xref: /btstack/src/ble/sm.c (revision c32dba203d4af5ccae95e4d7b5aa9cabd63fc4ec)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define __BTSTACK_FILE__ "sm.c"
39 
40 #include <stdio.h>
41 #include <string.h>
42 #include <inttypes.h>
43 
44 #include "ble/le_device_db.h"
45 #include "ble/core.h"
46 #include "ble/sm.h"
47 #include "bluetooth_company_id.h"
48 #include "btstack_crypto.h"
49 #include "btstack_debug.h"
50 #include "btstack_event.h"
51 #include "btstack_linked_list.h"
52 #include "btstack_memory.h"
53 #include "gap.h"
54 #include "hci.h"
55 #include "hci_dump.h"
56 #include "l2cap.h"
57 
58 #if !defined(ENABLE_LE_PERIPHERAL) && !defined(ENABLE_LE_CENTRAL)
59 #error "LE Security Manager used, but neither ENABLE_LE_PERIPHERAL nor ENABLE_LE_CENTRAL defined. Please add at least one to btstack_config.h."
60 #endif
61 
62 // assert SM Public Key can be sent/received
63 #ifdef ENABLE_LE_SECURE_CONNECTIONS
64 #if HCI_ACL_PAYLOAD_SIZE < 69
65 #error "HCI_ACL_PAYLOAD_SIZE must be at least 69 bytes when using LE Secure Conection. Please increase HCI_ACL_PAYLOAD_SIZE or disable ENABLE_LE_SECURE_CONNECTIONS"
66 #endif
67 #endif
68 
69 #if defined(ENABLE_LE_PERIPHERAL) && defined(ENABLE_LE_CENTRAL)
70 #define IS_RESPONDER(role) (role)
71 #else
72 #ifdef ENABLE_LE_CENTRAL
73 // only central - never responder (avoid 'unused variable' warnings)
74 #define IS_RESPONDER(role) (0 && role)
75 #else
76 // only peripheral - always responder (avoid 'unused variable' warnings)
77 #define IS_RESPONDER(role) (1 || role)
78 #endif
79 #endif
80 
81 #if defined(ENABLE_LE_SIGNED_WRITE) || defined(ENABLE_LE_SECURE_CONNECTIONS)
82 #define USE_CMAC_ENGINE
83 #endif
84 
85 //
86 // SM internal types and globals
87 //
88 
89 typedef enum {
90     DKG_W4_WORKING,
91     DKG_CALC_IRK,
92     DKG_CALC_DHK,
93     DKG_READY
94 } derived_key_generation_t;
95 
96 typedef enum {
97     RAU_W4_WORKING,
98     RAU_IDLE,
99     RAU_W4_RANDOM,
100     RAU_GET_ENC,
101     RAU_W4_ENC,
102     RAU_SET_ADDRESS,
103 } random_address_update_t;
104 
105 typedef enum {
106     CMAC_IDLE,
107     CMAC_CALC_SUBKEYS,
108     CMAC_W4_SUBKEYS,
109     CMAC_CALC_MI,
110     CMAC_W4_MI,
111     CMAC_CALC_MLAST,
112     CMAC_W4_MLAST
113 } cmac_state_t;
114 
115 typedef enum {
116     JUST_WORKS,
117     PK_RESP_INPUT,       // Initiator displays PK, responder inputs PK
118     PK_INIT_INPUT,       // Responder displays PK, initiator inputs PK
119     PK_BOTH_INPUT,       // Only input on both, both input PK
120     NUMERIC_COMPARISON,  // Only numerical compparison (yes/no) on on both sides
121     OOB                  // OOB available on one (SC) or both sides (legacy)
122 } stk_generation_method_t;
123 
124 typedef enum {
125     SM_USER_RESPONSE_IDLE,
126     SM_USER_RESPONSE_PENDING,
127     SM_USER_RESPONSE_CONFIRM,
128     SM_USER_RESPONSE_PASSKEY,
129     SM_USER_RESPONSE_DECLINE
130 } sm_user_response_t;
131 
132 typedef enum {
133     SM_AES128_IDLE,
134     SM_AES128_ACTIVE
135 } sm_aes128_state_t;
136 
137 typedef enum {
138     ADDRESS_RESOLUTION_IDLE,
139     ADDRESS_RESOLUTION_GENERAL,
140     ADDRESS_RESOLUTION_FOR_CONNECTION,
141 } address_resolution_mode_t;
142 
143 typedef enum {
144     ADDRESS_RESOLUTION_SUCEEDED,
145     ADDRESS_RESOLUTION_FAILED,
146 } address_resolution_event_t;
147 
148 typedef enum {
149     EC_KEY_GENERATION_ACTIVE,
150     EC_KEY_GENERATION_DONE,
151 } ec_key_generation_state_t;
152 
153 typedef enum {
154     SM_STATE_VAR_DHKEY_NEEDED = 1 << 0,
155     SM_STATE_VAR_DHKEY_CALCULATED = 1 << 1,
156     SM_STATE_VAR_DHKEY_COMMAND_RECEIVED = 1 << 2,
157 } sm_state_var_t;
158 
159 typedef enum {
160     SM_SC_OOB_IDLE,
161     SM_SC_OOB_W4_RANDOM,
162     SM_SC_OOB_W2_CALC_CONFIRM,
163     SM_SC_OOB_W4_CONFIRM,
164 } sm_sc_oob_state_t;
165 
166 typedef uint8_t sm_key24_t[3];
167 typedef uint8_t sm_key56_t[7];
168 typedef uint8_t sm_key256_t[32];
169 
170 //
171 // GLOBAL DATA
172 //
173 
174 static uint8_t test_use_fixed_local_csrk;
175 
176 #ifdef ENABLE_TESTING_SUPPORT
177 static uint8_t test_pairing_failure;
178 #endif
179 
180 // configuration
181 static uint8_t sm_accepted_stk_generation_methods;
182 static uint8_t sm_max_encryption_key_size;
183 static uint8_t sm_min_encryption_key_size;
184 static uint8_t sm_auth_req = 0;
185 static uint8_t sm_io_capabilities = IO_CAPABILITY_NO_INPUT_NO_OUTPUT;
186 static uint8_t sm_slave_request_security;
187 static uint32_t sm_fixed_passkey_in_display_role;
188 static uint8_t sm_reconstruct_ltk_without_le_device_db_entry;
189 
190 #ifdef ENABLE_LE_SECURE_CONNECTIONS
191 static uint8_t sm_sc_oob_random[16];
192 static void (*sm_sc_oob_callback)(const uint8_t * confirm_value, const uint8_t * random_value);
193 static sm_sc_oob_state_t sm_sc_oob_state;
194 #endif
195 
196 // Security Manager Master Keys, please use sm_set_er(er) and sm_set_ir(ir) with your own 128 bit random values
197 static sm_key_t sm_persistent_er;
198 static sm_key_t sm_persistent_ir;
199 
200 // derived from sm_persistent_ir
201 static sm_key_t sm_persistent_dhk;
202 static sm_key_t sm_persistent_irk;
203 static uint8_t  sm_persistent_irk_ready = 0;    // used for testing
204 static derived_key_generation_t dkg_state;
205 
206 // derived from sm_persistent_er
207 // ..
208 
209 // random address update
210 static random_address_update_t rau_state;
211 static bd_addr_t sm_random_address;
212 
213 #ifdef USE_CMAC_ENGINE
214 // CMAC Calculation: General
215 static btstack_crypto_aes128_cmac_t sm_cmac_request;
216 static void (*sm_cmac_done_callback)(uint8_t hash[8]);
217 static uint8_t sm_cmac_active;
218 static uint8_t sm_cmac_hash[16];
219 #endif
220 
221 // CMAC for ATT Signed Writes
222 #ifdef ENABLE_LE_SIGNED_WRITE
223 static uint16_t        sm_cmac_signed_write_message_len;
224 static uint8_t         sm_cmac_signed_write_header[3];
225 static const uint8_t * sm_cmac_signed_write_message;
226 static uint8_t         sm_cmac_signed_write_sign_counter[4];
227 #endif
228 
229 // CMAC for Secure Connection functions
230 #ifdef ENABLE_LE_SECURE_CONNECTIONS
231 static sm_connection_t * sm_cmac_connection;
232 static uint8_t           sm_cmac_sc_buffer[80];
233 #endif
234 
235 // resolvable private address lookup / CSRK calculation
236 static int       sm_address_resolution_test;
237 static int       sm_address_resolution_ah_calculation_active;
238 static uint8_t   sm_address_resolution_addr_type;
239 static bd_addr_t sm_address_resolution_address;
240 static void *    sm_address_resolution_context;
241 static address_resolution_mode_t sm_address_resolution_mode;
242 static btstack_linked_list_t sm_address_resolution_general_queue;
243 
244 // aes128 crypto engine.
245 static sm_aes128_state_t  sm_aes128_state;
246 
247 // crypto
248 static btstack_crypto_random_t   sm_crypto_random_request;
249 static btstack_crypto_random_t   sm_crypto_random_oob_request;
250 static btstack_crypto_aes128_t   sm_crypto_aes128_request;
251 #ifdef ENABLE_LE_SECURE_CONNECTIONS
252 static btstack_crypto_ecc_p256_t sm_crypto_ecc_p256_request;
253 #endif
254 
255 // temp storage for random data
256 static uint8_t sm_random_data[8];
257 static uint8_t sm_aes128_key[16];
258 static uint8_t sm_aes128_plaintext[16];
259 static uint8_t sm_aes128_ciphertext[16];
260 
261 // to receive hci events
262 static btstack_packet_callback_registration_t hci_event_callback_registration;
263 
264 /* to dispatch sm event */
265 static btstack_linked_list_t sm_event_handlers;
266 
267 // LE Secure Connections
268 #ifdef ENABLE_LE_SECURE_CONNECTIONS
269 static ec_key_generation_state_t ec_key_generation_state;
270 static uint8_t ec_q[64];
271 #endif
272 
273 //
274 // Volume 3, Part H, Chapter 24
275 // "Security shall be initiated by the Security Manager in the device in the master role.
276 // The device in the slave role shall be the responding device."
277 // -> master := initiator, slave := responder
278 //
279 
280 // data needed for security setup
281 typedef struct sm_setup_context {
282 
283     btstack_timer_source_t sm_timeout;
284 
285     // used in all phases
286     uint8_t   sm_pairing_failed_reason;
287 
288     // user response, (Phase 1 and/or 2)
289     uint8_t   sm_user_response;
290     uint8_t   sm_keypress_notification; // bitmap: passkey started, digit entered, digit erased, passkey cleared, passkey complete, 3 bit count
291 
292     // defines which keys will be send after connection is encrypted - calculated during Phase 1, used Phase 3
293     int       sm_key_distribution_send_set;
294     int       sm_key_distribution_received_set;
295 
296     // Phase 2 (Pairing over SMP)
297     stk_generation_method_t sm_stk_generation_method;
298     sm_key_t  sm_tk;
299     uint8_t   sm_have_oob_data;
300     uint8_t   sm_use_secure_connections;
301 
302     sm_key_t  sm_c1_t3_value;   // c1 calculation
303     sm_pairing_packet_t sm_m_preq; // pairing request - needed only for c1
304     sm_pairing_packet_t sm_s_pres; // pairing response - needed only for c1
305     sm_key_t  sm_local_random;
306     sm_key_t  sm_local_confirm;
307     sm_key_t  sm_peer_random;
308     sm_key_t  sm_peer_confirm;
309     uint8_t   sm_m_addr_type;   // address and type can be removed
310     uint8_t   sm_s_addr_type;   //  ''
311     bd_addr_t sm_m_address;     //  ''
312     bd_addr_t sm_s_address;     //  ''
313     sm_key_t  sm_ltk;
314 
315     uint8_t   sm_state_vars;
316 #ifdef ENABLE_LE_SECURE_CONNECTIONS
317     uint8_t   sm_peer_q[64];    // also stores random for EC key generation during init
318     sm_key_t  sm_peer_nonce;    // might be combined with sm_peer_random
319     sm_key_t  sm_local_nonce;   // might be combined with sm_local_random
320     sm_key_t  sm_dhkey;
321     sm_key_t  sm_peer_dhkey_check;
322     sm_key_t  sm_local_dhkey_check;
323     sm_key_t  sm_ra;
324     sm_key_t  sm_rb;
325     sm_key_t  sm_t;             // used for f5 and h6
326     sm_key_t  sm_mackey;
327     uint8_t   sm_passkey_bit;   // also stores number of generated random bytes for EC key generation
328 #endif
329 
330     // Phase 3
331 
332     // key distribution, we generate
333     uint16_t  sm_local_y;
334     uint16_t  sm_local_div;
335     uint16_t  sm_local_ediv;
336     uint8_t   sm_local_rand[8];
337     sm_key_t  sm_local_ltk;
338     sm_key_t  sm_local_csrk;
339     sm_key_t  sm_local_irk;
340     // sm_local_address/addr_type not needed
341 
342     // key distribution, received from peer
343     uint16_t  sm_peer_y;
344     uint16_t  sm_peer_div;
345     uint16_t  sm_peer_ediv;
346     uint8_t   sm_peer_rand[8];
347     sm_key_t  sm_peer_ltk;
348     sm_key_t  sm_peer_irk;
349     sm_key_t  sm_peer_csrk;
350     uint8_t   sm_peer_addr_type;
351     bd_addr_t sm_peer_address;
352 
353 } sm_setup_context_t;
354 
355 //
356 static sm_setup_context_t the_setup;
357 static sm_setup_context_t * setup = &the_setup;
358 
359 // active connection - the one for which the_setup is used for
360 static uint16_t sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
361 
362 // @returns 1 if oob data is available
363 // stores oob data in provided 16 byte buffer if not null
364 static int (*sm_get_oob_data)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data) = NULL;
365 static int (*sm_get_sc_oob_data)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_sc_peer_confirm, uint8_t * oob_sc_peer_random);
366 
367 // horizontal: initiator capabilities
368 // vertial:    responder capabilities
369 static const stk_generation_method_t stk_generation_method [5] [5] = {
370     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
371     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
372     { PK_RESP_INPUT,   PK_RESP_INPUT,    PK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
373     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
374     { PK_RESP_INPUT,   PK_RESP_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
375 };
376 
377 // uses numeric comparison if one side has DisplayYesNo and KeyboardDisplay combinations
378 #ifdef ENABLE_LE_SECURE_CONNECTIONS
379 static const stk_generation_method_t stk_generation_method_with_secure_connection[5][5] = {
380     { JUST_WORKS,      JUST_WORKS,         PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT      },
381     { JUST_WORKS,      NUMERIC_COMPARISON, PK_INIT_INPUT,   JUST_WORKS,    NUMERIC_COMPARISON },
382     { PK_RESP_INPUT,   PK_RESP_INPUT,      PK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT      },
383     { JUST_WORKS,      JUST_WORKS,         JUST_WORKS,      JUST_WORKS,    JUST_WORKS         },
384     { PK_RESP_INPUT,   NUMERIC_COMPARISON, PK_INIT_INPUT,   JUST_WORKS,    NUMERIC_COMPARISON },
385 };
386 #endif
387 
388 static void sm_run(void);
389 #ifdef USE_CMAC_ENGINE
390 static void sm_cmac_message_start(const sm_key_t key, uint16_t message_len, const uint8_t * message, void (*done_callback)(uint8_t * hash));
391 #endif
392 static void sm_done_for_handle(hci_con_handle_t con_handle);
393 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle);
394 static inline int sm_calc_actual_encryption_key_size(int other);
395 static int sm_validate_stk_generation_method(void);
396 static void sm_handle_encryption_result_address_resolution(void *arg);
397 static void sm_handle_encryption_result_dkg_dhk(void *arg);
398 static void sm_handle_encryption_result_dkg_irk(void *arg);
399 static void sm_handle_encryption_result_enc_a(void *arg);
400 static void sm_handle_encryption_result_enc_b(void *arg);
401 static void sm_handle_encryption_result_enc_c(void *arg);
402 static void sm_handle_encryption_result_enc_csrk(void *arg);
403 static void sm_handle_encryption_result_enc_d(void * arg);
404 static void sm_handle_encryption_result_enc_ph3_ltk(void *arg);
405 static void sm_handle_encryption_result_enc_ph3_y(void *arg);
406 static void sm_handle_encryption_result_enc_ph4_ltk(void *arg);
407 static void sm_handle_encryption_result_enc_ph4_y(void *arg);
408 static void sm_handle_encryption_result_enc_stk(void *arg);
409 static void sm_handle_encryption_result_rau(void *arg);
410 static void sm_handle_random_result_ph2_tk(void * arg);
411 static void sm_handle_random_result_rau(void * arg);
412 #ifdef ENABLE_LE_SECURE_CONNECTIONS
413 static void sm_handle_random_result_sc_get_random(void * arg);
414 #endif
415 static void sm_notify_client_status_reason(sm_connection_t * sm_conn, uint8_t status, uint8_t reason);
416 static int sm_passkey_entry(stk_generation_method_t method);
417 
418 static void log_info_hex16(const char * name, uint16_t value){
419     log_info("%-6s 0x%04x", name, value);
420 }
421 
422 // static inline uint8_t sm_pairing_packet_get_code(sm_pairing_packet_t packet){
423 //     return packet[0];
424 // }
425 static inline uint8_t sm_pairing_packet_get_io_capability(sm_pairing_packet_t packet){
426     return packet[1];
427 }
428 static inline uint8_t sm_pairing_packet_get_oob_data_flag(sm_pairing_packet_t packet){
429     return packet[2];
430 }
431 static inline uint8_t sm_pairing_packet_get_auth_req(sm_pairing_packet_t packet){
432     return packet[3];
433 }
434 static inline uint8_t sm_pairing_packet_get_max_encryption_key_size(sm_pairing_packet_t packet){
435     return packet[4];
436 }
437 static inline uint8_t sm_pairing_packet_get_initiator_key_distribution(sm_pairing_packet_t packet){
438     return packet[5];
439 }
440 static inline uint8_t sm_pairing_packet_get_responder_key_distribution(sm_pairing_packet_t packet){
441     return packet[6];
442 }
443 
444 static inline void sm_pairing_packet_set_code(sm_pairing_packet_t packet, uint8_t code){
445     packet[0] = code;
446 }
447 static inline void sm_pairing_packet_set_io_capability(sm_pairing_packet_t packet, uint8_t io_capability){
448     packet[1] = io_capability;
449 }
450 static inline void sm_pairing_packet_set_oob_data_flag(sm_pairing_packet_t packet, uint8_t oob_data_flag){
451     packet[2] = oob_data_flag;
452 }
453 static inline void sm_pairing_packet_set_auth_req(sm_pairing_packet_t packet, uint8_t auth_req){
454     packet[3] = auth_req;
455 }
456 static inline void sm_pairing_packet_set_max_encryption_key_size(sm_pairing_packet_t packet, uint8_t max_encryption_key_size){
457     packet[4] = max_encryption_key_size;
458 }
459 static inline void sm_pairing_packet_set_initiator_key_distribution(sm_pairing_packet_t packet, uint8_t initiator_key_distribution){
460     packet[5] = initiator_key_distribution;
461 }
462 static inline void sm_pairing_packet_set_responder_key_distribution(sm_pairing_packet_t packet, uint8_t responder_key_distribution){
463     packet[6] = responder_key_distribution;
464 }
465 
466 // @returns 1 if all bytes are 0
467 static int sm_is_null(uint8_t * data, int size){
468     int i;
469     for (i=0; i < size ; i++){
470         if (data[i]) return 0;
471     }
472     return 1;
473 }
474 
475 static int sm_is_null_random(uint8_t random[8]){
476     return sm_is_null(random, 8);
477 }
478 
479 static int sm_is_null_key(uint8_t * key){
480     return sm_is_null(key, 16);
481 }
482 
483 // Key utils
484 static void sm_reset_tk(void){
485     int i;
486     for (i=0;i<16;i++){
487         setup->sm_tk[i] = 0;
488     }
489 }
490 
491 // "For example, if a 128-bit encryption key is 0x123456789ABCDEF0123456789ABCDEF0
492 // and it is reduced to 7 octets (56 bits), then the resulting key is 0x0000000000000000003456789ABCDEF0.""
493 static void sm_truncate_key(sm_key_t key, int max_encryption_size){
494     int i;
495     for (i = max_encryption_size ; i < 16 ; i++){
496         key[15-i] = 0;
497     }
498 }
499 
500 // SMP Timeout implementation
501 
502 // Upon transmission of the Pairing Request command or reception of the Pairing Request command,
503 // the Security Manager Timer shall be reset and started.
504 //
505 // The Security Manager Timer shall be reset when an L2CAP SMP command is queued for transmission.
506 //
507 // If the Security Manager Timer reaches 30 seconds, the procedure shall be considered to have failed,
508 // and the local higher layer shall be notified. No further SMP commands shall be sent over the L2CAP
509 // Security Manager Channel. A new SM procedure shall only be performed when a new physical link has been
510 // established.
511 
512 static void sm_timeout_handler(btstack_timer_source_t * timer){
513     log_info("SM timeout");
514     sm_connection_t * sm_conn = (sm_connection_t*) btstack_run_loop_get_timer_context(timer);
515     sm_conn->sm_engine_state = SM_GENERAL_TIMEOUT;
516     sm_notify_client_status_reason(sm_conn, ERROR_CODE_CONNECTION_TIMEOUT, 0);
517     sm_done_for_handle(sm_conn->sm_handle);
518 
519     // trigger handling of next ready connection
520     sm_run();
521 }
522 static void sm_timeout_start(sm_connection_t * sm_conn){
523     btstack_run_loop_remove_timer(&setup->sm_timeout);
524     btstack_run_loop_set_timer_context(&setup->sm_timeout, sm_conn);
525     btstack_run_loop_set_timer_handler(&setup->sm_timeout, sm_timeout_handler);
526     btstack_run_loop_set_timer(&setup->sm_timeout, 30000); // 30 seconds sm timeout
527     btstack_run_loop_add_timer(&setup->sm_timeout);
528 }
529 static void sm_timeout_stop(void){
530     btstack_run_loop_remove_timer(&setup->sm_timeout);
531 }
532 static void sm_timeout_reset(sm_connection_t * sm_conn){
533     sm_timeout_stop();
534     sm_timeout_start(sm_conn);
535 }
536 
537 // end of sm timeout
538 
539 // GAP Random Address updates
540 static gap_random_address_type_t gap_random_adress_type;
541 static btstack_timer_source_t gap_random_address_update_timer;
542 static uint32_t gap_random_adress_update_period;
543 
544 static void gap_random_address_trigger(void){
545     log_info("gap_random_address_trigger");
546     if (rau_state != RAU_IDLE) return;
547     rau_state = RAU_W4_RANDOM;
548     btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_address, 8, &sm_handle_random_result_rau, NULL);
549 }
550 
551 static void gap_random_address_update_handler(btstack_timer_source_t * timer){
552     UNUSED(timer);
553 
554     log_info("GAP Random Address Update due");
555     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
556     btstack_run_loop_add_timer(&gap_random_address_update_timer);
557     gap_random_address_trigger();
558 }
559 
560 static void gap_random_address_update_start(void){
561     btstack_run_loop_set_timer_handler(&gap_random_address_update_timer, gap_random_address_update_handler);
562     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
563     btstack_run_loop_add_timer(&gap_random_address_update_timer);
564 }
565 
566 static void gap_random_address_update_stop(void){
567     btstack_run_loop_remove_timer(&gap_random_address_update_timer);
568 }
569 
570 // ah(k,r) helper
571 // r = padding || r
572 // r - 24 bit value
573 static void sm_ah_r_prime(uint8_t r[3], uint8_t * r_prime){
574     // r'= padding || r
575     memset(r_prime, 0, 16);
576     memcpy(&r_prime[13], r, 3);
577 }
578 
579 // d1 helper
580 // d' = padding || r || d
581 // d,r - 16 bit values
582 static void sm_d1_d_prime(uint16_t d, uint16_t r, uint8_t * d1_prime){
583     // d'= padding || r || d
584     memset(d1_prime, 0, 16);
585     big_endian_store_16(d1_prime, 12, r);
586     big_endian_store_16(d1_prime, 14, d);
587 }
588 
589 // dm helper
590 // r’ = padding || r
591 // r - 64 bit value
592 static void sm_dm_r_prime(uint8_t r[8], uint8_t * r_prime){
593     memset(r_prime, 0, 16);
594     memcpy(&r_prime[8], r, 8);
595 }
596 
597 // calculate arguments for first AES128 operation in C1 function
598 static void sm_c1_t1(sm_key_t r, uint8_t preq[7], uint8_t pres[7], uint8_t iat, uint8_t rat, uint8_t * t1){
599 
600     // p1 = pres || preq || rat’ || iat’
601     // "The octet of iat’ becomes the least significant octet of p1 and the most signifi-
602     // cant octet of pres becomes the most significant octet of p1.
603     // For example, if the 8-bit iat’ is 0x01, the 8-bit rat’ is 0x00, the 56-bit preq
604     // is 0x07071000000101 and the 56 bit pres is 0x05000800000302 then
605     // p1 is 0x05000800000302070710000001010001."
606 
607     sm_key_t p1;
608     reverse_56(pres, &p1[0]);
609     reverse_56(preq, &p1[7]);
610     p1[14] = rat;
611     p1[15] = iat;
612     log_info_key("p1", p1);
613     log_info_key("r", r);
614 
615     // t1 = r xor p1
616     int i;
617     for (i=0;i<16;i++){
618         t1[i] = r[i] ^ p1[i];
619     }
620     log_info_key("t1", t1);
621 }
622 
623 // calculate arguments for second AES128 operation in C1 function
624 static void sm_c1_t3(sm_key_t t2, bd_addr_t ia, bd_addr_t ra, uint8_t * t3){
625      // p2 = padding || ia || ra
626     // "The least significant octet of ra becomes the least significant octet of p2 and
627     // the most significant octet of padding becomes the most significant octet of p2.
628     // For example, if 48-bit ia is 0xA1A2A3A4A5A6 and the 48-bit ra is
629     // 0xB1B2B3B4B5B6 then p2 is 0x00000000A1A2A3A4A5A6B1B2B3B4B5B6.
630 
631     sm_key_t p2;
632     memset(p2, 0, 16);
633     memcpy(&p2[4],  ia, 6);
634     memcpy(&p2[10], ra, 6);
635     log_info_key("p2", p2);
636 
637     // c1 = e(k, t2_xor_p2)
638     int i;
639     for (i=0;i<16;i++){
640         t3[i] = t2[i] ^ p2[i];
641     }
642     log_info_key("t3", t3);
643 }
644 
645 static void sm_s1_r_prime(sm_key_t r1, sm_key_t r2, uint8_t * r_prime){
646     log_info_key("r1", r1);
647     log_info_key("r2", r2);
648     memcpy(&r_prime[8], &r2[8], 8);
649     memcpy(&r_prime[0], &r1[8], 8);
650 }
651 
652 static void sm_dispatch_event(uint8_t packet_type, uint16_t channel, uint8_t * packet, uint16_t size){
653     UNUSED(channel);
654 
655     // log event
656     hci_dump_packet(packet_type, 1, packet, size);
657     // dispatch to all event handlers
658     btstack_linked_list_iterator_t it;
659     btstack_linked_list_iterator_init(&it, &sm_event_handlers);
660     while (btstack_linked_list_iterator_has_next(&it)){
661         btstack_packet_callback_registration_t * entry = (btstack_packet_callback_registration_t*) btstack_linked_list_iterator_next(&it);
662         entry->callback(packet_type, 0, packet, size);
663     }
664 }
665 
666 static void sm_setup_event_base(uint8_t * event, int event_size, uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
667     event[0] = type;
668     event[1] = event_size - 2;
669     little_endian_store_16(event, 2, con_handle);
670     event[4] = addr_type;
671     reverse_bd_addr(address, &event[5]);
672 }
673 
674 static void sm_notify_client_base(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
675     uint8_t event[11];
676     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
677     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
678 }
679 
680 static void sm_notify_client_passkey(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint32_t passkey){
681     uint8_t event[15];
682     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
683     little_endian_store_32(event, 11, passkey);
684     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
685 }
686 
687 static void sm_notify_client_index(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint16_t index){
688     // fetch addr and addr type from db
689     bd_addr_t identity_address;
690     int identity_address_type;
691     le_device_db_info(index, &identity_address_type, identity_address, NULL);
692 
693     uint8_t event[19];
694     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
695     event[11] = identity_address_type;
696     reverse_bd_addr(identity_address, &event[12]);
697     event[18] = index;
698     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
699 }
700 
701 static void sm_notify_client_status(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint8_t status){
702     uint8_t event[12];
703     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
704     event[11] = status;
705     sm_dispatch_event(HCI_EVENT_PACKET, 0, (uint8_t*) &event, sizeof(event));
706 }
707 
708 static void sm_notify_client_status_reason(sm_connection_t * sm_conn, uint8_t status, uint8_t reason){
709     uint8_t event[13];
710     sm_setup_event_base(event, sizeof(event), SM_EVENT_PAIRING_COMPLETE, sm_conn->sm_handle, setup->sm_peer_addr_type, setup->sm_peer_address);
711     event[11] = status;
712     event[12] = reason;
713     sm_dispatch_event(HCI_EVENT_PACKET, 0, (uint8_t*) &event, sizeof(event));
714 }
715 
716 // decide on stk generation based on
717 // - pairing request
718 // - io capabilities
719 // - OOB data availability
720 static void sm_setup_tk(void){
721 
722     // default: just works
723     setup->sm_stk_generation_method = JUST_WORKS;
724 
725 #ifdef ENABLE_LE_SECURE_CONNECTIONS
726     setup->sm_use_secure_connections = ( sm_pairing_packet_get_auth_req(setup->sm_m_preq)
727                                        & sm_pairing_packet_get_auth_req(setup->sm_s_pres)
728                                        & SM_AUTHREQ_SECURE_CONNECTION ) != 0;
729 #else
730     setup->sm_use_secure_connections = 0;
731 #endif
732     log_info("Secure pairing: %u", setup->sm_use_secure_connections);
733 
734 
735     // decide if OOB will be used based on SC vs. Legacy and oob flags
736     int use_oob = 0;
737     if (setup->sm_use_secure_connections){
738         // In LE Secure Connections pairing, the out of band method is used if at least
739         // one device has the peer device's out of band authentication data available.
740         use_oob = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq) | sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
741     } else {
742         // In LE legacy pairing, the out of band method is used if both the devices have
743         // the other device's out of band authentication data available.
744         use_oob = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq) & sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
745     }
746     if (use_oob){
747         log_info("SM: have OOB data");
748         log_info_key("OOB", setup->sm_tk);
749         setup->sm_stk_generation_method = OOB;
750         return;
751     }
752 
753     // If both devices have not set the MITM option in the Authentication Requirements
754     // Flags, then the IO capabilities shall be ignored and the Just Works association
755     // model shall be used.
756     if (((sm_pairing_packet_get_auth_req(setup->sm_m_preq) & SM_AUTHREQ_MITM_PROTECTION) == 0)
757     &&  ((sm_pairing_packet_get_auth_req(setup->sm_s_pres) & SM_AUTHREQ_MITM_PROTECTION) == 0)){
758         log_info("SM: MITM not required by both -> JUST WORKS");
759         return;
760     }
761 
762     // Reset TK as it has been setup in sm_init_setup
763     sm_reset_tk();
764 
765     // Also use just works if unknown io capabilites
766     if ((sm_pairing_packet_get_io_capability(setup->sm_m_preq) > IO_CAPABILITY_KEYBOARD_DISPLAY) || (sm_pairing_packet_get_io_capability(setup->sm_s_pres) > IO_CAPABILITY_KEYBOARD_DISPLAY)){
767         return;
768     }
769 
770     // Otherwise the IO capabilities of the devices shall be used to determine the
771     // pairing method as defined in Table 2.4.
772     // see http://stackoverflow.com/a/1052837/393697 for how to specify pointer to 2-dimensional array
773     const stk_generation_method_t (*generation_method)[5] = stk_generation_method;
774 
775 #ifdef ENABLE_LE_SECURE_CONNECTIONS
776     // table not define by default
777     if (setup->sm_use_secure_connections){
778         generation_method = stk_generation_method_with_secure_connection;
779     }
780 #endif
781     setup->sm_stk_generation_method = generation_method[sm_pairing_packet_get_io_capability(setup->sm_s_pres)][sm_pairing_packet_get_io_capability(setup->sm_m_preq)];
782 
783     log_info("sm_setup_tk: master io cap: %u, slave io cap: %u -> method %u",
784         sm_pairing_packet_get_io_capability(setup->sm_m_preq), sm_pairing_packet_get_io_capability(setup->sm_s_pres), setup->sm_stk_generation_method);
785 }
786 
787 static int sm_key_distribution_flags_for_set(uint8_t key_set){
788     int flags = 0;
789     if (key_set & SM_KEYDIST_ENC_KEY){
790         flags |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
791         flags |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
792     }
793     if (key_set & SM_KEYDIST_ID_KEY){
794         flags |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
795         flags |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
796     }
797     if (key_set & SM_KEYDIST_SIGN){
798         flags |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
799     }
800     return flags;
801 }
802 
803 static void sm_setup_key_distribution(uint8_t key_set){
804     setup->sm_key_distribution_received_set = 0;
805     setup->sm_key_distribution_send_set = sm_key_distribution_flags_for_set(key_set);
806 }
807 
808 // CSRK Key Lookup
809 
810 
811 static int sm_address_resolution_idle(void){
812     return sm_address_resolution_mode == ADDRESS_RESOLUTION_IDLE;
813 }
814 
815 static void sm_address_resolution_start_lookup(uint8_t addr_type, hci_con_handle_t con_handle, bd_addr_t addr, address_resolution_mode_t mode, void * context){
816     memcpy(sm_address_resolution_address, addr, 6);
817     sm_address_resolution_addr_type = addr_type;
818     sm_address_resolution_test = 0;
819     sm_address_resolution_mode = mode;
820     sm_address_resolution_context = context;
821     sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_STARTED, con_handle, addr_type, addr);
822 }
823 
824 int sm_address_resolution_lookup(uint8_t address_type, bd_addr_t address){
825     // check if already in list
826     btstack_linked_list_iterator_t it;
827     sm_lookup_entry_t * entry;
828     btstack_linked_list_iterator_init(&it, &sm_address_resolution_general_queue);
829     while(btstack_linked_list_iterator_has_next(&it)){
830         entry = (sm_lookup_entry_t *) btstack_linked_list_iterator_next(&it);
831         if (entry->address_type != address_type) continue;
832         if (memcmp(entry->address, address, 6))  continue;
833         // already in list
834         return BTSTACK_BUSY;
835     }
836     entry = btstack_memory_sm_lookup_entry_get();
837     if (!entry) return BTSTACK_MEMORY_ALLOC_FAILED;
838     entry->address_type = (bd_addr_type_t) address_type;
839     memcpy(entry->address, address, 6);
840     btstack_linked_list_add(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
841     sm_run();
842     return 0;
843 }
844 
845 // CMAC calculation using AES Engineq
846 #ifdef USE_CMAC_ENGINE
847 
848 static void sm_cmac_done_trampoline(void * arg){
849     UNUSED(arg);
850     sm_cmac_active = 0;
851     (*sm_cmac_done_callback)(sm_cmac_hash);
852     sm_run();
853 }
854 
855 int sm_cmac_ready(void){
856     return sm_cmac_active == 0;
857 }
858 
859 // generic cmac calculation
860 static void sm_cmac_message_start(const sm_key_t key, uint16_t message_len, const uint8_t * message, void (*done_callback)(uint8_t * hash)){
861     sm_cmac_active = 1;
862     sm_cmac_done_callback = done_callback;
863     btstack_crypto_aes128_cmac_message(&sm_cmac_request, key, message_len, message, sm_cmac_hash, sm_cmac_done_trampoline, NULL);
864 }
865 #endif
866 
867 // cmac for ATT Message signing
868 #ifdef ENABLE_LE_SIGNED_WRITE
869 
870 static void sm_cmac_generator_start(const sm_key_t key, uint16_t message_len, uint8_t (*get_byte_callback)(uint16_t offset), void (*done_callback)(uint8_t * hash)){
871     sm_cmac_active = 1;
872     sm_cmac_done_callback = done_callback;
873     btstack_crypto_aes128_cmac_generator(&sm_cmac_request, key, message_len, get_byte_callback, sm_cmac_hash, sm_cmac_done_trampoline, NULL);
874 }
875 
876 static uint8_t sm_cmac_signed_write_message_get_byte(uint16_t offset){
877     if (offset >= sm_cmac_signed_write_message_len) {
878         log_error("sm_cmac_signed_write_message_get_byte. out of bounds, access %u, len %u", offset, sm_cmac_signed_write_message_len);
879         return 0;
880     }
881 
882     offset = sm_cmac_signed_write_message_len - 1 - offset;
883 
884     // sm_cmac_signed_write_header[3] | message[] | sm_cmac_signed_write_sign_counter[4]
885     if (offset < 3){
886         return sm_cmac_signed_write_header[offset];
887     }
888     int actual_message_len_incl_header = sm_cmac_signed_write_message_len - 4;
889     if (offset <  actual_message_len_incl_header){
890         return sm_cmac_signed_write_message[offset - 3];
891     }
892     return sm_cmac_signed_write_sign_counter[offset - actual_message_len_incl_header];
893 }
894 
895 void sm_cmac_signed_write_start(const sm_key_t k, uint8_t opcode, hci_con_handle_t con_handle, uint16_t message_len, const uint8_t * message, uint32_t sign_counter, void (*done_handler)(uint8_t * hash)){
896     // ATT Message Signing
897     sm_cmac_signed_write_header[0] = opcode;
898     little_endian_store_16(sm_cmac_signed_write_header, 1, con_handle);
899     little_endian_store_32(sm_cmac_signed_write_sign_counter, 0, sign_counter);
900     uint16_t total_message_len = 3 + message_len + 4;  // incl. virtually prepended att opcode, handle and appended sign_counter in LE
901     sm_cmac_signed_write_message     = message;
902     sm_cmac_signed_write_message_len = total_message_len;
903     sm_cmac_generator_start(k, total_message_len, &sm_cmac_signed_write_message_get_byte, done_handler);
904 }
905 #endif
906 
907 static void sm_trigger_user_response(sm_connection_t * sm_conn){
908     // notify client for: JUST WORKS confirm, Numeric comparison confirm, PASSKEY display or input
909     setup->sm_user_response = SM_USER_RESPONSE_IDLE;
910     switch (setup->sm_stk_generation_method){
911         case PK_RESP_INPUT:
912             if (IS_RESPONDER(sm_conn->sm_role)){
913                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
914                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
915             } else {
916                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
917             }
918             break;
919         case PK_INIT_INPUT:
920             if (IS_RESPONDER(sm_conn->sm_role)){
921                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
922             } else {
923                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
924                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
925             }
926             break;
927         case PK_BOTH_INPUT:
928             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
929             sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
930             break;
931         case NUMERIC_COMPARISON:
932             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
933             sm_notify_client_passkey(SM_EVENT_NUMERIC_COMPARISON_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
934             break;
935         case JUST_WORKS:
936             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
937             sm_notify_client_base(SM_EVENT_JUST_WORKS_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
938             break;
939         case OOB:
940             // client already provided OOB data, let's skip notification.
941             break;
942     }
943 }
944 
945 static int sm_key_distribution_all_received(sm_connection_t * sm_conn){
946     int recv_flags;
947     if (IS_RESPONDER(sm_conn->sm_role)){
948         // slave / responder
949         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres));
950     } else {
951         // master / initiator
952         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
953     }
954     log_debug("sm_key_distribution_all_received: received 0x%02x, expecting 0x%02x", setup->sm_key_distribution_received_set, recv_flags);
955     return recv_flags == setup->sm_key_distribution_received_set;
956 }
957 
958 static void sm_done_for_handle(hci_con_handle_t con_handle){
959     if (sm_active_connection_handle == con_handle){
960         sm_timeout_stop();
961         sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
962         log_info("sm: connection 0x%x released setup context", con_handle);
963     }
964 }
965 
966 static int sm_key_distribution_flags_for_auth_req(void){
967 
968     int flags = SM_KEYDIST_ID_KEY;
969     if (sm_auth_req & SM_AUTHREQ_BONDING){
970         // encryption and signing information only if bonding requested
971         flags |= SM_KEYDIST_ENC_KEY;
972 #ifdef ENABLE_LE_SIGNED_WRITE
973         flags |= SM_KEYDIST_SIGN;
974 #endif
975     }
976     return flags;
977 }
978 
979 static void sm_reset_setup(void){
980     // fill in sm setup
981     setup->sm_state_vars = 0;
982     setup->sm_keypress_notification = 0;
983     sm_reset_tk();
984 }
985 
986 static void sm_init_setup(sm_connection_t * sm_conn){
987 
988     // fill in sm setup
989     setup->sm_peer_addr_type = sm_conn->sm_peer_addr_type;
990     memcpy(setup->sm_peer_address, sm_conn->sm_peer_address, 6);
991 
992     // query client for Legacy Pairing OOB data
993     setup->sm_have_oob_data = 0;
994     if (sm_get_oob_data) {
995         setup->sm_have_oob_data = (*sm_get_oob_data)(sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, setup->sm_tk);
996     }
997 
998     // if available and SC supported, also ask for SC OOB Data
999 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1000     memset(setup->sm_ra, 0, 16);
1001     memset(setup->sm_rb, 0, 16);
1002     if (setup->sm_have_oob_data && (sm_auth_req & SM_AUTHREQ_SECURE_CONNECTION)){
1003         if (sm_get_sc_oob_data){
1004             if (IS_RESPONDER(sm_conn->sm_role)){
1005                 setup->sm_have_oob_data = (*sm_get_sc_oob_data)(
1006                     sm_conn->sm_peer_addr_type,
1007                     sm_conn->sm_peer_address,
1008                     setup->sm_peer_confirm,
1009                     setup->sm_ra);
1010             } else {
1011                 setup->sm_have_oob_data = (*sm_get_sc_oob_data)(
1012                     sm_conn->sm_peer_addr_type,
1013                     sm_conn->sm_peer_address,
1014                     setup->sm_peer_confirm,
1015                     setup->sm_rb);
1016             }
1017         } else {
1018             setup->sm_have_oob_data = 0;
1019         }
1020     }
1021 #endif
1022 
1023     sm_pairing_packet_t * local_packet;
1024     if (IS_RESPONDER(sm_conn->sm_role)){
1025         // slave
1026         local_packet = &setup->sm_s_pres;
1027         gap_le_get_own_address(&setup->sm_s_addr_type, setup->sm_s_address);
1028         setup->sm_m_addr_type = sm_conn->sm_peer_addr_type;
1029         memcpy(setup->sm_m_address, sm_conn->sm_peer_address, 6);
1030     } else {
1031         // master
1032         local_packet = &setup->sm_m_preq;
1033         gap_le_get_own_address(&setup->sm_m_addr_type, setup->sm_m_address);
1034         setup->sm_s_addr_type = sm_conn->sm_peer_addr_type;
1035         memcpy(setup->sm_s_address, sm_conn->sm_peer_address, 6);
1036 
1037         int key_distribution_flags = sm_key_distribution_flags_for_auth_req();
1038         sm_pairing_packet_set_initiator_key_distribution(setup->sm_m_preq, key_distribution_flags);
1039         sm_pairing_packet_set_responder_key_distribution(setup->sm_m_preq, key_distribution_flags);
1040     }
1041 
1042     uint8_t auth_req = sm_auth_req;
1043     sm_pairing_packet_set_io_capability(*local_packet, sm_io_capabilities);
1044     sm_pairing_packet_set_oob_data_flag(*local_packet, setup->sm_have_oob_data);
1045     sm_pairing_packet_set_auth_req(*local_packet, auth_req);
1046     sm_pairing_packet_set_max_encryption_key_size(*local_packet, sm_max_encryption_key_size);
1047 }
1048 
1049 static int sm_stk_generation_init(sm_connection_t * sm_conn){
1050 
1051     sm_pairing_packet_t * remote_packet;
1052     int                   remote_key_request;
1053     if (IS_RESPONDER(sm_conn->sm_role)){
1054         // slave / responder
1055         remote_packet      = &setup->sm_m_preq;
1056         remote_key_request = sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq);
1057     } else {
1058         // master / initiator
1059         remote_packet      = &setup->sm_s_pres;
1060         remote_key_request = sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres);
1061     }
1062 
1063     // check key size
1064     sm_conn->sm_actual_encryption_key_size = sm_calc_actual_encryption_key_size(sm_pairing_packet_get_max_encryption_key_size(*remote_packet));
1065     if (sm_conn->sm_actual_encryption_key_size == 0) return SM_REASON_ENCRYPTION_KEY_SIZE;
1066 
1067     // decide on STK generation method
1068     sm_setup_tk();
1069     log_info("SMP: generation method %u", setup->sm_stk_generation_method);
1070 
1071     // check if STK generation method is acceptable by client
1072     if (!sm_validate_stk_generation_method()) return SM_REASON_AUTHENTHICATION_REQUIREMENTS;
1073 
1074     // identical to responder
1075     sm_setup_key_distribution(remote_key_request);
1076 
1077     // JUST WORKS doens't provide authentication
1078     sm_conn->sm_connection_authenticated = setup->sm_stk_generation_method == JUST_WORKS ? 0 : 1;
1079 
1080     return 0;
1081 }
1082 
1083 static void sm_address_resolution_handle_event(address_resolution_event_t event){
1084 
1085     // cache and reset context
1086     int matched_device_id = sm_address_resolution_test;
1087     address_resolution_mode_t mode = sm_address_resolution_mode;
1088     void * context = sm_address_resolution_context;
1089 
1090     // reset context
1091     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
1092     sm_address_resolution_context = NULL;
1093     sm_address_resolution_test = -1;
1094     hci_con_handle_t con_handle = 0;
1095 
1096     sm_connection_t * sm_connection;
1097 #ifdef ENABLE_LE_CENTRAL
1098     sm_key_t ltk;
1099 #endif
1100     switch (mode){
1101         case ADDRESS_RESOLUTION_GENERAL:
1102             break;
1103         case ADDRESS_RESOLUTION_FOR_CONNECTION:
1104             sm_connection = (sm_connection_t *) context;
1105             con_handle = sm_connection->sm_handle;
1106             switch (event){
1107                 case ADDRESS_RESOLUTION_SUCEEDED:
1108                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_SUCCEEDED;
1109                     sm_connection->sm_le_db_index = matched_device_id;
1110                     log_info("ADDRESS_RESOLUTION_SUCEEDED, index %d", sm_connection->sm_le_db_index);
1111                     if (sm_connection->sm_role) {
1112                         // LTK request received before, IRK required -> start LTK calculation
1113                         if (sm_connection->sm_engine_state == SM_RESPONDER_PH0_RECEIVED_LTK_W4_IRK){
1114                             sm_connection->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST;
1115                         }
1116                         break;
1117                     }
1118 #ifdef ENABLE_LE_CENTRAL
1119                     log_info("central: bonding requested %u, prev security request %u", sm_connection->sm_pairing_requested, sm_connection->sm_security_request_received);
1120                     if (!sm_connection->sm_pairing_requested && !sm_connection->sm_security_request_received) break;
1121                     sm_connection->sm_security_request_received = 0;
1122                     sm_connection->sm_pairing_requested = 0;
1123                     le_device_db_encryption_get(sm_connection->sm_le_db_index, NULL, NULL, ltk, NULL, NULL, NULL);
1124                     if (!sm_is_null_key(ltk)){
1125                         sm_connection->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
1126                     } else {
1127                         sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1128                     }
1129 #endif
1130                     break;
1131                 case ADDRESS_RESOLUTION_FAILED:
1132                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_FAILED;
1133                     if (sm_connection->sm_role) {
1134                         // LTK request received before, IRK required -> negative LTK reply
1135                         if (sm_connection->sm_engine_state == SM_RESPONDER_PH0_RECEIVED_LTK_W4_IRK){
1136                             sm_connection->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
1137                         }
1138                         break;
1139                     }
1140 #ifdef ENABLE_LE_CENTRAL
1141                     if (!sm_connection->sm_pairing_requested && !sm_connection->sm_security_request_received) break;
1142                     sm_connection->sm_security_request_received = 0;
1143                     sm_connection->sm_pairing_requested = 0;
1144                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1145 #endif
1146                     break;
1147             }
1148             break;
1149         default:
1150             break;
1151     }
1152 
1153     switch (event){
1154         case ADDRESS_RESOLUTION_SUCEEDED:
1155             sm_notify_client_index(SM_EVENT_IDENTITY_RESOLVING_SUCCEEDED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address, matched_device_id);
1156             break;
1157         case ADDRESS_RESOLUTION_FAILED:
1158             sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_FAILED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address);
1159             break;
1160     }
1161 }
1162 
1163 static void sm_key_distribution_handle_all_received(sm_connection_t * sm_conn){
1164 
1165     int le_db_index = -1;
1166 
1167     // only store pairing information if both sides are bondable, i.e., the bonadble flag is set
1168     int bonding_enabed = ( sm_pairing_packet_get_auth_req(setup->sm_m_preq)
1169                          & sm_pairing_packet_get_auth_req(setup->sm_s_pres)
1170                          & SM_AUTHREQ_BONDING ) != 0;
1171 
1172     if (bonding_enabed){
1173 
1174         // lookup device based on IRK
1175         if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
1176             int i;
1177             for (i=0; i < le_device_db_max_count(); i++){
1178                 sm_key_t irk;
1179                 bd_addr_t address;
1180                 int address_type;
1181                 le_device_db_info(i, &address_type, address, irk);
1182                 if (memcmp(irk, setup->sm_peer_irk, 16) == 0){
1183                     log_info("sm: device found for IRK, updating");
1184                     le_db_index = i;
1185                     break;
1186                 }
1187             }
1188         }
1189 
1190         // if not found, lookup via public address if possible
1191         log_info("sm peer addr type %u, peer addres %s", setup->sm_peer_addr_type, bd_addr_to_str(setup->sm_peer_address));
1192         if (le_db_index < 0 && setup->sm_peer_addr_type == BD_ADDR_TYPE_LE_PUBLIC){
1193             int i;
1194             for (i=0; i < le_device_db_max_count(); i++){
1195                 bd_addr_t address;
1196                 int address_type;
1197                 le_device_db_info(i, &address_type, address, NULL);
1198                 log_info("device %u, sm peer addr type %u, peer addres %s", i, address_type, bd_addr_to_str(address));
1199                 if (address_type == BD_ADDR_TYPE_LE_PUBLIC && memcmp(address, setup->sm_peer_address, 6) == 0){
1200                     log_info("sm: device found for public address, updating");
1201                     le_db_index = i;
1202                     break;
1203                 }
1204             }
1205         }
1206 
1207         // if not found, add to db
1208         if (le_db_index < 0) {
1209             le_db_index = le_device_db_add(setup->sm_peer_addr_type, setup->sm_peer_address, setup->sm_peer_irk);
1210         }
1211 
1212         if (le_db_index >= 0){
1213 
1214             sm_notify_client_index(SM_EVENT_IDENTITY_CREATED, sm_conn->sm_handle, setup->sm_peer_addr_type, setup->sm_peer_address, le_db_index);
1215 
1216 #ifdef ENABLE_LE_SIGNED_WRITE
1217             // store local CSRK
1218             if (setup->sm_key_distribution_send_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1219                 log_info("sm: store local CSRK");
1220                 le_device_db_local_csrk_set(le_db_index, setup->sm_local_csrk);
1221                 le_device_db_local_counter_set(le_db_index, 0);
1222             }
1223 
1224             // store remote CSRK
1225             if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1226                 log_info("sm: store remote CSRK");
1227                 le_device_db_remote_csrk_set(le_db_index, setup->sm_peer_csrk);
1228                 le_device_db_remote_counter_set(le_db_index, 0);
1229             }
1230 #endif
1231             // store encryption information for secure connections: LTK generated by ECDH
1232             if (setup->sm_use_secure_connections){
1233                 log_info("sm: store SC LTK (key size %u, authenticated %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
1234                 uint8_t zero_rand[8];
1235                 memset(zero_rand, 0, 8);
1236                 le_device_db_encryption_set(le_db_index, 0, zero_rand, setup->sm_ltk, sm_conn->sm_actual_encryption_key_size,
1237                     sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
1238             }
1239 
1240             // store encryption information for legacy pairing: peer LTK, EDIV, RAND
1241             else if ( (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION)
1242                    && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_MASTER_IDENTIFICATION )){
1243                 log_info("sm: set encryption information (key size %u, authenticated %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
1244                 le_device_db_encryption_set(le_db_index, setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1245                     sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
1246 
1247             }
1248         }
1249     } else {
1250         log_info("Ignoring received keys, bonding not enabled");
1251     }
1252 
1253     // keep le_db_index
1254     sm_conn->sm_le_db_index = le_db_index;
1255 }
1256 
1257 static void sm_pairing_error(sm_connection_t * sm_conn, uint8_t reason){
1258     setup->sm_pairing_failed_reason = reason;
1259     sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1260 }
1261 
1262 static inline void sm_pdu_received_in_wrong_state(sm_connection_t * sm_conn){
1263     sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
1264 }
1265 
1266 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1267 
1268 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn);
1269 static int sm_passkey_used(stk_generation_method_t method);
1270 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method);
1271 
1272 static void sm_sc_start_calculating_local_confirm(sm_connection_t * sm_conn){
1273     if (sm_passkey_used(setup->sm_stk_generation_method)){
1274         // sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
1275         btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_nonce, 16, &sm_handle_random_result_sc_get_random, sm_conn);
1276     } else {
1277         sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
1278     }
1279 }
1280 
1281 static void sm_sc_state_after_receiving_random(sm_connection_t * sm_conn){
1282     if (IS_RESPONDER(sm_conn->sm_role)){
1283         // Responder
1284         if (setup->sm_stk_generation_method == OOB){
1285             // generate Nb
1286             log_info("Generate Nb");
1287             // sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
1288             btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_nonce, 16, &sm_handle_random_result_sc_get_random, sm_conn);
1289         } else {
1290             sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
1291         }
1292     } else {
1293         // Initiator role
1294         switch (setup->sm_stk_generation_method){
1295             case JUST_WORKS:
1296                 sm_sc_prepare_dhkey_check(sm_conn);
1297                 break;
1298 
1299             case NUMERIC_COMPARISON:
1300                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_G2;
1301                 break;
1302             case PK_INIT_INPUT:
1303             case PK_RESP_INPUT:
1304             case PK_BOTH_INPUT:
1305                 if (setup->sm_passkey_bit < 20) {
1306                     sm_sc_start_calculating_local_confirm(sm_conn);
1307                 } else {
1308                     sm_sc_prepare_dhkey_check(sm_conn);
1309                 }
1310                 break;
1311             case OOB:
1312                 sm_sc_prepare_dhkey_check(sm_conn);
1313                 break;
1314         }
1315     }
1316 }
1317 
1318 static void sm_sc_cmac_done(uint8_t * hash){
1319     log_info("sm_sc_cmac_done: ");
1320     log_info_hexdump(hash, 16);
1321 
1322     if (sm_sc_oob_state == SM_SC_OOB_W4_CONFIRM){
1323         sm_sc_oob_state = SM_SC_OOB_IDLE;
1324         (*sm_sc_oob_callback)(hash, sm_sc_oob_random);
1325         return;
1326     }
1327 
1328     sm_connection_t * sm_conn = sm_cmac_connection;
1329     sm_cmac_connection = NULL;
1330 #ifdef ENABLE_CLASSIC
1331     link_key_type_t link_key_type;
1332 #endif
1333 
1334     switch (sm_conn->sm_engine_state){
1335         case SM_SC_W4_CMAC_FOR_CONFIRMATION:
1336             memcpy(setup->sm_local_confirm, hash, 16);
1337             sm_conn->sm_engine_state = SM_SC_SEND_CONFIRMATION;
1338             break;
1339         case SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION:
1340             // check
1341             if (0 != memcmp(hash, setup->sm_peer_confirm, 16)){
1342                 sm_pairing_error(sm_conn, SM_REASON_CONFIRM_VALUE_FAILED);
1343                 break;
1344             }
1345             sm_sc_state_after_receiving_random(sm_conn);
1346             break;
1347         case SM_SC_W4_CALCULATE_G2: {
1348             uint32_t vab = big_endian_read_32(hash, 12) % 1000000;
1349             big_endian_store_32(setup->sm_tk, 12, vab);
1350             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
1351             sm_trigger_user_response(sm_conn);
1352             break;
1353         }
1354         case SM_SC_W4_CALCULATE_F5_SALT:
1355             memcpy(setup->sm_t, hash, 16);
1356             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_MACKEY;
1357             break;
1358         case SM_SC_W4_CALCULATE_F5_MACKEY:
1359             memcpy(setup->sm_mackey, hash, 16);
1360             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_LTK;
1361             break;
1362         case SM_SC_W4_CALCULATE_F5_LTK:
1363             // truncate sm_ltk, but keep full LTK for cross-transport key derivation in sm_local_ltk
1364             // Errata Service Release to the Bluetooth Specification: ESR09
1365             //   E6405 – Cross transport key derivation from a key of size less than 128 bits
1366             //   Note: When the BR/EDR link key is being derived from the LTK, the derivation is done before the LTK gets masked."
1367             memcpy(setup->sm_ltk, hash, 16);
1368             memcpy(setup->sm_local_ltk, hash, 16);
1369             sm_truncate_key(setup->sm_ltk, sm_conn->sm_actual_encryption_key_size);
1370             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK;
1371             break;
1372         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
1373             memcpy(setup->sm_local_dhkey_check, hash, 16);
1374             if (IS_RESPONDER(sm_conn->sm_role)){
1375                 // responder
1376                 if (setup->sm_state_vars & SM_STATE_VAR_DHKEY_COMMAND_RECEIVED){
1377                     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
1378                 } else {
1379                     sm_conn->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
1380                 }
1381             } else {
1382                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1383             }
1384             break;
1385         case SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
1386             if (0 != memcmp(hash, setup->sm_peer_dhkey_check, 16) ){
1387                 sm_pairing_error(sm_conn, SM_REASON_DHKEY_CHECK_FAILED);
1388                 break;
1389             }
1390             if (IS_RESPONDER(sm_conn->sm_role)){
1391                 // responder
1392                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1393             } else {
1394                 // initiator
1395                 sm_conn->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
1396             }
1397             break;
1398         case SM_SC_W4_CALCULATE_H6_ILK:
1399             memcpy(setup->sm_t, hash, 16);
1400             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_H6_BR_EDR_LINK_KEY;
1401             break;
1402         case SM_SC_W4_CALCULATE_H6_BR_EDR_LINK_KEY:
1403 #ifdef ENABLE_CLASSIC
1404             reverse_128(hash, setup->sm_t);
1405             link_key_type = sm_conn->sm_connection_authenticated ?
1406                 AUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256 : UNAUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256;
1407             log_info("Derived classic link key from LE using h6, type %u", (int) link_key_type);
1408             if (IS_RESPONDER(sm_conn->sm_role)){
1409                 gap_store_link_key_for_bd_addr(setup->sm_m_address, setup->sm_t, link_key_type);
1410             } else {
1411                 gap_store_link_key_for_bd_addr(setup->sm_s_address, setup->sm_t, link_key_type);
1412             }
1413 #endif
1414             if (IS_RESPONDER(sm_conn->sm_role)){
1415                 sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
1416             } else {
1417                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
1418             }
1419             sm_notify_client_status_reason(sm_conn, ERROR_CODE_SUCCESS, 0);
1420             sm_done_for_handle(sm_conn->sm_handle);
1421             break;
1422         default:
1423             log_error("sm_sc_cmac_done in state %u", sm_conn->sm_engine_state);
1424             break;
1425     }
1426     sm_run();
1427 }
1428 
1429 static void f4_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, uint8_t z){
1430     const uint16_t message_len = 65;
1431     sm_cmac_connection = sm_conn;
1432     memcpy(sm_cmac_sc_buffer, u, 32);
1433     memcpy(sm_cmac_sc_buffer+32, v, 32);
1434     sm_cmac_sc_buffer[64] = z;
1435     log_info("f4 key");
1436     log_info_hexdump(x, 16);
1437     log_info("f4 message");
1438     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1439     sm_cmac_message_start(x, message_len, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1440 }
1441 
1442 static const sm_key_t f5_salt = { 0x6C ,0x88, 0x83, 0x91, 0xAA, 0xF5, 0xA5, 0x38, 0x60, 0x37, 0x0B, 0xDB, 0x5A, 0x60, 0x83, 0xBE};
1443 static const uint8_t f5_key_id[] = { 0x62, 0x74, 0x6c, 0x65 };
1444 static const uint8_t f5_length[] = { 0x01, 0x00};
1445 
1446 static void f5_calculate_salt(sm_connection_t * sm_conn){
1447     log_info("f5_calculate_salt");
1448     // calculate salt for f5
1449     const uint16_t message_len = 32;
1450     sm_cmac_connection = sm_conn;
1451     memcpy(sm_cmac_sc_buffer, setup->sm_dhkey, message_len);
1452     sm_cmac_message_start(f5_salt, message_len, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1453 }
1454 
1455 static inline void f5_mackkey(sm_connection_t * sm_conn, sm_key_t t, const sm_key_t n1, const sm_key_t n2, const sm_key56_t a1, const sm_key56_t a2){
1456     const uint16_t message_len = 53;
1457     sm_cmac_connection = sm_conn;
1458 
1459     // f5(W, N1, N2, A1, A2) = AES-CMACT (Counter = 0 || keyID || N1 || N2|| A1|| A2 || Length = 256) -- this is the MacKey
1460     sm_cmac_sc_buffer[0] = 0;
1461     memcpy(sm_cmac_sc_buffer+01, f5_key_id, 4);
1462     memcpy(sm_cmac_sc_buffer+05, n1, 16);
1463     memcpy(sm_cmac_sc_buffer+21, n2, 16);
1464     memcpy(sm_cmac_sc_buffer+37, a1, 7);
1465     memcpy(sm_cmac_sc_buffer+44, a2, 7);
1466     memcpy(sm_cmac_sc_buffer+51, f5_length, 2);
1467     log_info("f5 key");
1468     log_info_hexdump(t, 16);
1469     log_info("f5 message for MacKey");
1470     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1471     sm_cmac_message_start(t, message_len, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1472 }
1473 
1474 static void f5_calculate_mackey(sm_connection_t * sm_conn){
1475     sm_key56_t bd_addr_master, bd_addr_slave;
1476     bd_addr_master[0] =  setup->sm_m_addr_type;
1477     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1478     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1479     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1480     if (IS_RESPONDER(sm_conn->sm_role)){
1481         // responder
1482         f5_mackkey(sm_conn, setup->sm_t, setup->sm_peer_nonce, setup->sm_local_nonce, bd_addr_master, bd_addr_slave);
1483     } else {
1484         // initiator
1485         f5_mackkey(sm_conn, setup->sm_t, setup->sm_local_nonce, setup->sm_peer_nonce, bd_addr_master, bd_addr_slave);
1486     }
1487 }
1488 
1489 // note: must be called right after f5_mackey, as sm_cmac_buffer[1..52] will be reused
1490 static inline void f5_ltk(sm_connection_t * sm_conn, sm_key_t t){
1491     const uint16_t message_len = 53;
1492     sm_cmac_connection = sm_conn;
1493     sm_cmac_sc_buffer[0] = 1;
1494     // 1..52 setup before
1495     log_info("f5 key");
1496     log_info_hexdump(t, 16);
1497     log_info("f5 message for LTK");
1498     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1499     sm_cmac_message_start(t, message_len, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1500 }
1501 
1502 static void f5_calculate_ltk(sm_connection_t * sm_conn){
1503     f5_ltk(sm_conn, setup->sm_t);
1504 }
1505 
1506 static void f6_engine(sm_connection_t * sm_conn, const sm_key_t w, const sm_key_t n1, const sm_key_t n2, const sm_key_t r, const sm_key24_t io_cap, const sm_key56_t a1, const sm_key56_t a2){
1507     const uint16_t message_len = 65;
1508     sm_cmac_connection = sm_conn;
1509     memcpy(sm_cmac_sc_buffer, n1, 16);
1510     memcpy(sm_cmac_sc_buffer+16, n2, 16);
1511     memcpy(sm_cmac_sc_buffer+32, r, 16);
1512     memcpy(sm_cmac_sc_buffer+48, io_cap, 3);
1513     memcpy(sm_cmac_sc_buffer+51, a1, 7);
1514     memcpy(sm_cmac_sc_buffer+58, a2, 7);
1515     log_info("f6 key");
1516     log_info_hexdump(w, 16);
1517     log_info("f6 message");
1518     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1519     sm_cmac_message_start(w, 65, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1520 }
1521 
1522 // g2(U, V, X, Y) = AES-CMACX(U || V || Y) mod 2^32
1523 // - U is 256 bits
1524 // - V is 256 bits
1525 // - X is 128 bits
1526 // - Y is 128 bits
1527 static void g2_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, const sm_key_t y){
1528     const uint16_t message_len = 80;
1529     sm_cmac_connection = sm_conn;
1530     memcpy(sm_cmac_sc_buffer, u, 32);
1531     memcpy(sm_cmac_sc_buffer+32, v, 32);
1532     memcpy(sm_cmac_sc_buffer+64, y, 16);
1533     log_info("g2 key");
1534     log_info_hexdump(x, 16);
1535     log_info("g2 message");
1536     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1537     sm_cmac_message_start(x, message_len, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1538 }
1539 
1540 static void g2_calculate(sm_connection_t * sm_conn) {
1541     // calc Va if numeric comparison
1542     if (IS_RESPONDER(sm_conn->sm_role)){
1543         // responder
1544         g2_engine(sm_conn, setup->sm_peer_q, ec_q, setup->sm_peer_nonce, setup->sm_local_nonce);;
1545     } else {
1546         // initiator
1547         g2_engine(sm_conn, ec_q, setup->sm_peer_q, setup->sm_local_nonce, setup->sm_peer_nonce);
1548     }
1549 }
1550 
1551 static void sm_sc_calculate_local_confirm(sm_connection_t * sm_conn){
1552     uint8_t z = 0;
1553     if (sm_passkey_entry(setup->sm_stk_generation_method)){
1554         // some form of passkey
1555         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1556         z = 0x80 | ((pk >> setup->sm_passkey_bit) & 1);
1557         setup->sm_passkey_bit++;
1558     }
1559     f4_engine(sm_conn, ec_q, setup->sm_peer_q, setup->sm_local_nonce, z);
1560 }
1561 
1562 static void sm_sc_calculate_remote_confirm(sm_connection_t * sm_conn){
1563     // OOB
1564     if (setup->sm_stk_generation_method == OOB){
1565         if (IS_RESPONDER(sm_conn->sm_role)){
1566             f4_engine(sm_conn, setup->sm_peer_q, setup->sm_peer_q, setup->sm_ra, 0);
1567         } else {
1568             f4_engine(sm_conn, setup->sm_peer_q, setup->sm_peer_q, setup->sm_rb, 0);
1569         }
1570         return;
1571     }
1572 
1573     uint8_t z = 0;
1574     if (sm_passkey_entry(setup->sm_stk_generation_method)){
1575         // some form of passkey
1576         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1577         // sm_passkey_bit was increased before sending confirm value
1578         z = 0x80 | ((pk >> (setup->sm_passkey_bit-1)) & 1);
1579     }
1580     f4_engine(sm_conn, setup->sm_peer_q, ec_q, setup->sm_peer_nonce, z);
1581 }
1582 
1583 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn){
1584     log_info("sm_sc_prepare_dhkey_check, DHKEY calculated %u", setup->sm_state_vars & SM_STATE_VAR_DHKEY_CALCULATED ? 1 : 0);
1585 
1586     if (setup->sm_state_vars & SM_STATE_VAR_DHKEY_CALCULATED){
1587         sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_SALT;
1588         return;
1589     } else {
1590         sm_conn->sm_engine_state = SM_SC_W4_CALCULATE_DHKEY;
1591     }
1592 }
1593 
1594 static void sm_sc_dhkey_calculated(void * arg){
1595     sm_connection_t * sm_conn = (sm_connection_t *) arg;
1596     log_info("dhkey");
1597     log_info_hexdump(&setup->sm_dhkey[0], 32);
1598     setup->sm_state_vars |= SM_STATE_VAR_DHKEY_CALCULATED;
1599     // trigger next step
1600     if (sm_conn->sm_engine_state == SM_SC_W4_CALCULATE_DHKEY){
1601         sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_SALT;
1602     }
1603     sm_run();
1604 }
1605 
1606 static void sm_sc_calculate_f6_for_dhkey_check(sm_connection_t * sm_conn){
1607     // calculate DHKCheck
1608     sm_key56_t bd_addr_master, bd_addr_slave;
1609     bd_addr_master[0] =  setup->sm_m_addr_type;
1610     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1611     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1612     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1613     uint8_t iocap_a[3];
1614     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1615     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1616     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1617     uint8_t iocap_b[3];
1618     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1619     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1620     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1621     if (IS_RESPONDER(sm_conn->sm_role)){
1622         // responder
1623         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1624     } else {
1625         // initiator
1626         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1627     }
1628 }
1629 
1630 static void sm_sc_calculate_f6_to_verify_dhkey_check(sm_connection_t * sm_conn){
1631     // validate E = f6()
1632     sm_key56_t bd_addr_master, bd_addr_slave;
1633     bd_addr_master[0] =  setup->sm_m_addr_type;
1634     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1635     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1636     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1637 
1638     uint8_t iocap_a[3];
1639     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1640     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1641     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1642     uint8_t iocap_b[3];
1643     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1644     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1645     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1646     if (IS_RESPONDER(sm_conn->sm_role)){
1647         // responder
1648         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1649     } else {
1650         // initiator
1651         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1652     }
1653 }
1654 
1655 
1656 //
1657 // Link Key Conversion Function h6
1658 //
1659 // h6(W, keyID) = AES-CMACW(keyID)
1660 // - W is 128 bits
1661 // - keyID is 32 bits
1662 static void h6_engine(sm_connection_t * sm_conn, const sm_key_t w, const uint32_t key_id){
1663     const uint16_t message_len = 4;
1664     sm_cmac_connection = sm_conn;
1665     big_endian_store_32(sm_cmac_sc_buffer, 0, key_id);
1666     log_info("h6 key");
1667     log_info_hexdump(w, 16);
1668     log_info("h6 message");
1669     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1670     sm_cmac_message_start(w, message_len, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1671 }
1672 
1673 // For SC, setup->sm_local_ltk holds full LTK (sm_ltk is already truncated)
1674 // Errata Service Release to the Bluetooth Specification: ESR09
1675 //   E6405 – Cross transport key derivation from a key of size less than 128 bits
1676 //   "Note: When the BR/EDR link key is being derived from the LTK, the derivation is done before the LTK gets masked."
1677 static void h6_calculate_ilk(sm_connection_t * sm_conn){
1678     h6_engine(sm_conn, setup->sm_local_ltk, 0x746D7031);    // "tmp1"
1679 }
1680 
1681 static void h6_calculate_br_edr_link_key(sm_connection_t * sm_conn){
1682     h6_engine(sm_conn, setup->sm_t, 0x6c656272);    // "lebr"
1683 }
1684 
1685 #endif
1686 
1687 // key management legacy connections:
1688 // - potentially two different LTKs based on direction. each device stores LTK provided by peer
1689 // - master stores LTK, EDIV, RAND. responder optionally stored master LTK (only if it needs to reconnect)
1690 // - initiators reconnects: initiator uses stored LTK, EDIV, RAND generated by responder
1691 // - responder  reconnects: responder uses LTK receveived from master
1692 
1693 // key management secure connections:
1694 // - both devices store same LTK from ECDH key exchange.
1695 
1696 #if defined(ENABLE_LE_SECURE_CONNECTIONS) || defined(ENABLE_LE_CENTRAL)
1697 static void sm_load_security_info(sm_connection_t * sm_connection){
1698     int encryption_key_size;
1699     int authenticated;
1700     int authorized;
1701 
1702     // fetch data from device db - incl. authenticated/authorized/key size. Note all sm_connection_X require encryption enabled
1703     le_device_db_encryption_get(sm_connection->sm_le_db_index, &setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1704                                 &encryption_key_size, &authenticated, &authorized);
1705     log_info("db index %u, key size %u, authenticated %u, authorized %u", sm_connection->sm_le_db_index, encryption_key_size, authenticated, authorized);
1706     sm_connection->sm_actual_encryption_key_size = encryption_key_size;
1707     sm_connection->sm_connection_authenticated = authenticated;
1708     sm_connection->sm_connection_authorization_state = authorized ? AUTHORIZATION_GRANTED : AUTHORIZATION_UNKNOWN;
1709 }
1710 #endif
1711 
1712 #ifdef ENABLE_LE_PERIPHERAL
1713 static void sm_start_calculating_ltk_from_ediv_and_rand(sm_connection_t * sm_connection){
1714     memcpy(setup->sm_local_rand, sm_connection->sm_local_rand, 8);
1715     setup->sm_local_ediv = sm_connection->sm_local_ediv;
1716     // re-establish used key encryption size
1717     // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
1718     sm_connection->sm_actual_encryption_key_size = (setup->sm_local_rand[7] & 0x0f) + 1;
1719     // no db for authenticated flag hack: flag is stored in bit 4 of LSB
1720     sm_connection->sm_connection_authenticated = (setup->sm_local_rand[7] & 0x10) >> 4;
1721     log_info("sm: received ltk request with key size %u, authenticated %u",
1722             sm_connection->sm_actual_encryption_key_size, sm_connection->sm_connection_authenticated);
1723     sm_connection->sm_engine_state = SM_RESPONDER_PH4_Y_GET_ENC;
1724     sm_run();
1725 }
1726 #endif
1727 
1728 static void sm_run(void){
1729 
1730     btstack_linked_list_iterator_t it;
1731 
1732     // assert that stack has already bootet
1733     if (hci_get_state() != HCI_STATE_WORKING) return;
1734 
1735     // assert that we can send at least commands
1736     if (!hci_can_send_command_packet_now()) return;
1737 
1738     //
1739     // non-connection related behaviour
1740     //
1741 
1742     // distributed key generation
1743     switch (dkg_state){
1744         case DKG_CALC_IRK:
1745             // already busy?
1746             if (sm_aes128_state == SM_AES128_IDLE) {
1747                 log_info("DKG_CALC_IRK started");
1748                 // IRK = d1(IR, 1, 0)
1749                 sm_d1_d_prime(1, 0, sm_aes128_plaintext);  // plaintext = d1 prime
1750                 sm_aes128_state = SM_AES128_ACTIVE;
1751                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_ir, sm_aes128_plaintext, sm_persistent_irk, sm_handle_encryption_result_dkg_irk, NULL);
1752                 return;
1753             }
1754             break;
1755         case DKG_CALC_DHK:
1756             // already busy?
1757             if (sm_aes128_state == SM_AES128_IDLE) {
1758                 log_info("DKG_CALC_DHK started");
1759                 // DHK = d1(IR, 3, 0)
1760                 sm_d1_d_prime(3, 0, sm_aes128_plaintext);  // plaintext = d1 prime
1761                 sm_aes128_state = SM_AES128_ACTIVE;
1762                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_ir, sm_aes128_plaintext, sm_persistent_dhk, sm_handle_encryption_result_dkg_dhk, NULL);
1763                 return;
1764             }
1765             break;
1766         default:
1767             break;
1768     }
1769 
1770     // random address updates
1771     switch (rau_state){
1772         case RAU_GET_ENC:
1773             // already busy?
1774             if (sm_aes128_state == SM_AES128_IDLE) {
1775                 sm_ah_r_prime(sm_random_address, sm_aes128_plaintext);
1776                 sm_aes128_state = SM_AES128_ACTIVE;
1777                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_irk, sm_aes128_plaintext, sm_aes128_ciphertext, sm_handle_encryption_result_rau, NULL);
1778                 return;
1779             }
1780             break;
1781         case RAU_SET_ADDRESS:
1782             log_info("New random address: %s", bd_addr_to_str(sm_random_address));
1783             rau_state = RAU_IDLE;
1784             hci_send_cmd(&hci_le_set_random_address, sm_random_address);
1785             return;
1786         default:
1787             break;
1788     }
1789 
1790     // CSRK Lookup
1791     // -- if csrk lookup ready, find connection that require csrk lookup
1792     if (sm_address_resolution_idle()){
1793         hci_connections_get_iterator(&it);
1794         while(btstack_linked_list_iterator_has_next(&it)){
1795             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1796             sm_connection_t  * sm_connection  = &hci_connection->sm_connection;
1797             if (sm_connection->sm_irk_lookup_state == IRK_LOOKUP_W4_READY){
1798                 // and start lookup
1799                 sm_address_resolution_start_lookup(sm_connection->sm_peer_addr_type, sm_connection->sm_handle, sm_connection->sm_peer_address, ADDRESS_RESOLUTION_FOR_CONNECTION, sm_connection);
1800                 sm_connection->sm_irk_lookup_state = IRK_LOOKUP_STARTED;
1801                 break;
1802             }
1803         }
1804     }
1805 
1806     // -- if csrk lookup ready, resolved addresses for received addresses
1807     if (sm_address_resolution_idle()) {
1808         if (!btstack_linked_list_empty(&sm_address_resolution_general_queue)){
1809             sm_lookup_entry_t * entry = (sm_lookup_entry_t *) sm_address_resolution_general_queue;
1810             btstack_linked_list_remove(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
1811             sm_address_resolution_start_lookup(entry->address_type, 0, entry->address, ADDRESS_RESOLUTION_GENERAL, NULL);
1812             btstack_memory_sm_lookup_entry_free(entry);
1813         }
1814     }
1815 
1816     // -- Continue with CSRK device lookup by public or resolvable private address
1817     if (!sm_address_resolution_idle()){
1818         log_info("LE Device Lookup: device %u/%u", sm_address_resolution_test, le_device_db_max_count());
1819         while (sm_address_resolution_test < le_device_db_max_count()){
1820             int addr_type;
1821             bd_addr_t addr;
1822             sm_key_t irk;
1823             le_device_db_info(sm_address_resolution_test, &addr_type, addr, irk);
1824             log_info("device type %u, addr: %s", addr_type, bd_addr_to_str(addr));
1825 
1826             if (sm_address_resolution_addr_type == addr_type && memcmp(addr, sm_address_resolution_address, 6) == 0){
1827                 log_info("LE Device Lookup: found CSRK by { addr_type, address} ");
1828                 sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
1829                 break;
1830             }
1831 
1832             if (sm_address_resolution_addr_type == 0){
1833                 sm_address_resolution_test++;
1834                 continue;
1835             }
1836 
1837             if (sm_aes128_state == SM_AES128_ACTIVE) break;
1838 
1839             log_info("LE Device Lookup: calculate AH");
1840             log_info_key("IRK", irk);
1841 
1842             memcpy(sm_aes128_key, irk, 16);
1843             sm_ah_r_prime(sm_address_resolution_address, sm_aes128_plaintext);
1844             sm_address_resolution_ah_calculation_active = 1;
1845             sm_aes128_state = SM_AES128_ACTIVE;
1846             btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_aes128_key, sm_aes128_plaintext, sm_aes128_ciphertext, sm_handle_encryption_result_address_resolution, NULL);
1847             return;
1848         }
1849 
1850         if (sm_address_resolution_test >= le_device_db_max_count()){
1851             log_info("LE Device Lookup: not found");
1852             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_FAILED);
1853         }
1854     }
1855 
1856 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1857     switch (sm_sc_oob_state){
1858         case SM_SC_OOB_W2_CALC_CONFIRM:
1859             if (!sm_cmac_ready()) break;
1860             sm_sc_oob_state = SM_SC_OOB_W4_CONFIRM;
1861             f4_engine(NULL, ec_q, ec_q, sm_sc_oob_random, 0);
1862             return;
1863         default:
1864             break;
1865     }
1866 #endif
1867 
1868     // handle basic actions that don't requires the full context
1869     hci_connections_get_iterator(&it);
1870     while((sm_active_connection_handle == HCI_CON_HANDLE_INVALID) && btstack_linked_list_iterator_has_next(&it)){
1871         hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1872         sm_connection_t  * sm_connection = &hci_connection->sm_connection;
1873         switch(sm_connection->sm_engine_state){
1874             // responder side
1875             case SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY:
1876                 sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
1877                 hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
1878                 return;
1879 
1880 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1881             case SM_SC_RECEIVED_LTK_REQUEST:
1882                 switch (sm_connection->sm_irk_lookup_state){
1883                     case IRK_LOOKUP_FAILED:
1884                         log_info("LTK Request: ediv & random are empty, but no stored LTK (IRK Lookup Failed)");
1885                         sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
1886                         hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
1887                         return;
1888                     default:
1889                         break;
1890                 }
1891                 break;
1892 #endif
1893             default:
1894                 break;
1895         }
1896     }
1897 
1898     //
1899     // active connection handling
1900     // -- use loop to handle next connection if lock on setup context is released
1901 
1902     while (1) {
1903 
1904         // Find connections that requires setup context and make active if no other is locked
1905         hci_connections_get_iterator(&it);
1906         while((sm_active_connection_handle == HCI_CON_HANDLE_INVALID) && btstack_linked_list_iterator_has_next(&it)){
1907             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1908             sm_connection_t  * sm_connection = &hci_connection->sm_connection;
1909             // - if no connection locked and we're ready/waiting for setup context, fetch it and start
1910             int done = 1;
1911             int err;
1912             UNUSED(err);
1913             switch (sm_connection->sm_engine_state) {
1914 #ifdef ENABLE_LE_PERIPHERAL
1915                 case SM_RESPONDER_SEND_SECURITY_REQUEST:
1916                     // send packet if possible,
1917                     if (l2cap_can_send_fixed_channel_packet_now(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)){
1918                         const uint8_t buffer[2] = { SM_CODE_SECURITY_REQUEST, SM_AUTHREQ_BONDING};
1919                         sm_connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_REQUEST;
1920                         l2cap_send_connectionless(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
1921                     } else {
1922                         l2cap_request_can_send_fix_channel_now_event(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
1923                     }
1924                     // don't lock sxetup context yet
1925                     done = 0;
1926                     break;
1927                 case SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED:
1928                     sm_reset_setup();
1929                     sm_init_setup(sm_connection);
1930                     // recover pairing request
1931                     memcpy(&setup->sm_m_preq, &sm_connection->sm_m_preq, sizeof(sm_pairing_packet_t));
1932                     err = sm_stk_generation_init(sm_connection);
1933 
1934 #ifdef ENABLE_TESTING_SUPPORT
1935                     if (0 < test_pairing_failure && test_pairing_failure < SM_REASON_DHKEY_CHECK_FAILED){
1936                         log_info("testing_support: respond with pairing failure %u", test_pairing_failure);
1937                         err = test_pairing_failure;
1938                     }
1939 #endif
1940                     if (err){
1941                         setup->sm_pairing_failed_reason = err;
1942                         sm_connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1943                         break;
1944                     }
1945                     sm_timeout_start(sm_connection);
1946                     // generate random number first, if we need to show passkey
1947                     if (setup->sm_stk_generation_method == PK_INIT_INPUT){
1948                         btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 8, &sm_handle_random_result_ph2_tk, sm_connection);
1949                         break;
1950                     }
1951                     sm_connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
1952                     break;
1953                 case SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST:
1954                     sm_reset_setup();
1955                     sm_start_calculating_ltk_from_ediv_and_rand(sm_connection);
1956                     break;
1957 #endif
1958 #ifdef ENABLE_LE_CENTRAL
1959                 case SM_INITIATOR_PH0_HAS_LTK:
1960                     sm_reset_setup();
1961                     sm_load_security_info(sm_connection);
1962                     sm_connection->sm_engine_state = SM_INITIATOR_PH0_SEND_START_ENCRYPTION;
1963                     break;
1964                 case SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST:
1965                     sm_reset_setup();
1966                     sm_init_setup(sm_connection);
1967                     sm_timeout_start(sm_connection);
1968                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_SEND_PAIRING_REQUEST;
1969                     break;
1970 #endif
1971 
1972 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1973                 case SM_SC_RECEIVED_LTK_REQUEST:
1974                     switch (sm_connection->sm_irk_lookup_state){
1975                         case IRK_LOOKUP_SUCCEEDED:
1976                             // assuming Secure Connection, we have a stored LTK and the EDIV/RAND are null
1977                             // start using context by loading security info
1978                             sm_reset_setup();
1979                             sm_load_security_info(sm_connection);
1980                             if (setup->sm_peer_ediv == 0 && sm_is_null_random(setup->sm_peer_rand) && !sm_is_null_key(setup->sm_peer_ltk)){
1981                                 memcpy(setup->sm_ltk, setup->sm_peer_ltk, 16);
1982                                 sm_connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK_REPLY;
1983                                 break;
1984                             }
1985                             log_info("LTK Request: ediv & random are empty, but no stored LTK (IRK Lookup Succeeded)");
1986                             sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
1987                             hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
1988                             // don't lock setup context yet
1989                             return;
1990                         default:
1991                             // just wait until IRK lookup is completed
1992                             // don't lock setup context yet
1993                             done = 0;
1994                             break;
1995                     }
1996                     break;
1997 #endif
1998                 default:
1999                     done = 0;
2000                     break;
2001             }
2002             if (done){
2003                 sm_active_connection_handle = sm_connection->sm_handle;
2004                 log_info("sm: connection 0x%04x locked setup context as %s, state %u", sm_active_connection_handle, sm_connection->sm_role ? "responder" : "initiator", sm_connection->sm_engine_state);
2005             }
2006         }
2007 
2008         //
2009         // active connection handling
2010         //
2011 
2012         if (sm_active_connection_handle == HCI_CON_HANDLE_INVALID) return;
2013 
2014         sm_connection_t * connection = sm_get_connection_for_handle(sm_active_connection_handle);
2015         if (!connection) {
2016             log_info("no connection for handle 0x%04x", sm_active_connection_handle);
2017             return;
2018         }
2019 
2020         // assert that we could send a SM PDU - not needed for all of the following
2021         if (!l2cap_can_send_fixed_channel_packet_now(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)) {
2022             log_info("cannot send now, requesting can send now event");
2023             l2cap_request_can_send_fix_channel_now_event(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
2024             return;
2025         }
2026 
2027         // send keypress notifications
2028         if (setup->sm_keypress_notification){
2029             int i;
2030             uint8_t flags       = setup->sm_keypress_notification & 0x1f;
2031             uint8_t num_actions = setup->sm_keypress_notification >> 5;
2032             uint8_t action = 0;
2033             for (i=SM_KEYPRESS_PASSKEY_ENTRY_STARTED;i<=SM_KEYPRESS_PASSKEY_ENTRY_COMPLETED;i++){
2034                 if (flags & (1<<i)){
2035                     int clear_flag = 1;
2036                     switch (i){
2037                         case SM_KEYPRESS_PASSKEY_ENTRY_STARTED:
2038                         case SM_KEYPRESS_PASSKEY_CLEARED:
2039                         case SM_KEYPRESS_PASSKEY_ENTRY_COMPLETED:
2040                         default:
2041                             break;
2042                         case SM_KEYPRESS_PASSKEY_DIGIT_ENTERED:
2043                         case SM_KEYPRESS_PASSKEY_DIGIT_ERASED:
2044                             num_actions--;
2045                             clear_flag = num_actions == 0;
2046                             break;
2047                     }
2048                     if (clear_flag){
2049                         flags &= ~(1<<i);
2050                     }
2051                     action = i;
2052                     break;
2053                 }
2054             }
2055             setup->sm_keypress_notification = (num_actions << 5) | flags;
2056 
2057             // send keypress notification
2058             uint8_t buffer[2];
2059             buffer[0] = SM_CODE_KEYPRESS_NOTIFICATION;
2060             buffer[1] = action;
2061             l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2062 
2063             // try
2064             l2cap_request_can_send_fix_channel_now_event(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
2065             return;
2066         }
2067 
2068         int key_distribution_flags;
2069         UNUSED(key_distribution_flags);
2070 
2071         log_info("sm_run: state %u", connection->sm_engine_state);
2072         if (!l2cap_can_send_fixed_channel_packet_now(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)) {
2073             log_info("sm_run // cannot send");
2074         }
2075         switch (connection->sm_engine_state){
2076 
2077             // general
2078             case SM_GENERAL_SEND_PAIRING_FAILED: {
2079                 uint8_t buffer[2];
2080                 buffer[0] = SM_CODE_PAIRING_FAILED;
2081                 buffer[1] = setup->sm_pairing_failed_reason;
2082                 connection->sm_engine_state = connection->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
2083                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2084                 sm_notify_client_status_reason(connection, ERROR_CODE_AUTHENTICATION_FAILURE, setup->sm_pairing_failed_reason);
2085                 sm_done_for_handle(connection->sm_handle);
2086                 break;
2087             }
2088 
2089             // responding state
2090 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2091             case SM_SC_W2_CMAC_FOR_CONFIRMATION:
2092                 if (!sm_cmac_ready()) break;
2093                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CONFIRMATION;
2094                 sm_sc_calculate_local_confirm(connection);
2095                 break;
2096             case SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION:
2097                 if (!sm_cmac_ready()) break;
2098                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION;
2099                 sm_sc_calculate_remote_confirm(connection);
2100                 break;
2101             case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
2102                 if (!sm_cmac_ready()) break;
2103                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK;
2104                 sm_sc_calculate_f6_for_dhkey_check(connection);
2105                 break;
2106             case SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
2107                 if (!sm_cmac_ready()) break;
2108                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
2109                 sm_sc_calculate_f6_to_verify_dhkey_check(connection);
2110                 break;
2111             case SM_SC_W2_CALCULATE_F5_SALT:
2112                 if (!sm_cmac_ready()) break;
2113                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_SALT;
2114                 f5_calculate_salt(connection);
2115                 break;
2116             case SM_SC_W2_CALCULATE_F5_MACKEY:
2117                 if (!sm_cmac_ready()) break;
2118                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_MACKEY;
2119                 f5_calculate_mackey(connection);
2120                 break;
2121             case SM_SC_W2_CALCULATE_F5_LTK:
2122                 if (!sm_cmac_ready()) break;
2123                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_LTK;
2124                 f5_calculate_ltk(connection);
2125                 break;
2126             case SM_SC_W2_CALCULATE_G2:
2127                 if (!sm_cmac_ready()) break;
2128                 connection->sm_engine_state = SM_SC_W4_CALCULATE_G2;
2129                 g2_calculate(connection);
2130                 break;
2131             case SM_SC_W2_CALCULATE_H6_ILK:
2132                 if (!sm_cmac_ready()) break;
2133                 connection->sm_engine_state = SM_SC_W4_CALCULATE_H6_ILK;
2134                 h6_calculate_ilk(connection);
2135                 break;
2136             case SM_SC_W2_CALCULATE_H6_BR_EDR_LINK_KEY:
2137                 if (!sm_cmac_ready()) break;
2138                 connection->sm_engine_state = SM_SC_W4_CALCULATE_H6_BR_EDR_LINK_KEY;
2139                 h6_calculate_br_edr_link_key(connection);
2140                 break;
2141 #endif
2142 
2143 #ifdef ENABLE_LE_CENTRAL
2144             // initiator side
2145             case SM_INITIATOR_PH0_SEND_START_ENCRYPTION: {
2146                 sm_key_t peer_ltk_flipped;
2147                 reverse_128(setup->sm_peer_ltk, peer_ltk_flipped);
2148                 connection->sm_engine_state = SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED;
2149                 log_info("sm: hci_le_start_encryption ediv 0x%04x", setup->sm_peer_ediv);
2150                 uint32_t rand_high = big_endian_read_32(setup->sm_peer_rand, 0);
2151                 uint32_t rand_low  = big_endian_read_32(setup->sm_peer_rand, 4);
2152                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle,rand_low, rand_high, setup->sm_peer_ediv, peer_ltk_flipped);
2153                 return;
2154             }
2155 
2156             case SM_INITIATOR_PH1_SEND_PAIRING_REQUEST:
2157                 sm_pairing_packet_set_code(setup->sm_m_preq, SM_CODE_PAIRING_REQUEST);
2158                 connection->sm_engine_state = SM_INITIATOR_PH1_W4_PAIRING_RESPONSE;
2159                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_m_preq, sizeof(sm_pairing_packet_t));
2160                 sm_timeout_reset(connection);
2161                 break;
2162 #endif
2163 
2164 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2165 
2166             case SM_SC_SEND_PUBLIC_KEY_COMMAND: {
2167                 int trigger_user_response = 0;
2168 
2169                 uint8_t buffer[65];
2170                 buffer[0] = SM_CODE_PAIRING_PUBLIC_KEY;
2171                 //
2172                 reverse_256(&ec_q[0],  &buffer[1]);
2173                 reverse_256(&ec_q[32], &buffer[33]);
2174 
2175                 // stk generation method
2176                 // passkey entry: notify app to show passkey or to request passkey
2177                 switch (setup->sm_stk_generation_method){
2178                     case JUST_WORKS:
2179                     case NUMERIC_COMPARISON:
2180                         if (IS_RESPONDER(connection->sm_role)){
2181                             // responder
2182                             sm_sc_start_calculating_local_confirm(connection);
2183                         } else {
2184                             // initiator
2185                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2186                         }
2187                         break;
2188                     case PK_INIT_INPUT:
2189                     case PK_RESP_INPUT:
2190                     case PK_BOTH_INPUT:
2191                         // use random TK for display
2192                         memcpy(setup->sm_ra, setup->sm_tk, 16);
2193                         memcpy(setup->sm_rb, setup->sm_tk, 16);
2194                         setup->sm_passkey_bit = 0;
2195 
2196                         if (IS_RESPONDER(connection->sm_role)){
2197                             // responder
2198                             connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2199                         } else {
2200                             // initiator
2201                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2202                         }
2203                         trigger_user_response = 1;
2204                         break;
2205                     case OOB:
2206                         if (IS_RESPONDER(connection->sm_role)){
2207                             // responder
2208                             connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2209                         } else {
2210                             // initiator
2211                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2212                         }
2213                         break;
2214                 }
2215 
2216                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2217                 sm_timeout_reset(connection);
2218 
2219                 // trigger user response after sending pdu
2220                 if (trigger_user_response){
2221                     sm_trigger_user_response(connection);
2222                 }
2223                 break;
2224             }
2225             case SM_SC_SEND_CONFIRMATION: {
2226                 uint8_t buffer[17];
2227                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2228                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2229                 if (IS_RESPONDER(connection->sm_role)){
2230                     connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2231                 } else {
2232                     connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2233                 }
2234                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2235                 sm_timeout_reset(connection);
2236                 break;
2237             }
2238             case SM_SC_SEND_PAIRING_RANDOM: {
2239                 uint8_t buffer[17];
2240                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2241                 reverse_128(setup->sm_local_nonce, &buffer[1]);
2242                 log_info("stk method %u, num bits %u", setup->sm_stk_generation_method, setup->sm_passkey_bit);
2243                 if (sm_passkey_entry(setup->sm_stk_generation_method) && setup->sm_passkey_bit < 20){
2244                     log_info("SM_SC_SEND_PAIRING_RANDOM A");
2245                     if (IS_RESPONDER(connection->sm_role)){
2246                         // responder
2247                         connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2248                     } else {
2249                         // initiator
2250                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2251                     }
2252                 } else {
2253                     log_info("SM_SC_SEND_PAIRING_RANDOM B");
2254                     if (IS_RESPONDER(connection->sm_role)){
2255                         // responder
2256                         if (setup->sm_stk_generation_method == NUMERIC_COMPARISON){
2257                             log_info("SM_SC_SEND_PAIRING_RANDOM B1");
2258                             connection->sm_engine_state = SM_SC_W2_CALCULATE_G2;
2259                         } else {
2260                             log_info("SM_SC_SEND_PAIRING_RANDOM B2");
2261                             sm_sc_prepare_dhkey_check(connection);
2262                         }
2263                     } else {
2264                         // initiator
2265                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2266                     }
2267                 }
2268                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2269                 sm_timeout_reset(connection);
2270                 break;
2271             }
2272             case SM_SC_SEND_DHKEY_CHECK_COMMAND: {
2273                 uint8_t buffer[17];
2274                 buffer[0] = SM_CODE_PAIRING_DHKEY_CHECK;
2275                 reverse_128(setup->sm_local_dhkey_check, &buffer[1]);
2276 
2277                 if (IS_RESPONDER(connection->sm_role)){
2278                     connection->sm_engine_state = SM_SC_W4_LTK_REQUEST_SC;
2279                 } else {
2280                     connection->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
2281                 }
2282 
2283                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2284                 sm_timeout_reset(connection);
2285                 break;
2286             }
2287 
2288 #endif
2289 
2290 #ifdef ENABLE_LE_PERIPHERAL
2291             case SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE:
2292                 // echo initiator for now
2293                 sm_pairing_packet_set_code(setup->sm_s_pres,SM_CODE_PAIRING_RESPONSE);
2294                 key_distribution_flags = sm_key_distribution_flags_for_auth_req();
2295 
2296                 if (setup->sm_use_secure_connections){
2297                     connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2298                     // skip LTK/EDIV for SC
2299                     log_info("sm: dropping encryption information flag");
2300                     key_distribution_flags &= ~SM_KEYDIST_ENC_KEY;
2301                 } else {
2302                     connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_CONFIRM;
2303                 }
2304 
2305                 sm_pairing_packet_set_initiator_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_initiator_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2306                 sm_pairing_packet_set_responder_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2307                 // update key distribution after ENC was dropped
2308                 sm_setup_key_distribution(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
2309 
2310                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_s_pres, sizeof(sm_pairing_packet_t));
2311                 sm_timeout_reset(connection);
2312                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
2313                 if (!setup->sm_use_secure_connections || setup->sm_stk_generation_method == JUST_WORKS){
2314                     sm_trigger_user_response(connection);
2315                 }
2316                 return;
2317 #endif
2318 
2319             case SM_PH2_SEND_PAIRING_RANDOM: {
2320                 uint8_t buffer[17];
2321                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2322                 reverse_128(setup->sm_local_random, &buffer[1]);
2323                 if (IS_RESPONDER(connection->sm_role)){
2324                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_LTK_REQUEST;
2325                 } else {
2326                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_RANDOM;
2327                 }
2328                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2329                 sm_timeout_reset(connection);
2330                 break;
2331             }
2332 
2333             case SM_PH2_C1_GET_ENC_A:
2334                 // already busy?
2335                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2336                 // calculate confirm using aes128 engine - step 1
2337                 sm_c1_t1(setup->sm_local_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, sm_aes128_plaintext);
2338                 connection->sm_engine_state = SM_PH2_C1_W4_ENC_A;
2339                 sm_aes128_state = SM_AES128_ACTIVE;
2340                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, setup->sm_tk, sm_aes128_plaintext, sm_aes128_ciphertext, sm_handle_encryption_result_enc_a, connection);
2341                 break;
2342 
2343             case SM_PH2_C1_GET_ENC_C:
2344                 // already busy?
2345                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2346                 // calculate m_confirm using aes128 engine - step 1
2347                 sm_c1_t1(setup->sm_peer_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, sm_aes128_plaintext);
2348                 connection->sm_engine_state = SM_PH2_C1_W4_ENC_C;
2349                 sm_aes128_state = SM_AES128_ACTIVE;
2350                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, setup->sm_tk, sm_aes128_plaintext, sm_aes128_ciphertext, sm_handle_encryption_result_enc_c, connection);
2351                 break;
2352 
2353             case SM_PH2_CALC_STK:
2354                 // already busy?
2355                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2356                 // calculate STK
2357                 if (IS_RESPONDER(connection->sm_role)){
2358                     sm_s1_r_prime(setup->sm_local_random, setup->sm_peer_random, sm_aes128_plaintext);
2359                 } else {
2360                     sm_s1_r_prime(setup->sm_peer_random, setup->sm_local_random, sm_aes128_plaintext);
2361                 }
2362                 connection->sm_engine_state = SM_PH2_W4_STK;
2363                 sm_aes128_state = SM_AES128_ACTIVE;
2364                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, setup->sm_tk, sm_aes128_plaintext, setup->sm_ltk, sm_handle_encryption_result_enc_stk, connection);
2365                 break;
2366 
2367             case SM_PH3_Y_GET_ENC:
2368                 // already busy?
2369                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2370                 // PH3B2 - calculate Y from      - enc
2371                 // Y = dm(DHK, Rand)
2372                 sm_dm_r_prime(setup->sm_local_rand, sm_aes128_plaintext);
2373                 connection->sm_engine_state = SM_PH3_Y_W4_ENC;
2374                 sm_aes128_state = SM_AES128_ACTIVE;
2375                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_dhk, sm_aes128_plaintext, sm_aes128_ciphertext, sm_handle_encryption_result_enc_ph3_y, connection);
2376                 break;
2377 
2378             case SM_PH2_C1_SEND_PAIRING_CONFIRM: {
2379                 uint8_t buffer[17];
2380                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2381                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2382                 if (IS_RESPONDER(connection->sm_role)){
2383                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_PAIRING_RANDOM;
2384                 } else {
2385                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_CONFIRM;
2386                 }
2387                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2388                 sm_timeout_reset(connection);
2389                 return;
2390             }
2391 #ifdef ENABLE_LE_PERIPHERAL
2392             case SM_RESPONDER_PH2_SEND_LTK_REPLY: {
2393                 sm_key_t stk_flipped;
2394                 reverse_128(setup->sm_ltk, stk_flipped);
2395                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2396                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, stk_flipped);
2397                 return;
2398             }
2399             case SM_RESPONDER_PH4_SEND_LTK_REPLY: {
2400                 sm_key_t ltk_flipped;
2401                 reverse_128(setup->sm_ltk, ltk_flipped);
2402                 connection->sm_engine_state = SM_RESPONDER_IDLE;
2403                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, ltk_flipped);
2404                 sm_done_for_handle(connection->sm_handle);
2405                 return;
2406             }
2407             case SM_RESPONDER_PH4_Y_GET_ENC:
2408                 // already busy?
2409                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2410                 log_info("LTK Request: recalculating with ediv 0x%04x", setup->sm_local_ediv);
2411                 // Y = dm(DHK, Rand)
2412                 sm_dm_r_prime(setup->sm_local_rand, sm_aes128_plaintext);
2413                 connection->sm_engine_state = SM_RESPONDER_PH4_Y_W4_ENC;
2414                 sm_aes128_state = SM_AES128_ACTIVE;
2415                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_dhk, sm_aes128_plaintext, sm_aes128_ciphertext, sm_handle_encryption_result_enc_ph4_y, connection);
2416                 return;
2417 #endif
2418 #ifdef ENABLE_LE_CENTRAL
2419             case SM_INITIATOR_PH3_SEND_START_ENCRYPTION: {
2420                 sm_key_t stk_flipped;
2421                 reverse_128(setup->sm_ltk, stk_flipped);
2422                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2423                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle, 0, 0, 0, stk_flipped);
2424                 return;
2425             }
2426 #endif
2427 
2428             case SM_PH3_DISTRIBUTE_KEYS:
2429                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION){
2430                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
2431                     uint8_t buffer[17];
2432                     buffer[0] = SM_CODE_ENCRYPTION_INFORMATION;
2433                     reverse_128(setup->sm_ltk, &buffer[1]);
2434                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2435                     sm_timeout_reset(connection);
2436                     return;
2437                 }
2438                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_MASTER_IDENTIFICATION){
2439                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
2440                     uint8_t buffer[11];
2441                     buffer[0] = SM_CODE_MASTER_IDENTIFICATION;
2442                     little_endian_store_16(buffer, 1, setup->sm_local_ediv);
2443                     reverse_64(setup->sm_local_rand, &buffer[3]);
2444                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2445                     sm_timeout_reset(connection);
2446                     return;
2447                 }
2448                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
2449                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
2450                     uint8_t buffer[17];
2451                     buffer[0] = SM_CODE_IDENTITY_INFORMATION;
2452                     reverse_128(sm_persistent_irk, &buffer[1]);
2453                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2454                     sm_timeout_reset(connection);
2455                     return;
2456                 }
2457                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION){
2458                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
2459                     bd_addr_t local_address;
2460                     uint8_t buffer[8];
2461                     buffer[0] = SM_CODE_IDENTITY_ADDRESS_INFORMATION;
2462                     switch (gap_random_address_get_mode()){
2463                         case GAP_RANDOM_ADDRESS_TYPE_OFF:
2464                         case GAP_RANDOM_ADDRESS_TYPE_STATIC:
2465                             // public or static random
2466                             gap_le_get_own_address(&buffer[1], local_address);
2467                             break;
2468                         case GAP_RANDOM_ADDRESS_NON_RESOLVABLE:
2469                         case GAP_RANDOM_ADDRESS_RESOLVABLE:
2470                             // fallback to public
2471                             gap_local_bd_addr(local_address);
2472                             buffer[1] = 0;
2473                             break;
2474                     }
2475                     reverse_bd_addr(local_address, &buffer[2]);
2476                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2477                     sm_timeout_reset(connection);
2478                     return;
2479                 }
2480                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
2481                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
2482 
2483                     // hack to reproduce test runs
2484                     if (test_use_fixed_local_csrk){
2485                         memset(setup->sm_local_csrk, 0xcc, 16);
2486                     }
2487 
2488                     uint8_t buffer[17];
2489                     buffer[0] = SM_CODE_SIGNING_INFORMATION;
2490                     reverse_128(setup->sm_local_csrk, &buffer[1]);
2491                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2492                     sm_timeout_reset(connection);
2493                     return;
2494                 }
2495 
2496                 // keys are sent
2497                 if (IS_RESPONDER(connection->sm_role)){
2498                     // slave -> receive master keys if any
2499                     if (sm_key_distribution_all_received(connection)){
2500                         sm_key_distribution_handle_all_received(connection);
2501                         connection->sm_engine_state = SM_RESPONDER_IDLE;
2502                         sm_notify_client_status_reason(connection, ERROR_CODE_SUCCESS, 0);
2503                         sm_done_for_handle(connection->sm_handle);
2504                     } else {
2505                         connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2506                     }
2507                 } else {
2508                     // master -> all done
2509                     connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2510                     sm_notify_client_status_reason(connection, ERROR_CODE_SUCCESS, 0);
2511                     sm_done_for_handle(connection->sm_handle);
2512                 }
2513                 break;
2514 
2515             default:
2516                 break;
2517         }
2518 
2519         // check again if active connection was released
2520         if (sm_active_connection_handle != HCI_CON_HANDLE_INVALID) break;
2521     }
2522 }
2523 
2524 // sm_aes128_state stays active
2525 static void sm_handle_encryption_result_enc_a(void *arg){
2526     sm_connection_t * connection = (sm_connection_t*) arg;
2527     sm_c1_t3(sm_aes128_ciphertext, setup->sm_m_address, setup->sm_s_address, setup->sm_c1_t3_value);
2528     btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, setup->sm_tk, setup->sm_c1_t3_value, setup->sm_local_confirm, sm_handle_encryption_result_enc_b, connection);
2529 }
2530 
2531 static void sm_handle_encryption_result_enc_b(void *arg){
2532     sm_connection_t * connection = (sm_connection_t*) arg;
2533     sm_aes128_state = SM_AES128_IDLE;
2534     log_info_key("c1!", setup->sm_local_confirm);
2535     connection->sm_engine_state = SM_PH2_C1_SEND_PAIRING_CONFIRM;
2536     sm_run();
2537 }
2538 
2539 // sm_aes128_state stays active
2540 static void sm_handle_encryption_result_enc_c(void *arg){
2541     sm_connection_t * connection = (sm_connection_t*) arg;
2542     sm_c1_t3(sm_aes128_ciphertext, setup->sm_m_address, setup->sm_s_address, setup->sm_c1_t3_value);
2543     btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, setup->sm_tk, setup->sm_c1_t3_value, sm_aes128_ciphertext, sm_handle_encryption_result_enc_d, connection);
2544 }
2545 
2546 static void sm_handle_encryption_result_enc_d(void * arg){
2547     sm_connection_t * connection = (sm_connection_t*) arg;
2548     sm_aes128_state = SM_AES128_IDLE;
2549     log_info_key("c1!", sm_aes128_ciphertext);
2550     if (memcmp(setup->sm_peer_confirm, sm_aes128_ciphertext, 16) != 0){
2551         setup->sm_pairing_failed_reason = SM_REASON_CONFIRM_VALUE_FAILED;
2552         connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
2553         sm_run();
2554         return;
2555     }
2556     if (IS_RESPONDER(connection->sm_role)){
2557         connection->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
2558         sm_run();
2559     } else {
2560         sm_s1_r_prime(setup->sm_peer_random, setup->sm_local_random, sm_aes128_plaintext);
2561         sm_aes128_state = SM_AES128_ACTIVE;
2562         btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, setup->sm_tk, sm_aes128_plaintext, setup->sm_ltk, sm_handle_encryption_result_enc_stk, connection);
2563     }
2564 }
2565 
2566 static void sm_handle_encryption_result_enc_stk(void *arg){
2567     sm_connection_t * connection = (sm_connection_t*) arg;
2568     sm_aes128_state = SM_AES128_IDLE;
2569     sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2570     log_info_key("stk", setup->sm_ltk);
2571     if (IS_RESPONDER(connection->sm_role)){
2572         connection->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2573     } else {
2574         connection->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
2575     }
2576     sm_run();
2577 }
2578 
2579 // sm_aes128_state stays active
2580 static void sm_handle_encryption_result_enc_ph3_y(void *arg){
2581     sm_connection_t * connection = (sm_connection_t*) arg;
2582     setup->sm_local_y = big_endian_read_16(sm_aes128_ciphertext, 14);
2583     log_info_hex16("y", setup->sm_local_y);
2584     // PH3B3 - calculate EDIV
2585     setup->sm_local_ediv = setup->sm_local_y ^ setup->sm_local_div;
2586     log_info_hex16("ediv", setup->sm_local_ediv);
2587     // PH3B4 - calculate LTK         - enc
2588     // LTK = d1(ER, DIV, 0))
2589     sm_d1_d_prime(setup->sm_local_div, 0, sm_aes128_plaintext);
2590     btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_er, sm_aes128_plaintext, setup->sm_ltk, sm_handle_encryption_result_enc_ph3_ltk, connection);
2591 }
2592 
2593 // sm_aes128_state stays active
2594 static void sm_handle_encryption_result_enc_ph4_y(void *arg){
2595     sm_connection_t * connection = (sm_connection_t*) arg;
2596     setup->sm_local_y = big_endian_read_16(sm_aes128_ciphertext, 14);
2597     log_info_hex16("y", setup->sm_local_y);
2598 
2599     // PH3B3 - calculate DIV
2600     setup->sm_local_div = setup->sm_local_y ^ setup->sm_local_ediv;
2601     log_info_hex16("ediv", setup->sm_local_ediv);
2602     // PH3B4 - calculate LTK         - enc
2603     // LTK = d1(ER, DIV, 0))
2604     sm_d1_d_prime(setup->sm_local_div, 0, sm_aes128_plaintext);
2605     btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_er, sm_aes128_plaintext, setup->sm_ltk, sm_handle_encryption_result_enc_ph4_ltk, connection);
2606 }
2607 
2608 // sm_aes128_state stays active
2609 static void sm_handle_encryption_result_enc_ph3_ltk(void *arg){
2610     sm_connection_t * connection = (sm_connection_t*) arg;
2611     log_info_key("ltk", setup->sm_ltk);
2612     // calc CSRK next
2613     sm_d1_d_prime(setup->sm_local_div, 1, sm_aes128_plaintext);
2614     btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_er, sm_aes128_plaintext, setup->sm_local_csrk, sm_handle_encryption_result_enc_csrk, connection);
2615 }
2616 
2617 static void sm_handle_encryption_result_enc_csrk(void *arg){
2618     sm_connection_t * connection = (sm_connection_t*) arg;
2619     sm_aes128_state = SM_AES128_IDLE;
2620     log_info_key("csrk", setup->sm_local_csrk);
2621     if (setup->sm_key_distribution_send_set){
2622         connection->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
2623     } else {
2624         // no keys to send, just continue
2625         if (IS_RESPONDER(connection->sm_role)){
2626             // slave -> receive master keys
2627             connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2628         } else {
2629             if (setup->sm_use_secure_connections && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION)){
2630                 connection->sm_engine_state = SM_SC_W2_CALCULATE_H6_ILK;
2631             } else {
2632                 // master -> all done
2633                 connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2634                 sm_done_for_handle(connection->sm_handle);
2635             }
2636         }
2637     }
2638     sm_run();
2639 }
2640 
2641 #ifdef ENABLE_LE_PERIPHERAL
2642 static void sm_handle_encryption_result_enc_ph4_ltk(void *arg){
2643     sm_connection_t * connection = (sm_connection_t*) arg;
2644     sm_aes128_state = SM_AES128_IDLE;
2645     sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2646     log_info_key("ltk", setup->sm_ltk);
2647     connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK_REPLY;
2648     sm_run();
2649 }
2650 #endif
2651 
2652 static void sm_handle_encryption_result_address_resolution(void *arg){
2653     UNUSED(arg);
2654     sm_aes128_state = SM_AES128_IDLE;
2655     sm_address_resolution_ah_calculation_active = 0;
2656     // compare calulated address against connecting device
2657     uint8_t * hash = &sm_aes128_ciphertext[13];
2658     if (memcmp(&sm_address_resolution_address[3], hash, 3) == 0){
2659         log_info("LE Device Lookup: matched resolvable private address");
2660         sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
2661         sm_run();
2662         return;
2663     }
2664     // no match, try next
2665     sm_address_resolution_test++;
2666     sm_run();
2667 }
2668 
2669 static void sm_handle_encryption_result_dkg_irk(void *arg){
2670     UNUSED(arg);
2671     sm_aes128_state = SM_AES128_IDLE;
2672     log_info_key("irk", sm_persistent_irk);
2673     dkg_state = DKG_CALC_DHK;
2674     sm_run();
2675 }
2676 
2677 static void sm_handle_encryption_result_dkg_dhk(void *arg){
2678     UNUSED(arg);
2679     sm_aes128_state = SM_AES128_IDLE;
2680     log_info_key("dhk", sm_persistent_dhk);
2681     dkg_state = DKG_READY;
2682     // DKG calculation complete => SM Init Finished
2683     sm_run();
2684 }
2685 
2686 static void sm_handle_encryption_result_rau(void *arg){
2687     UNUSED(arg);
2688     sm_aes128_state = SM_AES128_IDLE;
2689     memcpy(&sm_random_address[3], &sm_aes128_ciphertext[13], 3);
2690     rau_state = RAU_SET_ADDRESS;
2691     sm_run();
2692 }
2693 
2694 static void sm_handle_random_result_rau(void * arg){
2695     UNUSED(arg);
2696     // non-resolvable vs. resolvable
2697     switch (gap_random_adress_type){
2698         case GAP_RANDOM_ADDRESS_RESOLVABLE:
2699             // resolvable: use random as prand and calc address hash
2700             // "The two most significant bits of prand shall be equal to ‘0’ and ‘1"
2701             sm_random_address[0] &= 0x3f;
2702             sm_random_address[0] |= 0x40;
2703             rau_state = RAU_GET_ENC;
2704             break;
2705         case GAP_RANDOM_ADDRESS_NON_RESOLVABLE:
2706         default:
2707             // "The two most significant bits of the address shall be equal to ‘0’""
2708             sm_random_address[0] &= 0x3f;
2709             rau_state = RAU_SET_ADDRESS;
2710             break;
2711     }
2712     sm_run();
2713 }
2714 
2715 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2716 static void sm_handle_random_result_sc_get_random(void * arg){
2717     sm_connection_t * connection = (sm_connection_t*) arg;
2718 
2719     // OOB
2720     if (setup->sm_stk_generation_method == OOB){
2721         connection->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
2722         sm_run();
2723         return;
2724     }
2725 
2726     // initiator & jw/nc -> send pairing random
2727     if (connection->sm_role == 0 && sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
2728         connection->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
2729     } else {
2730         connection->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
2731     }
2732     sm_run();
2733 }
2734 #endif
2735 
2736 static void sm_handle_random_result_ph2_random(void * arg){
2737     sm_connection_t * connection = (sm_connection_t*) arg;
2738     connection->sm_engine_state = SM_PH2_C1_GET_ENC_A;
2739     sm_run();
2740 }
2741 
2742 static void sm_handle_random_result_ph2_tk(void * arg){
2743     sm_connection_t * connection = (sm_connection_t*) arg;
2744     sm_reset_tk();
2745     uint32_t tk;
2746     if (sm_fixed_passkey_in_display_role == 0xffffffff){
2747         // map random to 0-999999 without speding much cycles on a modulus operation
2748         tk = little_endian_read_32(sm_random_data,0);
2749         tk = tk & 0xfffff;  // 1048575
2750         if (tk >= 999999){
2751             tk = tk - 999999;
2752         }
2753     } else {
2754         // override with pre-defined passkey
2755         tk = sm_fixed_passkey_in_display_role;
2756     }
2757     big_endian_store_32(setup->sm_tk, 12, tk);
2758     if (IS_RESPONDER(connection->sm_role)){
2759         connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
2760     } else {
2761         if (setup->sm_use_secure_connections){
2762             connection->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
2763         } else {
2764             connection->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
2765             sm_trigger_user_response(connection);
2766             // response_idle == nothing <--> sm_trigger_user_response() did not require response
2767             if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
2768                 btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_random, 16, &sm_handle_random_result_ph2_random, connection);
2769             }
2770         }
2771     }
2772     sm_run();
2773 }
2774 
2775 static void sm_handle_random_result_ph3_div(void * arg){
2776     sm_connection_t * connection = (sm_connection_t*) arg;
2777     // use 16 bit from random value as div
2778     setup->sm_local_div = big_endian_read_16(sm_random_data, 0);
2779     log_info_hex16("div", setup->sm_local_div);
2780     connection->sm_engine_state = SM_PH3_Y_GET_ENC;
2781     sm_run();
2782 }
2783 
2784 static void sm_handle_random_result_ph3_random(void * arg){
2785     sm_connection_t * connection = (sm_connection_t*) arg;
2786     reverse_64(sm_random_data, setup->sm_local_rand);
2787     // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
2788     setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xf0) + (connection->sm_actual_encryption_key_size - 1);
2789     // no db for authenticated flag hack: store flag in bit 4 of LSB
2790     setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xef) + (connection->sm_connection_authenticated << 4);
2791     btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 2, &sm_handle_random_result_ph3_div, connection);
2792 }
2793 
2794 static void sm_event_packet_handler (uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
2795 
2796     UNUSED(channel);    // ok: there is no channel
2797     UNUSED(size);       // ok: fixed format HCI events
2798 
2799     sm_connection_t  * sm_conn;
2800     hci_con_handle_t con_handle;
2801 
2802     switch (packet_type) {
2803 
2804 		case HCI_EVENT_PACKET:
2805 			switch (hci_event_packet_get_type(packet)) {
2806 
2807                 case BTSTACK_EVENT_STATE:
2808 					// bt stack activated, get started
2809 					if (btstack_event_state_get_state(packet) == HCI_STATE_WORKING){
2810                         log_info("HCI Working!");
2811 
2812                         dkg_state = sm_persistent_irk_ready ? DKG_CALC_DHK : DKG_CALC_IRK;
2813 
2814                         // trigger Random Address generation if requested before
2815                         switch (gap_random_adress_type){
2816                             case GAP_RANDOM_ADDRESS_TYPE_OFF:
2817                                 rau_state = RAU_IDLE;
2818                                 break;
2819                             case GAP_RANDOM_ADDRESS_TYPE_STATIC:
2820                                 rau_state = RAU_SET_ADDRESS;
2821                                 break;
2822                             default:
2823                                 rau_state = RAU_W4_RANDOM;
2824                                 btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_address, 8, &sm_handle_random_result_rau, NULL);
2825                                 break;
2826                         }
2827                         sm_run();
2828 					}
2829 					break;
2830 
2831                 case HCI_EVENT_LE_META:
2832                     switch (packet[2]) {
2833                         case HCI_SUBEVENT_LE_CONNECTION_COMPLETE:
2834 
2835                             log_info("sm: connected");
2836 
2837                             if (packet[3]) return; // connection failed
2838 
2839                             con_handle = little_endian_read_16(packet, 4);
2840                             sm_conn = sm_get_connection_for_handle(con_handle);
2841                             if (!sm_conn) break;
2842 
2843                             sm_conn->sm_handle = con_handle;
2844                             sm_conn->sm_role = packet[6];
2845                             sm_conn->sm_peer_addr_type = packet[7];
2846                             reverse_bd_addr(&packet[8], sm_conn->sm_peer_address);
2847 
2848                             log_info("New sm_conn, role %s", sm_conn->sm_role ? "slave" : "master");
2849 
2850                             // reset security properties
2851                             sm_conn->sm_connection_encrypted = 0;
2852                             sm_conn->sm_connection_authenticated = 0;
2853                             sm_conn->sm_connection_authorization_state = AUTHORIZATION_UNKNOWN;
2854                             sm_conn->sm_le_db_index = -1;
2855 
2856                             // prepare CSRK lookup (does not involve setup)
2857                             sm_conn->sm_irk_lookup_state = IRK_LOOKUP_W4_READY;
2858 
2859                             // just connected -> everything else happens in sm_run()
2860                             if (IS_RESPONDER(sm_conn->sm_role)){
2861                                 // slave - state already could be SM_RESPONDER_SEND_SECURITY_REQUEST instead
2862                                 if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
2863                                     if (sm_slave_request_security) {
2864                                         // request security if requested by app
2865                                         sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
2866                                     } else {
2867                                         // otherwise, wait for pairing request
2868                                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
2869                                     }
2870                                 }
2871                                 break;
2872                             } else {
2873                                 // master
2874                                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2875                             }
2876                             break;
2877 
2878                         case HCI_SUBEVENT_LE_LONG_TERM_KEY_REQUEST:
2879                             con_handle = little_endian_read_16(packet, 3);
2880                             sm_conn = sm_get_connection_for_handle(con_handle);
2881                             if (!sm_conn) break;
2882 
2883                             log_info("LTK Request: state %u", sm_conn->sm_engine_state);
2884                             if (sm_conn->sm_engine_state == SM_RESPONDER_PH2_W4_LTK_REQUEST){
2885                                 sm_conn->sm_engine_state = SM_PH2_CALC_STK;
2886                                 break;
2887                             }
2888                             if (sm_conn->sm_engine_state == SM_SC_W4_LTK_REQUEST_SC){
2889                                 // PH2 SEND LTK as we need to exchange keys in PH3
2890                                 sm_conn->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2891                                 break;
2892                             }
2893 
2894                             // store rand and ediv
2895                             reverse_64(&packet[5], sm_conn->sm_local_rand);
2896                             sm_conn->sm_local_ediv = little_endian_read_16(packet, 13);
2897 
2898                             // For Legacy Pairing (<=> EDIV != 0 || RAND != NULL), we need to recalculated our LTK as a
2899                             // potentially stored LTK is from the master
2900                             if (sm_conn->sm_local_ediv != 0 || !sm_is_null_random(sm_conn->sm_local_rand)){
2901                                 if (sm_reconstruct_ltk_without_le_device_db_entry){
2902                                     sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST;
2903                                     break;
2904                                 }
2905                                 // additionally check if remote is in LE Device DB if requested
2906                                 switch(sm_conn->sm_irk_lookup_state){
2907                                     case IRK_LOOKUP_FAILED:
2908                                         log_info("LTK Request: device not in device db");
2909                                         sm_conn->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
2910                                         break;
2911                                     case IRK_LOOKUP_SUCCEEDED:
2912                                         sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST;
2913                                         break;
2914                                     default:
2915                                         // wait for irk look doen
2916                                         sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK_W4_IRK;
2917                                         break;
2918                                 }
2919                                 break;
2920                             }
2921 
2922 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2923                             sm_conn->sm_engine_state = SM_SC_RECEIVED_LTK_REQUEST;
2924 #else
2925                             log_info("LTK Request: ediv & random are empty, but LE Secure Connections not supported");
2926                             sm_conn->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
2927 #endif
2928                             break;
2929 
2930                         default:
2931                             break;
2932                     }
2933                     break;
2934 
2935                 case HCI_EVENT_ENCRYPTION_CHANGE:
2936                     con_handle = little_endian_read_16(packet, 3);
2937                     sm_conn = sm_get_connection_for_handle(con_handle);
2938                     if (!sm_conn) break;
2939 
2940                     sm_conn->sm_connection_encrypted = packet[5];
2941                     log_info("Encryption state change: %u, key size %u", sm_conn->sm_connection_encrypted,
2942                         sm_conn->sm_actual_encryption_key_size);
2943                     log_info("event handler, state %u", sm_conn->sm_engine_state);
2944                     if (!sm_conn->sm_connection_encrypted) break;
2945                     // continue if part of initial pairing
2946                     switch (sm_conn->sm_engine_state){
2947                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
2948                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2949                             sm_done_for_handle(sm_conn->sm_handle);
2950                             break;
2951                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
2952                             if (IS_RESPONDER(sm_conn->sm_role)){
2953                                 // slave
2954                                 if (setup->sm_use_secure_connections){
2955                                     sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
2956                                 } else {
2957                                     btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 8, &sm_handle_random_result_ph3_random, sm_conn);
2958                                 }
2959                             } else {
2960                                 // master
2961                                 if (sm_key_distribution_all_received(sm_conn)){
2962                                     // skip receiving keys as there are none
2963                                     sm_key_distribution_handle_all_received(sm_conn);
2964                                     btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 8, &sm_handle_random_result_ph3_random, sm_conn);
2965                                 } else {
2966                                     sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2967                                 }
2968                             }
2969                             break;
2970                         default:
2971                             break;
2972                     }
2973                     break;
2974 
2975                 case HCI_EVENT_ENCRYPTION_KEY_REFRESH_COMPLETE:
2976                     con_handle = little_endian_read_16(packet, 3);
2977                     sm_conn = sm_get_connection_for_handle(con_handle);
2978                     if (!sm_conn) break;
2979 
2980                     log_info("Encryption key refresh complete, key size %u", sm_conn->sm_actual_encryption_key_size);
2981                     log_info("event handler, state %u", sm_conn->sm_engine_state);
2982                     // continue if part of initial pairing
2983                     switch (sm_conn->sm_engine_state){
2984                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
2985                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2986                             sm_done_for_handle(sm_conn->sm_handle);
2987                             break;
2988                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
2989                             if (IS_RESPONDER(sm_conn->sm_role)){
2990                                 // slave
2991                                 btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 8, &sm_handle_random_result_ph3_random, sm_conn);
2992                             } else {
2993                                 // master
2994                                 sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2995                             }
2996                             break;
2997                         default:
2998                             break;
2999                     }
3000                     break;
3001 
3002 
3003                 case HCI_EVENT_DISCONNECTION_COMPLETE:
3004                     con_handle = little_endian_read_16(packet, 3);
3005                     sm_done_for_handle(con_handle);
3006                     sm_conn = sm_get_connection_for_handle(con_handle);
3007                     if (!sm_conn) break;
3008 
3009                     // delete stored bonding on disconnect with authentication failure in ph0
3010                     if (sm_conn->sm_role == 0
3011                         && sm_conn->sm_engine_state == SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED
3012                         && packet[2] == ERROR_CODE_AUTHENTICATION_FAILURE){
3013                         le_device_db_remove(sm_conn->sm_le_db_index);
3014                     }
3015 
3016                     // pairing failed, if it was ongoing
3017                     if (sm_conn->sm_engine_state != SM_INITIATOR_CONNECTED && sm_conn->sm_engine_state != SM_GENERAL_IDLE){
3018                         sm_notify_client_status_reason(sm_conn, ERROR_CODE_REMOTE_USER_TERMINATED_CONNECTION, 0);
3019                     }
3020 
3021                     sm_conn->sm_engine_state = SM_GENERAL_IDLE;
3022                     sm_conn->sm_handle = 0;
3023                     break;
3024 
3025 				case HCI_EVENT_COMMAND_COMPLETE:
3026                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_read_bd_addr)){
3027                         // set local addr for le device db
3028                         bd_addr_t addr;
3029                         reverse_bd_addr(&packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE + 1], addr);
3030                         le_device_db_set_local_bd_addr(addr);
3031                     }
3032                     break;
3033                 default:
3034                     break;
3035 			}
3036             break;
3037         default:
3038             break;
3039 	}
3040 
3041     sm_run();
3042 }
3043 
3044 static inline int sm_calc_actual_encryption_key_size(int other){
3045     if (other < sm_min_encryption_key_size) return 0;
3046     if (other < sm_max_encryption_key_size) return other;
3047     return sm_max_encryption_key_size;
3048 }
3049 
3050 
3051 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3052 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method){
3053     switch (method){
3054         case JUST_WORKS:
3055         case NUMERIC_COMPARISON:
3056             return 1;
3057         default:
3058             return 0;
3059     }
3060 }
3061 // responder
3062 
3063 static int sm_passkey_used(stk_generation_method_t method){
3064     switch (method){
3065         case PK_RESP_INPUT:
3066             return 1;
3067         default:
3068             return 0;
3069     }
3070 }
3071 
3072 static int sm_passkey_entry(stk_generation_method_t method){
3073     switch (method){
3074         case PK_RESP_INPUT:
3075         case PK_INIT_INPUT:
3076         case PK_BOTH_INPUT:
3077             return 1;
3078         default:
3079             return 0;
3080     }
3081 }
3082 
3083 #endif
3084 
3085 /**
3086  * @return ok
3087  */
3088 static int sm_validate_stk_generation_method(void){
3089     // check if STK generation method is acceptable by client
3090     switch (setup->sm_stk_generation_method){
3091         case JUST_WORKS:
3092             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_JUST_WORKS) != 0;
3093         case PK_RESP_INPUT:
3094         case PK_INIT_INPUT:
3095         case PK_BOTH_INPUT:
3096             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_PASSKEY) != 0;
3097         case OOB:
3098             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_OOB) != 0;
3099         case NUMERIC_COMPARISON:
3100             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON) != 0;
3101             return 1;
3102         default:
3103             return 0;
3104     }
3105 }
3106 
3107 // size of complete sm_pdu used to validate input
3108 static const uint8_t sm_pdu_size[] = {
3109     0,  // 0x00 invalid opcode
3110     7,  // 0x01 pairing request
3111     7,  // 0x02 pairing response
3112     17, // 0x03 pairing confirm
3113     17, // 0x04 pairing random
3114     2,  // 0x05 pairing failed
3115     17, // 0x06 encryption information
3116     11, // 0x07 master identification
3117     17, // 0x08 identification information
3118     8,  // 0x09 identify address information
3119     17, // 0x0a signing information
3120     2,  // 0x0b security request
3121     65, // 0x0c pairing public key
3122     17, // 0x0d pairing dhk check
3123     2,  // 0x0e keypress notification
3124 };
3125 
3126 static void sm_pdu_handler(uint8_t packet_type, hci_con_handle_t con_handle, uint8_t *packet, uint16_t size){
3127 
3128     if (packet_type == HCI_EVENT_PACKET && packet[0] == L2CAP_EVENT_CAN_SEND_NOW){
3129         sm_run();
3130     }
3131 
3132     if (packet_type != SM_DATA_PACKET) return;
3133     if (size == 0) return;
3134 
3135     uint8_t sm_pdu_code = packet[0];
3136 
3137     // validate pdu size
3138     if (sm_pdu_code >= sizeof(sm_pdu_size)) return;
3139     if (sm_pdu_size[sm_pdu_code] != size)   return;
3140 
3141     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3142     if (!sm_conn) return;
3143 
3144     if (sm_pdu_code == SM_CODE_PAIRING_FAILED){
3145         sm_notify_client_status_reason(sm_conn, ERROR_CODE_AUTHENTICATION_FAILURE, packet[1]);
3146         sm_done_for_handle(con_handle);
3147         sm_conn->sm_engine_state = sm_conn->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
3148         return;
3149     }
3150 
3151     log_debug("sm_pdu_handler: state %u, pdu 0x%02x", sm_conn->sm_engine_state, sm_pdu_code);
3152 
3153     int err;
3154     UNUSED(err);
3155 
3156     if (sm_pdu_code == SM_CODE_KEYPRESS_NOTIFICATION){
3157         uint8_t buffer[5];
3158         buffer[0] = SM_EVENT_KEYPRESS_NOTIFICATION;
3159         buffer[1] = 3;
3160         little_endian_store_16(buffer, 2, con_handle);
3161         buffer[4] = packet[1];
3162         sm_dispatch_event(HCI_EVENT_PACKET, 0, buffer, sizeof(buffer));
3163         return;
3164     }
3165 
3166     switch (sm_conn->sm_engine_state){
3167 
3168         // a sm timeout requries a new physical connection
3169         case SM_GENERAL_TIMEOUT:
3170             return;
3171 
3172 #ifdef ENABLE_LE_CENTRAL
3173 
3174         // Initiator
3175         case SM_INITIATOR_CONNECTED:
3176             if ((sm_pdu_code != SM_CODE_SECURITY_REQUEST) || (sm_conn->sm_role)){
3177                 sm_pdu_received_in_wrong_state(sm_conn);
3178                 break;
3179             }
3180             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_FAILED){
3181                 sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3182                 break;
3183             }
3184             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_SUCCEEDED){
3185                 sm_key_t ltk;
3186                 le_device_db_encryption_get(sm_conn->sm_le_db_index, NULL, NULL, ltk, NULL, NULL, NULL);
3187                 if (!sm_is_null_key(ltk)){
3188                     log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3189                     sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3190                 } else {
3191                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3192                 }
3193                 break;
3194             }
3195             // otherwise, store security request
3196             sm_conn->sm_security_request_received = 1;
3197             break;
3198 
3199         case SM_INITIATOR_PH1_W4_PAIRING_RESPONSE:
3200             if (sm_pdu_code != SM_CODE_PAIRING_RESPONSE){
3201                 sm_pdu_received_in_wrong_state(sm_conn);
3202                 break;
3203             }
3204 
3205             // store pairing request
3206             memcpy(&setup->sm_s_pres, packet, sizeof(sm_pairing_packet_t));
3207             err = sm_stk_generation_init(sm_conn);
3208 
3209 #ifdef ENABLE_TESTING_SUPPORT
3210             if (0 < test_pairing_failure && test_pairing_failure < SM_REASON_DHKEY_CHECK_FAILED){
3211                 log_info("testing_support: abort with pairing failure %u", test_pairing_failure);
3212                 err = test_pairing_failure;
3213             }
3214 #endif
3215 
3216             if (err){
3217                 setup->sm_pairing_failed_reason = err;
3218                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3219                 break;
3220             }
3221 
3222             // generate random number first, if we need to show passkey
3223             if (setup->sm_stk_generation_method == PK_RESP_INPUT){
3224                 btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 8, &sm_handle_random_result_ph2_tk, sm_conn);
3225                 break;
3226             }
3227 
3228 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3229             if (setup->sm_use_secure_connections){
3230                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
3231                 if (setup->sm_stk_generation_method == JUST_WORKS){
3232                     sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3233                     sm_trigger_user_response(sm_conn);
3234                     if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3235                         sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3236                     }
3237                 } else {
3238                     sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3239                 }
3240                 break;
3241             }
3242 #endif
3243             sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3244             sm_trigger_user_response(sm_conn);
3245             // response_idle == nothing <--> sm_trigger_user_response() did not require response
3246             if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3247                 btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_random, 16, &sm_handle_random_result_ph2_random, sm_conn);
3248             }
3249             break;
3250 
3251         case SM_INITIATOR_PH2_W4_PAIRING_CONFIRM:
3252             if (sm_pdu_code != SM_CODE_PAIRING_CONFIRM){
3253                 sm_pdu_received_in_wrong_state(sm_conn);
3254                 break;
3255             }
3256 
3257             // store s_confirm
3258             reverse_128(&packet[1], setup->sm_peer_confirm);
3259 
3260 #ifdef ENABLE_TESTING_SUPPORT
3261             if (test_pairing_failure == SM_REASON_CONFIRM_VALUE_FAILED){
3262                 log_info("testing_support: reset confirm value");
3263                 memset(setup->sm_peer_confirm, 0, 16);
3264             }
3265 #endif
3266             sm_conn->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
3267             break;
3268 
3269         case SM_INITIATOR_PH2_W4_PAIRING_RANDOM:
3270             if (sm_pdu_code != SM_CODE_PAIRING_RANDOM){
3271                 sm_pdu_received_in_wrong_state(sm_conn);
3272                 break;;
3273             }
3274 
3275             // received random value
3276             reverse_128(&packet[1], setup->sm_peer_random);
3277             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3278             break;
3279 #endif
3280 
3281 #ifdef ENABLE_LE_PERIPHERAL
3282         // Responder
3283         case SM_RESPONDER_IDLE:
3284         case SM_RESPONDER_SEND_SECURITY_REQUEST:
3285         case SM_RESPONDER_PH1_W4_PAIRING_REQUEST:
3286             if (sm_pdu_code != SM_CODE_PAIRING_REQUEST){
3287                 sm_pdu_received_in_wrong_state(sm_conn);
3288                 break;;
3289             }
3290 
3291             // store pairing request
3292             memcpy(&sm_conn->sm_m_preq, packet, sizeof(sm_pairing_packet_t));
3293             sm_conn->sm_engine_state = SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED;
3294             break;
3295 #endif
3296 
3297 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3298         case SM_SC_W4_PUBLIC_KEY_COMMAND:
3299             if (sm_pdu_code != SM_CODE_PAIRING_PUBLIC_KEY){
3300                 sm_pdu_received_in_wrong_state(sm_conn);
3301                 break;
3302             }
3303 
3304             // store public key for DH Key calculation
3305             reverse_256(&packet[01], &setup->sm_peer_q[0]);
3306             reverse_256(&packet[33], &setup->sm_peer_q[32]);
3307 
3308             // validate public key
3309             err = btstack_crypto_ecc_p256_validate_public_key(setup->sm_peer_q);
3310             if (err){
3311                 log_error("sm: peer public key invalid %x", err);
3312                 // uses "unspecified reason", there is no "public key invalid" error code
3313                 sm_pdu_received_in_wrong_state(sm_conn);
3314                 break;
3315             }
3316 
3317             // start calculating dhkey
3318             btstack_crypto_ecc_p256_calculate_dhkey(&sm_crypto_ecc_p256_request, setup->sm_peer_q, setup->sm_dhkey, sm_sc_dhkey_calculated, sm_conn);
3319 
3320 
3321             log_info("public key received, generation method %u", setup->sm_stk_generation_method);
3322             if (IS_RESPONDER(sm_conn->sm_role)){
3323                 // responder
3324                 sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3325             } else {
3326                 // initiator
3327                 // stk generation method
3328                 // passkey entry: notify app to show passkey or to request passkey
3329                 switch (setup->sm_stk_generation_method){
3330                     case JUST_WORKS:
3331                     case NUMERIC_COMPARISON:
3332                         sm_conn->sm_engine_state = SM_SC_W4_CONFIRMATION;
3333                         break;
3334                     case PK_RESP_INPUT:
3335                         sm_sc_start_calculating_local_confirm(sm_conn);
3336                         break;
3337                     case PK_INIT_INPUT:
3338                     case PK_BOTH_INPUT:
3339                         if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3340                             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3341                             break;
3342                         }
3343                         sm_sc_start_calculating_local_confirm(sm_conn);
3344                         break;
3345                     case OOB:
3346                         // generate Nx
3347                         log_info("Generate Na");
3348                         btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_nonce, 16, &sm_handle_random_result_sc_get_random, sm_conn);
3349                         break;
3350                 }
3351             }
3352             break;
3353 
3354         case SM_SC_W4_CONFIRMATION:
3355             if (sm_pdu_code != SM_CODE_PAIRING_CONFIRM){
3356                 sm_pdu_received_in_wrong_state(sm_conn);
3357                 break;
3358             }
3359             // received confirm value
3360             reverse_128(&packet[1], setup->sm_peer_confirm);
3361 
3362 #ifdef ENABLE_TESTING_SUPPORT
3363             if (test_pairing_failure == SM_REASON_CONFIRM_VALUE_FAILED){
3364                 log_info("testing_support: reset confirm value");
3365                 memset(setup->sm_peer_confirm, 0, 16);
3366             }
3367 #endif
3368             if (IS_RESPONDER(sm_conn->sm_role)){
3369                 // responder
3370                 if (sm_passkey_used(setup->sm_stk_generation_method)){
3371                     if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3372                         // still waiting for passkey
3373                         sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3374                         break;
3375                     }
3376                 }
3377                 sm_sc_start_calculating_local_confirm(sm_conn);
3378             } else {
3379                 // initiator
3380                 if (sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
3381                     // sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
3382                     btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_nonce, 16, &sm_handle_random_result_sc_get_random, sm_conn);
3383                 } else {
3384                     sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
3385                 }
3386             }
3387             break;
3388 
3389         case SM_SC_W4_PAIRING_RANDOM:
3390             if (sm_pdu_code != SM_CODE_PAIRING_RANDOM){
3391                 sm_pdu_received_in_wrong_state(sm_conn);
3392                 break;
3393             }
3394 
3395             // received random value
3396             reverse_128(&packet[1], setup->sm_peer_nonce);
3397 
3398             // validate confirm value if Cb = f4(Pkb, Pka, Nb, z)
3399             // only check for JUST WORK/NC in initiator role OR passkey entry
3400             if ( (!IS_RESPONDER(sm_conn->sm_role) && sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method))
3401             ||   (sm_passkey_used(setup->sm_stk_generation_method)) ) {
3402                  sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION;
3403                  break;
3404             }
3405 
3406             // OOB
3407             if (setup->sm_stk_generation_method == OOB){
3408 
3409                 // setup local random, set to zero if remote did not receive our data
3410                 log_info("Received nonce, setup local random ra/rb for dhkey check");
3411                 if (IS_RESPONDER(sm_conn->sm_role)){
3412                     if (sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq) == 0){
3413                         log_info("Reset rb as A does not have OOB data");
3414                         memset(setup->sm_rb, 0, 16);
3415                     } else {
3416                         memcpy(setup->sm_rb, sm_sc_oob_random, 16);
3417                         log_info("Use stored rb");
3418                         log_info_hexdump(setup->sm_rb, 16);
3419                     }
3420                 }  else {
3421                     if (sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres) == 0){
3422                         log_info("Reset ra as B does not have OOB data");
3423                         memset(setup->sm_ra, 0, 16);
3424                     } else {
3425                         memcpy(setup->sm_ra, sm_sc_oob_random, 16);
3426                         log_info("Use stored ra");
3427                         log_info_hexdump(setup->sm_ra, 16);
3428                     }
3429                 }
3430 
3431                 // validate confirm value if Cb = f4(PKb, Pkb, rb, 0) for OOB if data received
3432                 if (setup->sm_have_oob_data){
3433                      sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION;
3434                      break;
3435                 }
3436             }
3437 
3438             // TODO: we only get here for Responder role with JW/NC
3439             sm_sc_state_after_receiving_random(sm_conn);
3440             break;
3441 
3442         case SM_SC_W2_CALCULATE_G2:
3443         case SM_SC_W4_CALCULATE_G2:
3444         case SM_SC_W4_CALCULATE_DHKEY:
3445         case SM_SC_W2_CALCULATE_F5_SALT:
3446         case SM_SC_W4_CALCULATE_F5_SALT:
3447         case SM_SC_W2_CALCULATE_F5_MACKEY:
3448         case SM_SC_W4_CALCULATE_F5_MACKEY:
3449         case SM_SC_W2_CALCULATE_F5_LTK:
3450         case SM_SC_W4_CALCULATE_F5_LTK:
3451         case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
3452         case SM_SC_W4_DHKEY_CHECK_COMMAND:
3453         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
3454             if (sm_pdu_code != SM_CODE_PAIRING_DHKEY_CHECK){
3455                 sm_pdu_received_in_wrong_state(sm_conn);
3456                 break;
3457             }
3458             // store DHKey Check
3459             setup->sm_state_vars |= SM_STATE_VAR_DHKEY_COMMAND_RECEIVED;
3460             reverse_128(&packet[01], setup->sm_peer_dhkey_check);
3461 
3462             // have we been only waiting for dhkey check command?
3463             if (sm_conn->sm_engine_state == SM_SC_W4_DHKEY_CHECK_COMMAND){
3464                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
3465             }
3466             break;
3467 #endif
3468 
3469 #ifdef ENABLE_LE_PERIPHERAL
3470         case SM_RESPONDER_PH1_W4_PAIRING_CONFIRM:
3471             if (sm_pdu_code != SM_CODE_PAIRING_CONFIRM){
3472                 sm_pdu_received_in_wrong_state(sm_conn);
3473                 break;
3474             }
3475 
3476             // received confirm value
3477             reverse_128(&packet[1], setup->sm_peer_confirm);
3478 
3479 #ifdef ENABLE_TESTING_SUPPORT
3480             if (test_pairing_failure == SM_REASON_CONFIRM_VALUE_FAILED){
3481                 log_info("testing_support: reset confirm value");
3482                 memset(setup->sm_peer_confirm, 0, 16);
3483             }
3484 #endif
3485             // notify client to hide shown passkey
3486             if (setup->sm_stk_generation_method == PK_INIT_INPUT){
3487                 sm_notify_client_base(SM_EVENT_PASSKEY_DISPLAY_CANCEL, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
3488             }
3489 
3490             // handle user cancel pairing?
3491             if (setup->sm_user_response == SM_USER_RESPONSE_DECLINE){
3492                 setup->sm_pairing_failed_reason = SM_REASON_PASSKEY_ENTRY_FAILED;
3493                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3494                 break;
3495             }
3496 
3497             // wait for user action?
3498             if (setup->sm_user_response == SM_USER_RESPONSE_PENDING){
3499                 sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3500                 break;
3501             }
3502 
3503             // calculate and send local_confirm
3504             btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_random, 16, &sm_handle_random_result_ph2_random, sm_conn);
3505             break;
3506 
3507         case SM_RESPONDER_PH2_W4_PAIRING_RANDOM:
3508             if (sm_pdu_code != SM_CODE_PAIRING_RANDOM){
3509                 sm_pdu_received_in_wrong_state(sm_conn);
3510                 break;;
3511             }
3512 
3513             // received random value
3514             reverse_128(&packet[1], setup->sm_peer_random);
3515             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3516             break;
3517 #endif
3518 
3519         case SM_PH3_RECEIVE_KEYS:
3520             switch(sm_pdu_code){
3521                 case SM_CODE_ENCRYPTION_INFORMATION:
3522                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
3523                     reverse_128(&packet[1], setup->sm_peer_ltk);
3524                     break;
3525 
3526                 case SM_CODE_MASTER_IDENTIFICATION:
3527                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
3528                     setup->sm_peer_ediv = little_endian_read_16(packet, 1);
3529                     reverse_64(&packet[3], setup->sm_peer_rand);
3530                     break;
3531 
3532                 case SM_CODE_IDENTITY_INFORMATION:
3533                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
3534                     reverse_128(&packet[1], setup->sm_peer_irk);
3535                     break;
3536 
3537                 case SM_CODE_IDENTITY_ADDRESS_INFORMATION:
3538                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
3539                     setup->sm_peer_addr_type = packet[1];
3540                     reverse_bd_addr(&packet[2], setup->sm_peer_address);
3541                     break;
3542 
3543                 case SM_CODE_SIGNING_INFORMATION:
3544                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
3545                     reverse_128(&packet[1], setup->sm_peer_csrk);
3546                     break;
3547                 default:
3548                     // Unexpected PDU
3549                     log_info("Unexpected PDU %u in SM_PH3_RECEIVE_KEYS", packet[0]);
3550                     break;
3551             }
3552             // done with key distribution?
3553             if (sm_key_distribution_all_received(sm_conn)){
3554 
3555                 sm_key_distribution_handle_all_received(sm_conn);
3556 
3557                 if (IS_RESPONDER(sm_conn->sm_role)){
3558                     if (setup->sm_use_secure_connections && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION)){
3559                         sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_H6_ILK;
3560                     } else {
3561                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
3562                         sm_notify_client_status_reason(sm_conn, ERROR_CODE_SUCCESS, 0);
3563                         sm_done_for_handle(sm_conn->sm_handle);
3564                     }
3565                 } else {
3566                     if (setup->sm_use_secure_connections){
3567                         sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
3568                     } else {
3569                         btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 8, &sm_handle_random_result_ph3_random, sm_conn);
3570                     }
3571                 }
3572             }
3573             break;
3574         default:
3575             // Unexpected PDU
3576             log_info("Unexpected PDU %u in state %u", packet[0], sm_conn->sm_engine_state);
3577             break;
3578     }
3579 
3580     // try to send preparared packet
3581     sm_run();
3582 }
3583 
3584 // Security Manager Client API
3585 void sm_register_oob_data_callback( int (*get_oob_data_callback)(uint8_t address_type, bd_addr_t addr, uint8_t * oob_data)){
3586     sm_get_oob_data = get_oob_data_callback;
3587 }
3588 
3589 void sm_register_sc_oob_data_callback( int (*get_sc_oob_data_callback)(uint8_t address_type, bd_addr_t addr, uint8_t * oob_sc_peer_confirm, uint8_t * oob_sc_peer_random)){
3590     sm_get_sc_oob_data = get_sc_oob_data_callback;
3591 }
3592 
3593 void sm_add_event_handler(btstack_packet_callback_registration_t * callback_handler){
3594     btstack_linked_list_add_tail(&sm_event_handlers, (btstack_linked_item_t*) callback_handler);
3595 }
3596 
3597 void sm_set_accepted_stk_generation_methods(uint8_t accepted_stk_generation_methods){
3598     sm_accepted_stk_generation_methods = accepted_stk_generation_methods;
3599 }
3600 
3601 void sm_set_encryption_key_size_range(uint8_t min_size, uint8_t max_size){
3602 	sm_min_encryption_key_size = min_size;
3603 	sm_max_encryption_key_size = max_size;
3604 }
3605 
3606 void sm_set_authentication_requirements(uint8_t auth_req){
3607 #ifndef ENABLE_LE_SECURE_CONNECTIONS
3608     if (auth_req & SM_AUTHREQ_SECURE_CONNECTION){
3609         log_error("ENABLE_LE_SECURE_CONNECTIONS not defined, but requested by app. Dropping SC flag");
3610         auth_req &= ~SM_AUTHREQ_SECURE_CONNECTION;
3611     }
3612 #endif
3613     sm_auth_req = auth_req;
3614 }
3615 
3616 void sm_set_io_capabilities(io_capability_t io_capability){
3617     sm_io_capabilities = io_capability;
3618 }
3619 
3620 #ifdef ENABLE_LE_PERIPHERAL
3621 void sm_set_request_security(int enable){
3622     sm_slave_request_security = enable;
3623 }
3624 #endif
3625 
3626 void sm_set_er(sm_key_t er){
3627     memcpy(sm_persistent_er, er, 16);
3628 }
3629 
3630 void sm_set_ir(sm_key_t ir){
3631     memcpy(sm_persistent_ir, ir, 16);
3632 }
3633 
3634 // Testing support only
3635 void sm_test_set_irk(sm_key_t irk){
3636     memcpy(sm_persistent_irk, irk, 16);
3637     sm_persistent_irk_ready = 1;
3638 }
3639 
3640 void sm_test_use_fixed_local_csrk(void){
3641     test_use_fixed_local_csrk = 1;
3642 }
3643 
3644 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3645 static void sm_ec_generated(void * arg){
3646     UNUSED(arg);
3647     ec_key_generation_state = EC_KEY_GENERATION_DONE;
3648 }
3649 #endif
3650 
3651 #ifdef ENABLE_TESTING_SUPPORT
3652 void sm_test_set_pairing_failure(int reason){
3653     test_pairing_failure = reason;
3654 }
3655 #endif
3656 
3657 void sm_init(void){
3658     // set some (BTstack default) ER and IR
3659     int i;
3660     sm_key_t er;
3661     sm_key_t ir;
3662     for (i=0;i<16;i++){
3663         er[i] = 0x30 + i;
3664         ir[i] = 0x90 + i;
3665     }
3666     sm_set_er(er);
3667     sm_set_ir(ir);
3668     // defaults
3669     sm_accepted_stk_generation_methods = SM_STK_GENERATION_METHOD_JUST_WORKS
3670                                        | SM_STK_GENERATION_METHOD_OOB
3671                                        | SM_STK_GENERATION_METHOD_PASSKEY
3672                                        | SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON;
3673 
3674     sm_max_encryption_key_size = 16;
3675     sm_min_encryption_key_size = 7;
3676 
3677     sm_fixed_passkey_in_display_role = 0xffffffff;
3678     sm_reconstruct_ltk_without_le_device_db_entry = 1;
3679 
3680 #ifdef USE_CMAC_ENGINE
3681     sm_cmac_active  = 0;
3682 #endif
3683     dkg_state = DKG_W4_WORKING;
3684     rau_state = RAU_W4_WORKING;
3685     sm_aes128_state = SM_AES128_IDLE;
3686     sm_address_resolution_test = -1;    // no private address to resolve yet
3687     sm_address_resolution_ah_calculation_active = 0;
3688     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
3689     sm_address_resolution_general_queue = NULL;
3690 
3691     gap_random_adress_update_period = 15 * 60 * 1000L;
3692     sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
3693 
3694     test_use_fixed_local_csrk = 0;
3695 
3696     // register for HCI Events from HCI
3697     hci_event_callback_registration.callback = &sm_event_packet_handler;
3698     hci_add_event_handler(&hci_event_callback_registration);
3699 
3700     //
3701     btstack_crypto_init();
3702 
3703     // and L2CAP PDUs + L2CAP_EVENT_CAN_SEND_NOW
3704     l2cap_register_fixed_channel(sm_pdu_handler, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
3705 
3706 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3707     ec_key_generation_state = EC_KEY_GENERATION_ACTIVE;
3708     btstack_crypto_ecc_p256_generate_key(&sm_crypto_ecc_p256_request, ec_q, &sm_ec_generated, NULL);
3709 #endif
3710 }
3711 
3712 void sm_use_fixed_passkey_in_display_role(uint32_t passkey){
3713     sm_fixed_passkey_in_display_role = passkey;
3714 }
3715 
3716 void sm_allow_ltk_reconstruction_without_le_device_db_entry(int allow){
3717     sm_reconstruct_ltk_without_le_device_db_entry = allow;
3718 }
3719 
3720 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle){
3721     hci_connection_t * hci_con = hci_connection_for_handle(con_handle);
3722     if (!hci_con) return NULL;
3723     return &hci_con->sm_connection;
3724 }
3725 
3726 static void sm_send_security_request_for_connection(sm_connection_t * sm_conn){
3727     switch (sm_conn->sm_engine_state){
3728         case SM_GENERAL_IDLE:
3729         case SM_RESPONDER_IDLE:
3730             sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
3731             sm_run();
3732             break;
3733         default:
3734             break;
3735     }
3736 }
3737 
3738 /**
3739  * @brief Trigger Security Request
3740  */
3741 void sm_send_security_request(hci_con_handle_t con_handle){
3742     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3743     if (!sm_conn) return;
3744     sm_send_security_request_for_connection(sm_conn);
3745 }
3746 
3747 // request pairing
3748 void sm_request_pairing(hci_con_handle_t con_handle){
3749     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3750     if (!sm_conn) return;     // wrong connection
3751 
3752     log_info("sm_request_pairing in role %u, state %u", sm_conn->sm_role, sm_conn->sm_engine_state);
3753     if (IS_RESPONDER(sm_conn->sm_role)){
3754         sm_send_security_request_for_connection(sm_conn);
3755     } else {
3756         // used as a trigger to start central/master/initiator security procedures
3757         uint16_t ediv;
3758         sm_key_t ltk;
3759         if (sm_conn->sm_engine_state == SM_INITIATOR_CONNECTED){
3760             switch (sm_conn->sm_irk_lookup_state){
3761                 case IRK_LOOKUP_FAILED:
3762                     log_info("irk lookup failed, send pairing request");
3763                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3764                     break;
3765                 case IRK_LOOKUP_SUCCEEDED:
3766                         le_device_db_encryption_get(sm_conn->sm_le_db_index, &ediv, NULL, ltk, NULL, NULL, NULL);
3767                         if (!sm_is_null_key(ltk) || ediv){
3768                             log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3769                             sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3770                         } else {
3771                             sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3772                         }
3773                         break;
3774                 default:
3775                     log_info("irk lookup pending");
3776                     sm_conn->sm_pairing_requested = 1;
3777                     break;
3778             }
3779         } else if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
3780             sm_conn->sm_pairing_requested = 1;
3781         }
3782     }
3783     sm_run();
3784 }
3785 
3786 // called by client app on authorization request
3787 void sm_authorization_decline(hci_con_handle_t con_handle){
3788     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3789     if (!sm_conn) return;     // wrong connection
3790     sm_conn->sm_connection_authorization_state = AUTHORIZATION_DECLINED;
3791     sm_notify_client_status(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 0);
3792 }
3793 
3794 void sm_authorization_grant(hci_con_handle_t con_handle){
3795     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3796     if (!sm_conn) return;     // wrong connection
3797     sm_conn->sm_connection_authorization_state = AUTHORIZATION_GRANTED;
3798     sm_notify_client_status(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 1);
3799 }
3800 
3801 // GAP Bonding API
3802 
3803 void sm_bonding_decline(hci_con_handle_t con_handle){
3804     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3805     if (!sm_conn) return;     // wrong connection
3806     setup->sm_user_response = SM_USER_RESPONSE_DECLINE;
3807     log_info("decline, state %u", sm_conn->sm_engine_state);
3808     switch(sm_conn->sm_engine_state){
3809 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3810         case SM_SC_W4_USER_RESPONSE:
3811         case SM_SC_W4_CONFIRMATION:
3812         case SM_SC_W4_PUBLIC_KEY_COMMAND:
3813 #endif
3814         case SM_PH1_W4_USER_RESPONSE:
3815             switch (setup->sm_stk_generation_method){
3816                 case PK_RESP_INPUT:
3817                 case PK_INIT_INPUT:
3818                 case PK_BOTH_INPUT:
3819                     sm_pairing_error(sm_conn, SM_REASON_PASSKEY_ENTRY_FAILED);
3820                     break;
3821                 case NUMERIC_COMPARISON:
3822                     sm_pairing_error(sm_conn, SM_REASON_NUMERIC_COMPARISON_FAILED);
3823                     break;
3824                 case JUST_WORKS:
3825                 case OOB:
3826                     sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
3827                     break;
3828             }
3829             break;
3830         default:
3831             break;
3832     }
3833     sm_run();
3834 }
3835 
3836 void sm_just_works_confirm(hci_con_handle_t con_handle){
3837     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3838     if (!sm_conn) return;     // wrong connection
3839     setup->sm_user_response = SM_USER_RESPONSE_CONFIRM;
3840     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3841         if (setup->sm_use_secure_connections){
3842             sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3843         } else {
3844             btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_random, 16, &sm_handle_random_result_ph2_random, sm_conn);
3845         }
3846     }
3847 
3848 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3849     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
3850         sm_sc_prepare_dhkey_check(sm_conn);
3851     }
3852 #endif
3853 
3854     sm_run();
3855 }
3856 
3857 void sm_numeric_comparison_confirm(hci_con_handle_t con_handle){
3858     // for now, it's the same
3859     sm_just_works_confirm(con_handle);
3860 }
3861 
3862 void sm_passkey_input(hci_con_handle_t con_handle, uint32_t passkey){
3863     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3864     if (!sm_conn) return;     // wrong connection
3865     sm_reset_tk();
3866     big_endian_store_32(setup->sm_tk, 12, passkey);
3867     setup->sm_user_response = SM_USER_RESPONSE_PASSKEY;
3868     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3869         btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_random, 16, &sm_handle_random_result_ph2_random, sm_conn);
3870     }
3871 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3872     memcpy(setup->sm_ra, setup->sm_tk, 16);
3873     memcpy(setup->sm_rb, setup->sm_tk, 16);
3874     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
3875         sm_sc_start_calculating_local_confirm(sm_conn);
3876     }
3877 #endif
3878     sm_run();
3879 }
3880 
3881 void sm_keypress_notification(hci_con_handle_t con_handle, uint8_t action){
3882     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3883     if (!sm_conn) return;     // wrong connection
3884     if (action > SM_KEYPRESS_PASSKEY_ENTRY_COMPLETED) return;
3885     uint8_t num_actions = setup->sm_keypress_notification >> 5;
3886     uint8_t flags = setup->sm_keypress_notification & 0x1f;
3887     switch (action){
3888         case SM_KEYPRESS_PASSKEY_ENTRY_STARTED:
3889         case SM_KEYPRESS_PASSKEY_ENTRY_COMPLETED:
3890             flags |= (1 << action);
3891             break;
3892         case SM_KEYPRESS_PASSKEY_CLEARED:
3893             // clear counter, keypress & erased flags + set passkey cleared
3894             flags = (flags & 0x19) | (1 << SM_KEYPRESS_PASSKEY_CLEARED);
3895             break;
3896         case SM_KEYPRESS_PASSKEY_DIGIT_ENTERED:
3897             if (flags & (1 << SM_KEYPRESS_PASSKEY_DIGIT_ERASED)){
3898                 // erase actions queued
3899                 num_actions--;
3900                 if (num_actions == 0){
3901                     // clear counter, keypress & erased flags
3902                     flags &= 0x19;
3903                 }
3904                 break;
3905             }
3906             num_actions++;
3907             flags |= (1 << SM_KEYPRESS_PASSKEY_DIGIT_ENTERED);
3908             break;
3909         case SM_KEYPRESS_PASSKEY_DIGIT_ERASED:
3910             if (flags & (1 << SM_KEYPRESS_PASSKEY_DIGIT_ENTERED)){
3911                 // enter actions queued
3912                 num_actions--;
3913                 if (num_actions == 0){
3914                     // clear counter, keypress & erased flags
3915                     flags &= 0x19;
3916                 }
3917                 break;
3918             }
3919             num_actions++;
3920             flags |= (1 << SM_KEYPRESS_PASSKEY_DIGIT_ERASED);
3921             break;
3922         default:
3923             break;
3924     }
3925     setup->sm_keypress_notification = (num_actions << 5) | flags;
3926     sm_run();
3927 }
3928 
3929 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3930 static void sm_handle_random_result_oob(void * arg){
3931     UNUSED(arg);
3932     sm_sc_oob_state = SM_SC_OOB_W2_CALC_CONFIRM;
3933     sm_run();
3934 }
3935 uint8_t sm_generate_sc_oob_data(void (*callback)(const uint8_t * confirm_value, const uint8_t * random_value)){
3936     if (sm_sc_oob_state != SM_SC_OOB_IDLE) return ERROR_CODE_COMMAND_DISALLOWED;
3937     sm_sc_oob_callback = callback;
3938     sm_sc_oob_state = SM_SC_OOB_W4_RANDOM;
3939     btstack_crypto_random_generate(&sm_crypto_random_oob_request, sm_sc_oob_random, 16, &sm_handle_random_result_oob, NULL);
3940     return 0;
3941 }
3942 #endif
3943 
3944 /**
3945  * @brief Identify device in LE Device DB
3946  * @param handle
3947  * @returns index from le_device_db or -1 if not found/identified
3948  */
3949 int sm_le_device_index(hci_con_handle_t con_handle ){
3950     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3951     if (!sm_conn) return -1;
3952     return sm_conn->sm_le_db_index;
3953 }
3954 
3955 static int gap_random_address_type_requires_updates(void){
3956     if (gap_random_adress_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return 0;
3957     if (gap_random_adress_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return 0;
3958     return 1;
3959 }
3960 
3961 static uint8_t own_address_type(void){
3962     switch (gap_random_adress_type){
3963         case GAP_RANDOM_ADDRESS_TYPE_OFF:
3964             return BD_ADDR_TYPE_LE_PUBLIC;
3965         default:
3966             return BD_ADDR_TYPE_LE_RANDOM;
3967     }
3968 }
3969 
3970 // GAP LE API
3971 void gap_random_address_set_mode(gap_random_address_type_t random_address_type){
3972     gap_random_address_update_stop();
3973     gap_random_adress_type = random_address_type;
3974     hci_le_set_own_address_type(own_address_type());
3975     if (!gap_random_address_type_requires_updates()) return;
3976     gap_random_address_update_start();
3977     gap_random_address_trigger();
3978 }
3979 
3980 gap_random_address_type_t gap_random_address_get_mode(void){
3981     return gap_random_adress_type;
3982 }
3983 
3984 void gap_random_address_set_update_period(int period_ms){
3985     gap_random_adress_update_period = period_ms;
3986     if (!gap_random_address_type_requires_updates()) return;
3987     gap_random_address_update_stop();
3988     gap_random_address_update_start();
3989 }
3990 
3991 void gap_random_address_set(bd_addr_t addr){
3992     gap_random_address_set_mode(GAP_RANDOM_ADDRESS_TYPE_STATIC);
3993     memcpy(sm_random_address, addr, 6);
3994     if (rau_state == RAU_W4_WORKING) return;
3995     rau_state = RAU_SET_ADDRESS;
3996     sm_run();
3997 }
3998 
3999 #ifdef ENABLE_LE_PERIPHERAL
4000 /*
4001  * @brief Set Advertisement Paramters
4002  * @param adv_int_min
4003  * @param adv_int_max
4004  * @param adv_type
4005  * @param direct_address_type
4006  * @param direct_address
4007  * @param channel_map
4008  * @param filter_policy
4009  *
4010  * @note own_address_type is used from gap_random_address_set_mode
4011  */
4012 void gap_advertisements_set_params(uint16_t adv_int_min, uint16_t adv_int_max, uint8_t adv_type,
4013     uint8_t direct_address_typ, bd_addr_t direct_address, uint8_t channel_map, uint8_t filter_policy){
4014     hci_le_advertisements_set_params(adv_int_min, adv_int_max, adv_type,
4015         direct_address_typ, direct_address, channel_map, filter_policy);
4016 }
4017 #endif
4018