if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
348307036a04SMatthias Ringwald                             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
348407036a04SMatthias Ringwald                             break;
348507036a04SMatthias Ringwald                         }
3486b35a3de2SMatthias Ringwald                         sm_sc_start_calculating_local_confirm(sm_conn);
3487a1e31e9cSMatthias Ringwald                         break;
3488a1e31e9cSMatthias Ringwald                     case OOB:
3489a1e31e9cSMatthias Ringwald                         // TODO: implement SC OOB
3490a1e31e9cSMatthias Ringwald                         break;
3491a1e31e9cSMatthias Ringwald                 }
3492136d331aSMatthias Ringwald             }
349327c32905SMatthias Ringwald             break;
3494e53be891SMatthias Ringwald 
3495c6b7cbd9SMatthias Ringwald         case SM_SC_W4_CONFIRMATION:
349645a61d50SMatthias Ringwald             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
349745a61d50SMatthias Ringwald                 sm_pdu_received_in_wrong_state(sm_conn);
349845a61d50SMatthias Ringwald                 break;
349945a61d50SMatthias Ringwald             }
350045a61d50SMatthias Ringwald             // received confirm value
350145a61d50SMatthias Ringwald             reverse_128(&packet[1], setup->sm_peer_confirm);
350245a61d50SMatthias Ringwald 
350342134bc6SMatthias Ringwald             if (IS_RESPONDER(sm_conn->sm_role)){
350445a61d50SMatthias Ringwald                 // responder
350507036a04SMatthias Ringwald                 if (sm_passkey_used(setup->sm_stk_generation_method)){
350607036a04SMatthias Ringwald                     if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
350707036a04SMatthias Ringwald                         // still waiting for passkey
350807036a04SMatthias Ringwald                         sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
350907036a04SMatthias Ringwald                         break;
351007036a04SMatthias Ringwald                     }
351107036a04SMatthias Ringwald                 }
3512b35a3de2SMatthias Ringwald                 sm_sc_start_calculating_local_confirm(sm_conn);
351345a61d50SMatthias Ringwald             } else {
351445a61d50SMatthias Ringwald                 // initiator
3515945888f5SMatthias Ringwald                 if (sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
3516f1c1783eSMatthias Ringwald                     sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
3517f1c1783eSMatthias Ringwald                 } else {
3518c6b7cbd9SMatthias Ringwald                     sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
351945a61d50SMatthias Ringwald                 }
3520f1c1783eSMatthias Ringwald             }
352145a61d50SMatthias Ringwald             break;
352245a61d50SMatthias Ringwald 
3523c6b7cbd9SMatthias Ringwald         case SM_SC_W4_PAIRING_RANDOM:
3524e53be891SMatthias Ringwald             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3525e53be891SMatthias Ringwald                 sm_pdu_received_in_wrong_state(sm_conn);
3526136d331aSMatthias Ringwald                 break;
3527e53be891SMatthias Ringwald             }
3528e53be891SMatthias Ringwald 
3529e53be891SMatthias Ringwald             // received random value
3530e53be891SMatthias Ringwald             reverse_128(&packet[1], setup->sm_peer_nonce);
3531e53be891SMatthias Ringwald 
35325a293e6eSMatthias Ringwald             // validate confirm value if Cb = f4(Pkb, Pka, Nb, z)
35335a293e6eSMatthias Ringwald             // only check for JUST WORK/NC in initiator role AND passkey entry
3534a3aba2f9SMatthias Ringwald             if (sm_conn->sm_role || sm_passkey_used(setup->sm_stk_generation_method)) {
3535688a08f9SMatthias Ringwald                  sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION;
35365a293e6eSMatthias Ringwald             }
35376f52a196SMatthias Ringwald 
3538688a08f9SMatthias Ringwald             sm_sc_state_after_receiving_random(sm_conn);
3539e53be891SMatthias Ringwald             break;
3540e53be891SMatthias Ringwald 
3541901c000fSMatthias Ringwald         case SM_SC_W2_CALCULATE_G2:
3542901c000fSMatthias Ringwald         case SM_SC_W4_CALCULATE_G2:
3543901c000fSMatthias Ringwald         case SM_SC_W2_CALCULATE_F5_SALT:
3544901c000fSMatthias Ringwald         case SM_SC_W4_CALCULATE_F5_SALT:
3545901c000fSMatthias Ringwald         case SM_SC_W2_CALCULATE_F5_MACKEY:
3546901c000fSMatthias Ringwald         case SM_SC_W4_CALCULATE_F5_MACKEY:
3547901c000fSMatthias Ringwald         case SM_SC_W2_CALCULATE_F5_LTK:
3548901c000fSMatthias Ringwald         case SM_SC_W4_CALCULATE_F5_LTK:
3549901c000fSMatthias Ringwald         case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
3550c6b7cbd9SMatthias Ringwald         case SM_SC_W4_DHKEY_CHECK_COMMAND:
3551901c000fSMatthias Ringwald         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
3552e53be891SMatthias Ringwald             if (packet[0] != SM_CODE_PAIRING_DHKEY_CHECK){
3553e53be891SMatthias Ringwald                 sm_pdu_received_in_wrong_state(sm_conn);
3554e53be891SMatthias Ringwald                 break;
3555e53be891SMatthias Ringwald             }
3556e53be891SMatthias Ringwald             // store DHKey Check
3557901c000fSMatthias Ringwald             setup->sm_state_vars |= SM_STATE_VAR_DHKEY_COMMAND_RECEIVED;
3558e53be891SMatthias Ringwald             reverse_128(&packet[01], setup->sm_peer_dhkey_check);
3559446a8c36SMatthias Ringwald 
3560901c000fSMatthias Ringwald             // have we been only waiting for dhkey check command?
3561901c000fSMatthias Ringwald             if (sm_conn->sm_engine_state == SM_SC_W4_DHKEY_CHECK_COMMAND){
3562019005a0SMatthias Ringwald                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
3563bd57ffebSMatthias Ringwald             }
3564bd57ffebSMatthias Ringwald             break;
356527c32905SMatthias Ringwald #endif
356627c32905SMatthias Ringwald 
356742134bc6SMatthias Ringwald #ifdef ENABLE_LE_PERIPHERAL
35683deb3ec6SMatthias Ringwald         case SM_RESPONDER_PH1_W4_PAIRING_CONFIRM:
35693deb3ec6SMatthias Ringwald             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
35703deb3ec6SMatthias Ringwald                 sm_pdu_received_in_wrong_state(sm_conn);
357127c32905SMatthias Ringwald                 break;
35723deb3ec6SMatthias Ringwald             }
35733deb3ec6SMatthias Ringwald 
35743deb3ec6SMatthias Ringwald             // received confirm value
35759c80e4ccSMatthias Ringwald             reverse_128(&packet[1], setup->sm_peer_confirm);
35763deb3ec6SMatthias Ringwald 
35773deb3ec6SMatthias Ringwald             // notify client to hide shown passkey
35783deb3ec6SMatthias Ringwald             if (setup->sm_stk_generation_method == PK_INIT_INPUT){
35795611a760SMatthias Ringwald                 sm_notify_client_base(SM_EVENT_PASSKEY_DISPLAY_CANCEL, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
35803deb3ec6SMatthias Ringwald             }
35813deb3ec6SMatthias Ringwald 
35823deb3ec6SMatthias Ringwald             // handle user cancel pairing?
35833deb3ec6SMatthias Ringwald             if (setup->sm_user_response == SM_USER_RESPONSE_DECLINE){
35843deb3ec6SMatthias Ringwald                 setup->sm_pairing_failed_reason = SM_REASON_PASSKEYT_ENTRY_FAILED;
35853deb3ec6SMatthias Ringwald                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
35863deb3ec6SMatthias Ringwald                 break;
35873deb3ec6SMatthias Ringwald             }
35883deb3ec6SMatthias Ringwald 
35893deb3ec6SMatthias Ringwald             // wait for user action?
35903deb3ec6SMatthias Ringwald             if (setup->sm_user_response == SM_USER_RESPONSE_PENDING){
35913deb3ec6SMatthias Ringwald                 sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
35923deb3ec6SMatthias Ringwald                 break;
35933deb3ec6SMatthias Ringwald             }
35943deb3ec6SMatthias Ringwald 
35953deb3ec6SMatthias Ringwald             // calculate and send local_confirm
35963deb3ec6SMatthias Ringwald             sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
35973deb3ec6SMatthias Ringwald             break;
35983deb3ec6SMatthias Ringwald 
35993deb3ec6SMatthias Ringwald         case SM_RESPONDER_PH2_W4_PAIRING_RANDOM:
36003deb3ec6SMatthias Ringwald             if (packet[0] != SM_CODE_PAIRING_RANDOM){
36013deb3ec6SMatthias Ringwald                 sm_pdu_received_in_wrong_state(sm_conn);
36023deb3ec6SMatthias Ringwald                 break;;
36033deb3ec6SMatthias Ringwald             }
36043deb3ec6SMatthias Ringwald 
36053deb3ec6SMatthias Ringwald             // received random value
36069c80e4ccSMatthias Ringwald             reverse_128(&packet[1], setup->sm_peer_random);
36073deb3ec6SMatthias Ringwald             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
36083deb3ec6SMatthias Ringwald             break;
360942134bc6SMatthias Ringwald #endif
36103deb3ec6SMatthias Ringwald 
36113deb3ec6SMatthias Ringwald         case SM_PH3_RECEIVE_KEYS:
36123deb3ec6SMatthias Ringwald             switch(packet[0]){
36133deb3ec6SMatthias Ringwald                 case SM_CODE_ENCRYPTION_INFORMATION:
36143deb3ec6SMatthias Ringwald                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
36159c80e4ccSMatthias Ringwald                     reverse_128(&packet[1], setup->sm_peer_ltk);
36163deb3ec6SMatthias Ringwald                     break;
36173deb3ec6SMatthias Ringwald 
36183deb3ec6SMatthias Ringwald                 case SM_CODE_MASTER_IDENTIFICATION:
36193deb3ec6SMatthias Ringwald                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
3620f8fbdce0SMatthias Ringwald                     setup->sm_peer_ediv = little_endian_read_16(packet, 1);
36219c80e4ccSMatthias Ringwald                     reverse_64(&packet[3], setup->sm_peer_rand);
36223deb3ec6SMatthias Ringwald                     break;
36233deb3ec6SMatthias Ringwald 
36243deb3ec6SMatthias Ringwald                 case SM_CODE_IDENTITY_INFORMATION:
36253deb3ec6SMatthias Ringwald                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
36269c80e4ccSMatthias Ringwald                     reverse_128(&packet[1], setup->sm_peer_irk);
36273deb3ec6SMatthias Ringwald                     break;
36283deb3ec6SMatthias Ringwald 
36293deb3ec6SMatthias Ringwald                 case SM_CODE_IDENTITY_ADDRESS_INFORMATION:
36303deb3ec6SMatthias Ringwald                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
36313deb3ec6SMatthias Ringwald                     setup->sm_peer_addr_type = packet[1];
3632724d70a2SMatthias Ringwald                     reverse_bd_addr(&packet[2], setup->sm_peer_address);
36333deb3ec6SMatthias Ringwald                     break;
36343deb3ec6SMatthias Ringwald 
36353deb3ec6SMatthias Ringwald                 case SM_CODE_SIGNING_INFORMATION:
36363deb3ec6SMatthias Ringwald                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
36379c80e4ccSMatthias Ringwald                     reverse_128(&packet[1], setup->sm_peer_csrk);
36383deb3ec6SMatthias Ringwald                     break;
36393deb3ec6SMatthias Ringwald                 default:
36403deb3ec6SMatthias Ringwald                     // Unexpected PDU
36413deb3ec6SMatthias Ringwald                     log_info("Unexpected PDU %u in SM_PH3_RECEIVE_KEYS", packet[0]);
36423deb3ec6SMatthias Ringwald                     break;
36433deb3ec6SMatthias Ringwald             }
36443deb3ec6SMatthias Ringwald             // done with key distribution?
36453deb3ec6SMatthias Ringwald             if (sm_key_distribution_all_received(sm_conn)){
36463deb3ec6SMatthias Ringwald 
36473deb3ec6SMatthias Ringwald                 sm_key_distribution_handle_all_received(sm_conn);
36483deb3ec6SMatthias Ringwald 
364942134bc6SMatthias Ringwald                 if (IS_RESPONDER(sm_conn->sm_role)){
36502bacf595SMatthias Ringwald                     if (setup->sm_use_secure_connections && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION)){
36512bacf595SMatthias Ringwald                         sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_H6_ILK;
36522bacf595SMatthias Ringwald                     } else {
36533deb3ec6SMatthias Ringwald                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
36543deb3ec6SMatthias Ringwald                         sm_done_for_handle(sm_conn->sm_handle);
36552bacf595SMatthias Ringwald                     }
36563deb3ec6SMatthias Ringwald                 } else {
3657625f00b2SMatthias Ringwald                     if (setup->sm_use_secure_connections){
3658625f00b2SMatthias Ringwald                         sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
3659bbf8db22SMatthias Ringwald                     } else {
3660bbf8db22SMatthias Ringwald                         sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3661625f00b2SMatthias Ringwald                     }
36623deb3ec6SMatthias Ringwald                 }
36633deb3ec6SMatthias Ringwald             }
36643deb3ec6SMatthias Ringwald             break;
36653deb3ec6SMatthias Ringwald         default:
36663deb3ec6SMatthias Ringwald             // Unexpected PDU
36673deb3ec6SMatthias Ringwald             log_info("Unexpected PDU %u in state %u", packet[0], sm_conn->sm_engine_state);
36683deb3ec6SMatthias Ringwald             break;
36693deb3ec6SMatthias Ringwald     }
36703deb3ec6SMatthias Ringwald 
36713deb3ec6SMatthias Ringwald     // try to send preparared packet
36723deb3ec6SMatthias Ringwald     sm_run();
36733deb3ec6SMatthias Ringwald }
36743deb3ec6SMatthias Ringwald 
36753deb3ec6SMatthias Ringwald // Security Manager Client API
36763deb3ec6SMatthias Ringwald void sm_register_oob_data_callback( int (*get_oob_data_callback)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data)){
36773deb3ec6SMatthias Ringwald     sm_get_oob_data = get_oob_data_callback;
36783deb3ec6SMatthias Ringwald }
36793deb3ec6SMatthias Ringwald 
368089a78d34SMatthias Ringwald void sm_add_event_handler(btstack_packet_callback_registration_t * callback_handler){
368189a78d34SMatthias Ringwald     btstack_linked_list_add_tail(&sm_event_handlers, (btstack_linked_item_t*) callback_handler);
368289a78d34SMatthias Ringwald }
368389a78d34SMatthias Ringwald 
36843deb3ec6SMatthias Ringwald void sm_set_accepted_stk_generation_methods(uint8_t accepted_stk_generation_methods){
36853deb3ec6SMatthias Ringwald     sm_accepted_stk_generation_methods = accepted_stk_generation_methods;
36863deb3ec6SMatthias Ringwald }
36873deb3ec6SMatthias Ringwald 
36883deb3ec6SMatthias Ringwald void sm_set_encryption_key_size_range(uint8_t min_size, uint8_t max_size){
36893deb3ec6SMatthias Ringwald 	sm_min_encryption_key_size = min_size;
36903deb3ec6SMatthias Ringwald 	sm_max_encryption_key_size = max_size;
36913deb3ec6SMatthias Ringwald }
36923deb3ec6SMatthias Ringwald 
36933deb3ec6SMatthias Ringwald void sm_set_authentication_requirements(uint8_t auth_req){
36943deb3ec6SMatthias Ringwald     sm_auth_req = auth_req;
36953deb3ec6SMatthias Ringwald }
36963deb3ec6SMatthias Ringwald 
36973deb3ec6SMatthias Ringwald void sm_set_io_capabilities(io_capability_t io_capability){
36983deb3ec6SMatthias Ringwald     sm_io_capabilities = io_capability;
36993deb3ec6SMatthias Ringwald }
37003deb3ec6SMatthias Ringwald 
370142134bc6SMatthias Ringwald #ifdef ENABLE_LE_PERIPHERAL
37023deb3ec6SMatthias Ringwald void sm_set_request_security(int enable){
37033deb3ec6SMatthias Ringwald     sm_slave_request_security = enable;
37043deb3ec6SMatthias Ringwald }
370542134bc6SMatthias Ringwald #endif
37063deb3ec6SMatthias Ringwald 
37073deb3ec6SMatthias Ringwald void sm_set_er(sm_key_t er){
37083deb3ec6SMatthias Ringwald     memcpy(sm_persistent_er, er, 16);
37093deb3ec6SMatthias Ringwald }
37103deb3ec6SMatthias Ringwald 
37113deb3ec6SMatthias Ringwald void sm_set_ir(sm_key_t ir){
37123deb3ec6SMatthias Ringwald     memcpy(sm_persistent_ir, ir, 16);
37133deb3ec6SMatthias Ringwald }
37143deb3ec6SMatthias Ringwald 
37153deb3ec6SMatthias Ringwald // Testing support only
37163deb3ec6SMatthias Ringwald void sm_test_set_irk(sm_key_t irk){
37173deb3ec6SMatthias Ringwald     memcpy(sm_persistent_irk, irk, 16);
37183deb3ec6SMatthias Ringwald     sm_persistent_irk_ready = 1;
37193deb3ec6SMatthias Ringwald }
37203deb3ec6SMatthias Ringwald 
37213deb3ec6SMatthias Ringwald void sm_test_use_fixed_local_csrk(void){
37223deb3ec6SMatthias Ringwald     test_use_fixed_local_csrk = 1;
37233deb3ec6SMatthias Ringwald }
37243deb3ec6SMatthias Ringwald 
37253deb3ec6SMatthias Ringwald void sm_init(void){
37263deb3ec6SMatthias Ringwald     // set some (BTstack default) ER and IR
37273deb3ec6SMatthias Ringwald     int i;
37283deb3ec6SMatthias Ringwald     sm_key_t er;
37293deb3ec6SMatthias Ringwald     sm_key_t ir;
37303deb3ec6SMatthias Ringwald     for (i=0;i<16;i++){
37313deb3ec6SMatthias Ringwald         er[i] = 0x30 + i;
37323deb3ec6SMatthias Ringwald         ir[i] = 0x90 + i;
37333deb3ec6SMatthias Ringwald     }
37343deb3ec6SMatthias Ringwald     sm_set_er(er);
37353deb3ec6SMatthias Ringwald     sm_set_ir(ir);
37363deb3ec6SMatthias Ringwald     // defaults
37373deb3ec6SMatthias Ringwald     sm_accepted_stk_generation_methods = SM_STK_GENERATION_METHOD_JUST_WORKS
37383deb3ec6SMatthias Ringwald                                        | SM_STK_GENERATION_METHOD_OOB
3739b4343428SMatthias Ringwald                                        | SM_STK_GENERATION_METHOD_PASSKEY
3740b4343428SMatthias Ringwald                                        | SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON;
3741b4343428SMatthias Ringwald 
37423deb3ec6SMatthias Ringwald     sm_max_encryption_key_size = 16;
37433deb3ec6SMatthias Ringwald     sm_min_encryption_key_size = 7;
37443deb3ec6SMatthias Ringwald 
37457a766ebfSMatthias Ringwald #ifdef ENABLE_CMAC_ENGINE
37463deb3ec6SMatthias Ringwald     sm_cmac_state  = CMAC_IDLE;
37477a766ebfSMatthias Ringwald #endif
37483deb3ec6SMatthias Ringwald     dkg_state = DKG_W4_WORKING;
37493deb3ec6SMatthias Ringwald     rau_state = RAU_W4_WORKING;
37503deb3ec6SMatthias Ringwald     sm_aes128_state = SM_AES128_IDLE;
37513deb3ec6SMatthias Ringwald     sm_address_resolution_test = -1;    // no private address to resolve yet
37523deb3ec6SMatthias Ringwald     sm_address_resolution_ah_calculation_active = 0;
37533deb3ec6SMatthias Ringwald     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
37543deb3ec6SMatthias Ringwald     sm_address_resolution_general_queue = NULL;
37553deb3ec6SMatthias Ringwald 
37563deb3ec6SMatthias Ringwald     gap_random_adress_update_period = 15 * 60 * 1000L;
37577149bde5SMatthias Ringwald     sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
37583deb3ec6SMatthias Ringwald 
37593deb3ec6SMatthias Ringwald     test_use_fixed_local_csrk = 0;
37603deb3ec6SMatthias Ringwald 
3761e03e489aSMatthias Ringwald     // register for HCI Events from HCI
3762e03e489aSMatthias Ringwald     hci_event_callback_registration.callback = &sm_event_packet_handler;
3763e03e489aSMatthias Ringwald     hci_add_event_handler(&hci_event_callback_registration);
3764e03e489aSMatthias Ringwald 
3765b170b20fSMatthias Ringwald     // and L2CAP PDUs + L2CAP_EVENT_CAN_SEND_NOW
3766e03e489aSMatthias Ringwald     l2cap_register_fixed_channel(sm_pdu_handler, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
376727c32905SMatthias Ringwald 
376809e4d397SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
37697df18c15SMatthias Ringwald     ec_key_generation_state = EC_KEY_GENERATION_IDLE;
377009e4d397SMatthias Ringwald #endif
37717df18c15SMatthias Ringwald }
37727df18c15SMatthias Ringwald 
3773df86eb96SMatthias Ringwald void sm_use_fixed_ec_keypair(uint8_t * qx, uint8_t * qy, uint8_t * d){
3774a3aba2f9SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
3775fc5bff5fSMatthias Ringwald     memcpy(&ec_q[0],  qx, 32);
3776fc5bff5fSMatthias Ringwald     memcpy(&ec_q[32], qy, 32);
3777df86eb96SMatthias Ringwald     memcpy(ec_d, d, 32);
3778df86eb96SMatthias Ringwald     sm_have_ec_keypair = 1;
3779df86eb96SMatthias Ringwald     ec_key_generation_state = EC_KEY_GENERATION_DONE;
3780d0662982SMatthias Ringwald #else
3781d0662982SMatthias Ringwald     UNUSED(qx);
3782d0662982SMatthias Ringwald     UNUSED(qy);
3783d0662982SMatthias Ringwald     UNUSED(d);
3784a3aba2f9SMatthias Ringwald #endif
3785df86eb96SMatthias Ringwald }
3786df86eb96SMatthias Ringwald 
3787c692d776SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
3788c692d776SMatthias Ringwald static void parse_hex(uint8_t * buffer, const char * hex_string){
3789c692d776SMatthias Ringwald     while (*hex_string){
3790c692d776SMatthias Ringwald         int high_nibble = nibble_for_char(*hex_string++);
3791c692d776SMatthias Ringwald         int low_nibble  = nibble_for_char(*hex_string++);
3792c692d776SMatthias Ringwald         *buffer++       = (high_nibble << 4) | low_nibble;
3793c692d776SMatthias Ringwald     }
3794c692d776SMatthias Ringwald }
3795c692d776SMatthias Ringwald #endif
3796c692d776SMatthias Ringwald 
37977df18c15SMatthias Ringwald void sm_test_use_fixed_ec_keypair(void){
3798a3aba2f9SMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
3799c692d776SMatthias Ringwald     const char * ec_d_string =  "3f49f6d4a3c55f3874c9b3e3d2103f504aff607beb40b7995899b8a6cd3c1abd";
3800c692d776SMatthias Ringwald     const char * ec_qx_string = "20b003d2f297be2c5e2c83a7e9f9a5b9eff49111acf4fddbcc0301480e359de6";
3801c692d776SMatthias Ringwald     const char * ec_qy_string = "dc809c49652aeb6d63329abf5a52155c766345c28fed3024741c8ed01589d28b";
3802c692d776SMatthias Ringwald     parse_hex(ec_d, ec_d_string);
3803c692d776SMatthias Ringwald     parse_hex(&ec_q[0],  ec_qx_string);
3804c692d776SMatthias Ringwald     parse_hex(&ec_q[32], ec_qy_string);
3805df86eb96SMatthias Ringwald     sm_have_ec_keypair = 1;
3806df86eb96SMatthias Ringwald     ec_key_generation_state = EC_KEY_GENERATION_DONE;
3807a3aba2f9SMatthias Ringwald #endif
38083deb3ec6SMatthias Ringwald }
38093deb3ec6SMatthias Ringwald 
3810711e6c80SMatthias Ringwald static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle){
3811711e6c80SMatthias Ringwald     hci_connection_t * hci_con = hci_connection_for_handle(con_handle);
38123deb3ec6SMatthias Ringwald     if (!hci_con) return NULL;
38133deb3ec6SMatthias Ringwald     return &hci_con->sm_connection;
38143deb3ec6SMatthias Ringwald }
38153deb3ec6SMatthias Ringwald 
38163deb3ec6SMatthias Ringwald // @returns 0 if not encrypted, 7-16 otherwise
3817711e6c80SMatthias Ringwald int sm_encryption_key_size(hci_con_handle_t con_handle){
3818711e6c80SMatthias Ringwald     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
38193deb3ec6SMatthias Ringwald     if (!sm_conn) return 0;     // wrong connection
38203deb3ec6SMatthias Ringwald     if (!sm_conn->sm_connection_encrypted) return 0;
38213deb3ec6SMatthias Ringwald     return sm_conn->sm_actual_encryption_key_size;
38223deb3ec6SMatthias Ringwald }
38233deb3ec6SMatthias Ringwald 
3824711e6c80SMatthias Ringwald int sm_authenticated(hci_con_handle_t con_handle){
3825711e6c80SMatthias Ringwald     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
38263deb3ec6SMatthias Ringwald     if (!sm_conn) return 0;     // wrong connection
38273deb3ec6SMatthias Ringwald     if (!sm_conn->sm_connection_encrypted) return 0; // unencrypted connection cannot be authenticated
38283deb3ec6SMatthias Ringwald     return sm_conn->sm_connection_authenticated;
38293deb3ec6SMatthias Ringwald }
38303deb3ec6SMatthias Ringwald 
3831711e6c80SMatthias Ringwald authorization_state_t sm_authorization_state(hci_con_handle_t con_handle){
3832711e6c80SMatthias Ringwald     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
38333deb3ec6SMatthias Ringwald     if (!sm_conn) return AUTHORIZATION_UNKNOWN;     // wrong connection
38343deb3ec6SMatthias Ringwald     if (!sm_conn->sm_connection_encrypted)               return AUTHORIZATION_UNKNOWN; // unencrypted connection cannot be authorized
38353deb3ec6SMatthias Ringwald     if (!sm_conn->sm_connection_authenticated)           return AUTHORIZATION_UNKNOWN; // unauthenticatd connection cannot be authorized
38363deb3ec6SMatthias Ringwald     return sm_conn->sm_connection_authorization_state;
38373deb3ec6SMatthias Ringwald }
38383deb3ec6SMatthias Ringwald 
38393deb3ec6SMatthias Ringwald static void sm_send_security_request_for_connection(sm_connection_t * sm_conn){
38403deb3ec6SMatthias Ringwald     switch (sm_conn->sm_engine_state){
38413deb3ec6SMatthias Ringwald         case SM_GENERAL_IDLE:
38423deb3ec6SMatthias Ringwald         case SM_RESPONDER_IDLE:
38433deb3ec6SMatthias Ringwald             sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
38443deb3ec6SMatthias Ringwald             sm_run();
38453deb3ec6SMatthias Ringwald             break;
38463deb3ec6SMatthias Ringwald         default:
38473deb3ec6SMatthias Ringwald             break;
38483deb3ec6SMatthias Ringwald     }
38493deb3ec6SMatthias Ringwald }
38503deb3ec6SMatthias Ringwald 
38513deb3ec6SMatthias Ringwald /**
38523deb3ec6SMatthias Ringwald  * @brief Trigger Security Request
38533deb3ec6SMatthias Ringwald  */
3854711e6c80SMatthias Ringwald void sm_send_security_request(hci_con_handle_t con_handle){
3855711e6c80SMatthias Ringwald     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
38563deb3ec6SMatthias Ringwald     if (!sm_conn) return;
38573deb3ec6SMatthias Ringwald     sm_send_security_request_for_connection(sm_conn);
38583deb3ec6SMatthias Ringwald }
38593deb3ec6SMatthias Ringwald 
38603deb3ec6SMatthias Ringwald // request pairing
3861711e6c80SMatthias Ringwald void sm_request_pairing(hci_con_handle_t con_handle){
3862711e6c80SMatthias Ringwald     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
38633deb3ec6SMatthias Ringwald     if (!sm_conn) return;     // wrong connection
38643deb3ec6SMatthias Ringwald 
38653deb3ec6SMatthias Ringwald     log_info("sm_request_pairing in role %u, state %u", sm_conn->sm_role, sm_conn->sm_engine_state);
386642134bc6SMatthias Ringwald     if (IS_RESPONDER(sm_conn->sm_role)){
38673deb3ec6SMatthias Ringwald         sm_send_security_request_for_connection(sm_conn);
38683deb3ec6SMatthias Ringwald     } else {
38693deb3ec6SMatthias Ringwald         // used as a trigger to start central/master/initiator security procedures
38703deb3ec6SMatthias Ringwald         uint16_t ediv;
38713764b551SMatthias Ringwald         sm_key_t ltk;
38723deb3ec6SMatthias Ringwald         if (sm_conn->sm_engine_state == SM_INITIATOR_CONNECTED){
38733deb3ec6SMatthias Ringwald             switch (sm_conn->sm_irk_lookup_state){
38743deb3ec6SMatthias Ringwald                 case IRK_LOOKUP_FAILED:
38753deb3ec6SMatthias Ringwald                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
38763deb3ec6SMatthias Ringwald                     break;
38773deb3ec6SMatthias Ringwald                 case IRK_LOOKUP_SUCCEEDED:
38783764b551SMatthias Ringwald                         le_device_db_encryption_get(sm_conn->sm_le_db_index, &ediv, NULL, ltk, NULL, NULL, NULL);
38793764b551SMatthias Ringwald                         if (!sm_is_null_key(ltk) || ediv){
38803deb3ec6SMatthias Ringwald                             log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
38813deb3ec6SMatthias Ringwald                             sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
38823deb3ec6SMatthias Ringwald                         } else {
38833deb3ec6SMatthias Ringwald                             sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
38843deb3ec6SMatthias Ringwald                         }
38853deb3ec6SMatthias Ringwald                         break;
38863deb3ec6SMatthias Ringwald                 default:
38873deb3ec6SMatthias Ringwald                     sm_conn->sm_bonding_requested = 1;
38883deb3ec6SMatthias Ringwald                     break;
38893deb3ec6SMatthias Ringwald             }
3890e88b2961SMatthias Ringwald         } else if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
3891e88b2961SMatthias Ringwald             sm_conn->sm_bonding_requested = 1;
38923deb3ec6SMatthias Ringwald         }
38933deb3ec6SMatthias Ringwald     }
38943deb3ec6SMatthias Ringwald     sm_run();
38953deb3ec6SMatthias Ringwald }
38963deb3ec6SMatthias Ringwald 
38973deb3ec6SMatthias Ringwald // called by client app on authorization request
3898711e6c80SMatthias Ringwald void sm_authorization_decline(hci_con_handle_t con_handle){
3899711e6c80SMatthias Ringwald     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
39003deb3ec6SMatthias Ringwald     if (!sm_conn) return;     // wrong connection
39013deb3ec6SMatthias Ringwald     sm_conn->sm_connection_authorization_state = AUTHORIZATION_DECLINED;
39025611a760SMatthias Ringwald     sm_notify_client_authorization(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 0);
39033deb3ec6SMatthias Ringwald }
39043deb3ec6SMatthias Ringwald 
3905711e6c80SMatthias Ringwald void sm_authorization_grant(hci_con_handle_t con_handle){
3906711e6c80SMatthias Ringwald     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
39073deb3ec6SMatthias Ringwald     if (!sm_conn) return;     // wrong connection
39083deb3ec6SMatthias Ringwald     sm_conn->sm_connection_authorization_state = AUTHORIZATION_GRANTED;
39095611a760SMatthias Ringwald     sm_notify_client_authorization(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 1);
39103deb3ec6SMatthias Ringwald }
39113deb3ec6SMatthias Ringwald 
39123deb3ec6SMatthias Ringwald // GAP Bonding API
39133deb3ec6SMatthias Ringwald 
3914711e6c80SMatthias Ringwald void sm_bonding_decline(hci_con_handle_t con_handle){
3915711e6c80SMatthias Ringwald     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
39163deb3ec6SMatthias Ringwald     if (!sm_conn) return;     // wrong connection
39173deb3ec6SMatthias Ringwald     setup->sm_user_response = SM_USER_RESPONSE_DECLINE;
39183deb3ec6SMatthias Ringwald 
39193deb3ec6SMatthias Ringwald     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3920de2fd182SMatthias Ringwald         switch (setup->sm_stk_generation_method){
3921de2fd182SMatthias Ringwald             case PK_RESP_INPUT:
3922de2fd182SMatthias Ringwald             case PK_INIT_INPUT:
3923de2fd182SMatthias Ringwald             case OK_BOTH_INPUT:
3924de2fd182SMatthias Ringwald                 sm_pairing_error(sm_conn, SM_GENERAL_SEND_PAIRING_FAILED);
3925de2fd182SMatthias Ringwald                 break;
3926de2fd182SMatthias Ringwald             case NK_BOTH_INPUT:
3927de2fd182SMatthias Ringwald                 sm_pairing_error(sm_conn, SM_REASON_NUMERIC_COMPARISON_FAILED);
3928de2fd182SMatthias Ringwald                 break;
3929de2fd182SMatthias Ringwald             case JUST_WORKS:
3930de2fd182SMatthias Ringwald             case OOB:
3931de2fd182SMatthias Ringwald                 sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
3932de2fd182SMatthias Ringwald                 break;
3933de2fd182SMatthias Ringwald         }
39343deb3ec6SMatthias Ringwald     }
39353deb3ec6SMatthias Ringwald     sm_run();
39363deb3ec6SMatthias Ringwald }
39373deb3ec6SMatthias Ringwald 
3938711e6c80SMatthias Ringwald void sm_just_works_confirm(hci_con_handle_t con_handle){
3939711e6c80SMatthias Ringwald     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
39403deb3ec6SMatthias Ringwald     if (!sm_conn) return;     // wrong connection
39413deb3ec6SMatthias Ringwald     setup->sm_user_response = SM_USER_RESPONSE_CONFIRM;
39423deb3ec6SMatthias Ringwald     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3943136d331aSMatthias Ringwald         if (setup->sm_use_secure_connections){
3944c6b7cbd9SMatthias Ringwald             sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3945bbf8db22SMatthias Ringwald         } else {
3946bbf8db22SMatthias Ringwald             sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3947136d331aSMatthias Ringwald         }
39483deb3ec6SMatthias Ringwald     }
39490346c37cSMatthias Ringwald 
39500346c37cSMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
3951c6b7cbd9SMatthias Ringwald     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
3952dc300847SMatthias Ringwald         sm_sc_prepare_dhkey_check(sm_conn);
3953446a8c36SMatthias Ringwald     }
39540346c37cSMatthias Ringwald #endif
39550346c37cSMatthias Ringwald 
39563deb3ec6SMatthias Ringwald     sm_run();
39573deb3ec6SMatthias Ringwald }
39583deb3ec6SMatthias Ringwald 
3959c8c46d51SMatthias Ringwald void sm_numeric_comparison_confirm(hci_con_handle_t con_handle){
3960c8c46d51SMatthias Ringwald     // for now, it's the same
3961c8c46d51SMatthias Ringwald     sm_just_works_confirm(con_handle);
3962c8c46d51SMatthias Ringwald }
3963c8c46d51SMatthias Ringwald 
3964711e6c80SMatthias Ringwald void sm_passkey_input(hci_con_handle_t con_handle, uint32_t passkey){
3965711e6c80SMatthias Ringwald     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
39663deb3ec6SMatthias Ringwald     if (!sm_conn) return;     // wrong connection
39673deb3ec6SMatthias Ringwald     sm_reset_tk();
3968f8fbdce0SMatthias Ringwald     big_endian_store_32(setup->sm_tk, 12, passkey);
39693deb3ec6SMatthias Ringwald     setup->sm_user_response = SM_USER_RESPONSE_PASSKEY;
39703deb3ec6SMatthias Ringwald     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
39713deb3ec6SMatthias Ringwald         sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
39723deb3ec6SMatthias Ringwald     }
39731c516d8fSMatthias Ringwald #ifdef ENABLE_LE_SECURE_CONNECTIONS
397407036a04SMatthias Ringwald     memcpy(setup->sm_ra, setup->sm_tk, 16);
397507036a04SMatthias Ringwald     memcpy(setup->sm_rb, setup->sm_tk, 16);
397607036a04SMatthias Ringwald     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
397707036a04SMatthias Ringwald         sm_sc_start_calculating_local_confirm(sm_conn);
397807036a04SMatthias Ringwald     }
39791c516d8fSMatthias Ringwald #endif
39803deb3ec6SMatthias Ringwald     sm_run();
39813deb3ec6SMatthias Ringwald }
39823deb3ec6SMatthias Ringwald 
39833d7fe1e9SMatthias Ringwald void sm_keypress_notification(hci_con_handle_t con_handle, uint8_t action){
39843d7fe1e9SMatthias Ringwald     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
39853d7fe1e9SMatthias Ringwald     if (!sm_conn) return;     // wrong connection
39863d7fe1e9SMatthias Ringwald     if (action > SM_KEYPRESS_PASSKEY_ENTRY_COMPLETED) return;
39873d7fe1e9SMatthias Ringwald     setup->sm_keypress_notification = action;
39883d7fe1e9SMatthias Ringwald     sm_run();
39893d7fe1e9SMatthias Ringwald }
39903d7fe1e9SMatthias Ringwald 
39913deb3ec6SMatthias Ringwald /**
39923deb3ec6SMatthias Ringwald  * @brief Identify device in LE Device DB
39933deb3ec6SMatthias Ringwald  * @param handle
39943deb3ec6SMatthias Ringwald  * @returns index from le_device_db or -1 if not found/identified
39953deb3ec6SMatthias Ringwald  */
3996711e6c80SMatthias Ringwald int sm_le_device_index(hci_con_handle_t con_handle ){
3997711e6c80SMatthias Ringwald     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
39983deb3ec6SMatthias Ringwald     if (!sm_conn) return -1;
39993deb3ec6SMatthias Ringwald     return sm_conn->sm_le_db_index;
40003deb3ec6SMatthias Ringwald }
40013deb3ec6SMatthias Ringwald 
40028f57b085SMatthias Ringwald static int gap_random_address_type_requires_updates(void){
40038f57b085SMatthias Ringwald     if (gap_random_adress_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return 0;
40048f57b085SMatthias Ringwald     if (gap_random_adress_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return 0;
40058f57b085SMatthias Ringwald     return 1;
40068f57b085SMatthias Ringwald }
4007d70217a2SMatthias Ringwald 
400833373e40SMatthias Ringwald static uint8_t own_address_type(void){
4009b95a5a35SMatthias Ringwald     switch (gap_random_adress_type){
4010b95a5a35SMatthias Ringwald         case GAP_RANDOM_ADDRESS_TYPE_OFF:
4011b95a5a35SMatthias Ringwald             return BD_ADDR_TYPE_LE_PUBLIC;
4012b95a5a35SMatthias Ringwald         default:
4013b95a5a35SMatthias Ringwald             return BD_ADDR_TYPE_LE_RANDOM;
4014b95a5a35SMatthias Ringwald     }
401533373e40SMatthias Ringwald }
40168f57b085SMatthias Ringwald 
40173deb3ec6SMatthias Ringwald // GAP LE API
40183deb3ec6SMatthias Ringwald void gap_random_address_set_mode(gap_random_address_type_t random_address_type){
40193deb3ec6SMatthias Ringwald     gap_random_address_update_stop();
40203deb3ec6SMatthias Ringwald     gap_random_adress_type = random_address_type;
4021b95a5a35SMatthias Ringwald     hci_le_set_own_address_type(own_address_type());
40228f57b085SMatthias Ringwald     if (!gap_random_address_type_requires_updates()) return;
40233deb3ec6SMatthias Ringwald     gap_random_address_update_start();
40243deb3ec6SMatthias Ringwald     gap_random_address_trigger();
40253deb3ec6SMatthias Ringwald }
40263deb3ec6SMatthias Ringwald 
40273deb3ec6SMatthias Ringwald gap_random_address_type_t gap_random_address_get_mode(void){
40283deb3ec6SMatthias Ringwald     return gap_random_adress_type;
40293deb3ec6SMatthias Ringwald }
40303deb3ec6SMatthias Ringwald 
40313deb3ec6SMatthias Ringwald void gap_random_address_set_update_period(int period_ms){
40323deb3ec6SMatthias Ringwald     gap_random_adress_update_period = period_ms;
40338f57b085SMatthias Ringwald     if (!gap_random_address_type_requires_updates()) return;
40343deb3ec6SMatthias Ringwald     gap_random_address_update_stop();
40353deb3ec6SMatthias Ringwald     gap_random_address_update_start();
40363deb3ec6SMatthias Ringwald }
40373deb3ec6SMatthias Ringwald 
40387e252622SMatthias Ringwald void gap_random_address_set(bd_addr_t addr){
40398f57b085SMatthias Ringwald     gap_random_address_set_mode(GAP_RANDOM_ADDRESS_TYPE_STATIC);
40407e252622SMatthias Ringwald     memcpy(sm_random_address, addr, 6);
40415777861bSMatthias Ringwald     if (rau_state == RAU_W4_WORKING) return;
40427e252622SMatthias Ringwald     rau_state = RAU_SET_ADDRESS;
40437e252622SMatthias Ringwald     sm_run();
40447e252622SMatthias Ringwald }
40457e252622SMatthias Ringwald 
4046d70217a2SMatthias Ringwald #ifdef ENABLE_LE_PERIPHERAL
40473deb3ec6SMatthias Ringwald /*
40483deb3ec6SMatthias Ringwald  * @brief Set Advertisement Paramters
40493deb3ec6SMatthias Ringwald  * @param adv_int_min
40503deb3ec6SMatthias Ringwald  * @param adv_int_max
40513deb3ec6SMatthias Ringwald  * @param adv_type
40523deb3ec6SMatthias Ringwald  * @param direct_address_type
40533deb3ec6SMatthias Ringwald  * @param direct_address
40543deb3ec6SMatthias Ringwald  * @param channel_map
40553deb3ec6SMatthias Ringwald  * @param filter_policy
40563deb3ec6SMatthias Ringwald  *
40573deb3ec6SMatthias Ringwald  * @note own_address_type is used from gap_random_address_set_mode
40583deb3ec6SMatthias Ringwald  */
40593deb3ec6SMatthias Ringwald void gap_advertisements_set_params(uint16_t adv_int_min, uint16_t adv_int_max, uint8_t adv_type,
40603deb3ec6SMatthias Ringwald     uint8_t direct_address_typ, bd_addr_t direct_address, uint8_t channel_map, uint8_t filter_policy){
4061b95a5a35SMatthias Ringwald     hci_le_advertisements_set_params(adv_int_min, adv_int_max, adv_type,
40623deb3ec6SMatthias Ringwald         direct_address_typ, direct_address, channel_map, filter_policy);
40633deb3ec6SMatthias Ringwald }
4064d70217a2SMatthias Ringwald #endif
40653deb3ec6SMatthias Ringwald 
4066