xref: /btstack/src/ble/sm.c (revision c7e2c1a542dadacc23cd62771be7147d28e1cb0f)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define __BTSTACK_FILE__ "sm.c"
39 
40 #include <stdio.h>
41 #include <string.h>
42 #include <inttypes.h>
43 
44 #include "ble/le_device_db.h"
45 #include "ble/core.h"
46 #include "ble/sm.h"
47 #include "bluetooth_company_id.h"
48 #include "btstack_crypto.h"
49 #include "btstack_debug.h"
50 #include "btstack_event.h"
51 #include "btstack_linked_list.h"
52 #include "btstack_memory.h"
53 #include "gap.h"
54 #include "hci.h"
55 #include "hci_dump.h"
56 #include "l2cap.h"
57 
58 #if !defined(ENABLE_LE_PERIPHERAL) && !defined(ENABLE_LE_CENTRAL)
59 #error "LE Security Manager used, but neither ENABLE_LE_PERIPHERAL nor ENABLE_LE_CENTRAL defined. Please add at least one to btstack_config.h."
60 #endif
61 
62 // assert SM Public Key can be sent/received
63 #ifdef ENABLE_LE_SECURE_CONNECTIONS
64 #if HCI_ACL_PAYLOAD_SIZE < 69
65 #error "HCI_ACL_PAYLOAD_SIZE must be at least 69 bytes when using LE Secure Conection. Please increase HCI_ACL_PAYLOAD_SIZE or disable ENABLE_LE_SECURE_CONNECTIONS"
66 #endif
67 #endif
68 
69 #if defined(ENABLE_LE_PERIPHERAL) && defined(ENABLE_LE_CENTRAL)
70 #define IS_RESPONDER(role) (role)
71 #else
72 #ifdef ENABLE_LE_CENTRAL
73 // only central - never responder (avoid 'unused variable' warnings)
74 #define IS_RESPONDER(role) (0 && role)
75 #else
76 // only peripheral - always responder (avoid 'unused variable' warnings)
77 #define IS_RESPONDER(role) (1 || role)
78 #endif
79 #endif
80 
81 #if defined(ENABLE_LE_SIGNED_WRITE) || defined(ENABLE_LE_SECURE_CONNECTIONS)
82 #define USE_CMAC_ENGINE
83 #endif
84 
85 //
86 // SM internal types and globals
87 //
88 
89 typedef enum {
90     DKG_W4_WORKING,
91     DKG_CALC_IRK,
92     DKG_CALC_DHK,
93     DKG_READY
94 } derived_key_generation_t;
95 
96 typedef enum {
97     RAU_W4_WORKING,
98     RAU_IDLE,
99     RAU_W4_RANDOM,
100     RAU_GET_ENC,
101     RAU_W4_ENC,
102     RAU_SET_ADDRESS,
103 } random_address_update_t;
104 
105 typedef enum {
106     CMAC_IDLE,
107     CMAC_CALC_SUBKEYS,
108     CMAC_W4_SUBKEYS,
109     CMAC_CALC_MI,
110     CMAC_W4_MI,
111     CMAC_CALC_MLAST,
112     CMAC_W4_MLAST
113 } cmac_state_t;
114 
115 typedef enum {
116     JUST_WORKS,
117     PK_RESP_INPUT,       // Initiator displays PK, responder inputs PK
118     PK_INIT_INPUT,       // Responder displays PK, initiator inputs PK
119     PK_BOTH_INPUT,       // Only input on both, both input PK
120     NUMERIC_COMPARISON,  // Only numerical compparison (yes/no) on on both sides
121     OOB                  // OOB available on one (SC) or both sides (legacy)
122 } stk_generation_method_t;
123 
124 typedef enum {
125     SM_USER_RESPONSE_IDLE,
126     SM_USER_RESPONSE_PENDING,
127     SM_USER_RESPONSE_CONFIRM,
128     SM_USER_RESPONSE_PASSKEY,
129     SM_USER_RESPONSE_DECLINE
130 } sm_user_response_t;
131 
132 typedef enum {
133     SM_AES128_IDLE,
134     SM_AES128_ACTIVE
135 } sm_aes128_state_t;
136 
137 typedef enum {
138     ADDRESS_RESOLUTION_IDLE,
139     ADDRESS_RESOLUTION_GENERAL,
140     ADDRESS_RESOLUTION_FOR_CONNECTION,
141 } address_resolution_mode_t;
142 
143 typedef enum {
144     ADDRESS_RESOLUTION_SUCEEDED,
145     ADDRESS_RESOLUTION_FAILED,
146 } address_resolution_event_t;
147 
148 typedef enum {
149     EC_KEY_GENERATION_ACTIVE,
150     EC_KEY_GENERATION_DONE,
151 } ec_key_generation_state_t;
152 
153 typedef enum {
154     SM_STATE_VAR_DHKEY_NEEDED = 1 << 0,
155     SM_STATE_VAR_DHKEY_CALCULATED = 1 << 1,
156     SM_STATE_VAR_DHKEY_COMMAND_RECEIVED = 1 << 2,
157 } sm_state_var_t;
158 
159 typedef enum {
160     SM_SC_OOB_IDLE,
161     SM_SC_OOB_W4_RANDOM,
162     SM_SC_OOB_W2_CALC_CONFIRM,
163     SM_SC_OOB_W4_CONFIRM,
164 } sm_sc_oob_state_t;
165 
166 typedef uint8_t sm_key24_t[3];
167 typedef uint8_t sm_key56_t[7];
168 typedef uint8_t sm_key256_t[32];
169 
170 //
171 // GLOBAL DATA
172 //
173 
174 static uint8_t test_use_fixed_local_csrk;
175 
176 #ifdef ENABLE_TESTING_SUPPORT
177 static uint8_t test_pairing_failure;
178 #endif
179 
180 // configuration
181 static uint8_t sm_accepted_stk_generation_methods;
182 static uint8_t sm_max_encryption_key_size;
183 static uint8_t sm_min_encryption_key_size;
184 static uint8_t sm_auth_req = 0;
185 static uint8_t sm_io_capabilities = IO_CAPABILITY_NO_INPUT_NO_OUTPUT;
186 static uint8_t sm_slave_request_security;
187 static uint32_t sm_fixed_passkey_in_display_role;
188 static uint8_t sm_reconstruct_ltk_without_le_device_db_entry;
189 
190 #ifdef ENABLE_LE_SECURE_CONNECTIONS
191 static uint8_t sm_sc_oob_random[16];
192 static void (*sm_sc_oob_callback)(const uint8_t * confirm_value, const uint8_t * random_value);
193 static sm_sc_oob_state_t sm_sc_oob_state;
194 #endif
195 
196 // Security Manager Master Keys, please use sm_set_er(er) and sm_set_ir(ir) with your own 128 bit random values
197 static sm_key_t sm_persistent_er;
198 static sm_key_t sm_persistent_ir;
199 
200 // derived from sm_persistent_ir
201 static sm_key_t sm_persistent_dhk;
202 static sm_key_t sm_persistent_irk;
203 static uint8_t  sm_persistent_irk_ready = 0;    // used for testing
204 static derived_key_generation_t dkg_state;
205 
206 // derived from sm_persistent_er
207 // ..
208 
209 // random address update
210 static random_address_update_t rau_state;
211 static bd_addr_t sm_random_address;
212 
213 #ifdef USE_CMAC_ENGINE
214 // CMAC Calculation: General
215 static btstack_crypto_aes128_cmac_t sm_cmac_request;
216 static void (*sm_cmac_done_callback)(uint8_t hash[8]);
217 static uint8_t sm_cmac_active;
218 static uint8_t sm_cmac_hash[16];
219 #endif
220 
221 // CMAC for ATT Signed Writes
222 #ifdef ENABLE_LE_SIGNED_WRITE
223 static uint16_t        sm_cmac_signed_write_message_len;
224 static uint8_t         sm_cmac_signed_write_header[3];
225 static const uint8_t * sm_cmac_signed_write_message;
226 static uint8_t         sm_cmac_signed_write_sign_counter[4];
227 #endif
228 
229 // CMAC for Secure Connection functions
230 #ifdef ENABLE_LE_SECURE_CONNECTIONS
231 static sm_connection_t * sm_cmac_connection;
232 static uint8_t           sm_cmac_sc_buffer[80];
233 #endif
234 
235 // resolvable private address lookup / CSRK calculation
236 static int       sm_address_resolution_test;
237 static int       sm_address_resolution_ah_calculation_active;
238 static uint8_t   sm_address_resolution_addr_type;
239 static bd_addr_t sm_address_resolution_address;
240 static void *    sm_address_resolution_context;
241 static address_resolution_mode_t sm_address_resolution_mode;
242 static btstack_linked_list_t sm_address_resolution_general_queue;
243 
244 // aes128 crypto engine.
245 static sm_aes128_state_t  sm_aes128_state;
246 
247 // crypto
248 static btstack_crypto_random_t   sm_crypto_random_request;
249 static btstack_crypto_aes128_t   sm_crypto_aes128_request;
250 #ifdef ENABLE_LE_SECURE_CONNECTIONS
251 static btstack_crypto_ecc_p256_t sm_crypto_ecc_p256_request;
252 static btstack_crypto_random_t   sm_crypto_random_oob_request;
253 #endif
254 
255 // temp storage for random data
256 static uint8_t sm_random_data[8];
257 static uint8_t sm_aes128_key[16];
258 static uint8_t sm_aes128_plaintext[16];
259 static uint8_t sm_aes128_ciphertext[16];
260 
261 // to receive hci events
262 static btstack_packet_callback_registration_t hci_event_callback_registration;
263 
264 /* to dispatch sm event */
265 static btstack_linked_list_t sm_event_handlers;
266 
267 // LE Secure Connections
268 #ifdef ENABLE_LE_SECURE_CONNECTIONS
269 static ec_key_generation_state_t ec_key_generation_state;
270 static uint8_t ec_q[64];
271 #endif
272 
273 //
274 // Volume 3, Part H, Chapter 24
275 // "Security shall be initiated by the Security Manager in the device in the master role.
276 // The device in the slave role shall be the responding device."
277 // -> master := initiator, slave := responder
278 //
279 
280 // data needed for security setup
281 typedef struct sm_setup_context {
282 
283     btstack_timer_source_t sm_timeout;
284 
285     // used in all phases
286     uint8_t   sm_pairing_failed_reason;
287 
288     // user response, (Phase 1 and/or 2)
289     uint8_t   sm_user_response;
290     uint8_t   sm_keypress_notification; // bitmap: passkey started, digit entered, digit erased, passkey cleared, passkey complete, 3 bit count
291 
292     // defines which keys will be send after connection is encrypted - calculated during Phase 1, used Phase 3
293     int       sm_key_distribution_send_set;
294     int       sm_key_distribution_received_set;
295 
296     // Phase 2 (Pairing over SMP)
297     stk_generation_method_t sm_stk_generation_method;
298     sm_key_t  sm_tk;
299     uint8_t   sm_have_oob_data;
300     uint8_t   sm_use_secure_connections;
301 
302     sm_key_t  sm_c1_t3_value;   // c1 calculation
303     sm_pairing_packet_t sm_m_preq; // pairing request - needed only for c1
304     sm_pairing_packet_t sm_s_pres; // pairing response - needed only for c1
305     sm_key_t  sm_local_random;
306     sm_key_t  sm_local_confirm;
307     sm_key_t  sm_peer_random;
308     sm_key_t  sm_peer_confirm;
309     uint8_t   sm_m_addr_type;   // address and type can be removed
310     uint8_t   sm_s_addr_type;   //  ''
311     bd_addr_t sm_m_address;     //  ''
312     bd_addr_t sm_s_address;     //  ''
313     sm_key_t  sm_ltk;
314 
315     uint8_t   sm_state_vars;
316 #ifdef ENABLE_LE_SECURE_CONNECTIONS
317     uint8_t   sm_peer_q[64];    // also stores random for EC key generation during init
318     sm_key_t  sm_peer_nonce;    // might be combined with sm_peer_random
319     sm_key_t  sm_local_nonce;   // might be combined with sm_local_random
320     sm_key_t  sm_dhkey;
321     sm_key_t  sm_peer_dhkey_check;
322     sm_key_t  sm_local_dhkey_check;
323     sm_key_t  sm_ra;
324     sm_key_t  sm_rb;
325     sm_key_t  sm_t;             // used for f5 and h6
326     sm_key_t  sm_mackey;
327     uint8_t   sm_passkey_bit;   // also stores number of generated random bytes for EC key generation
328 #endif
329 
330     // Phase 3
331 
332     // key distribution, we generate
333     uint16_t  sm_local_y;
334     uint16_t  sm_local_div;
335     uint16_t  sm_local_ediv;
336     uint8_t   sm_local_rand[8];
337     sm_key_t  sm_local_ltk;
338     sm_key_t  sm_local_csrk;
339     sm_key_t  sm_local_irk;
340     // sm_local_address/addr_type not needed
341 
342     // key distribution, received from peer
343     uint16_t  sm_peer_y;
344     uint16_t  sm_peer_div;
345     uint16_t  sm_peer_ediv;
346     uint8_t   sm_peer_rand[8];
347     sm_key_t  sm_peer_ltk;
348     sm_key_t  sm_peer_irk;
349     sm_key_t  sm_peer_csrk;
350     uint8_t   sm_peer_addr_type;
351     bd_addr_t sm_peer_address;
352 
353 } sm_setup_context_t;
354 
355 //
356 static sm_setup_context_t the_setup;
357 static sm_setup_context_t * setup = &the_setup;
358 
359 // active connection - the one for which the_setup is used for
360 static uint16_t sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
361 
362 // @returns 1 if oob data is available
363 // stores oob data in provided 16 byte buffer if not null
364 static int (*sm_get_oob_data)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data) = NULL;
365 static int (*sm_get_sc_oob_data)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_sc_peer_confirm, uint8_t * oob_sc_peer_random);
366 
367 // horizontal: initiator capabilities
368 // vertial:    responder capabilities
369 static const stk_generation_method_t stk_generation_method [5] [5] = {
370     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
371     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
372     { PK_RESP_INPUT,   PK_RESP_INPUT,    PK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
373     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
374     { PK_RESP_INPUT,   PK_RESP_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
375 };
376 
377 // uses numeric comparison if one side has DisplayYesNo and KeyboardDisplay combinations
378 #ifdef ENABLE_LE_SECURE_CONNECTIONS
379 static const stk_generation_method_t stk_generation_method_with_secure_connection[5][5] = {
380     { JUST_WORKS,      JUST_WORKS,         PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT      },
381     { JUST_WORKS,      NUMERIC_COMPARISON, PK_INIT_INPUT,   JUST_WORKS,    NUMERIC_COMPARISON },
382     { PK_RESP_INPUT,   PK_RESP_INPUT,      PK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT      },
383     { JUST_WORKS,      JUST_WORKS,         JUST_WORKS,      JUST_WORKS,    JUST_WORKS         },
384     { PK_RESP_INPUT,   NUMERIC_COMPARISON, PK_INIT_INPUT,   JUST_WORKS,    NUMERIC_COMPARISON },
385 };
386 #endif
387 
388 static void sm_run(void);
389 #ifdef USE_CMAC_ENGINE
390 static void sm_cmac_message_start(const sm_key_t key, uint16_t message_len, const uint8_t * message, void (*done_callback)(uint8_t * hash));
391 #endif
392 static void sm_done_for_handle(hci_con_handle_t con_handle);
393 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle);
394 static inline int sm_calc_actual_encryption_key_size(int other);
395 static int sm_validate_stk_generation_method(void);
396 static void sm_handle_encryption_result_address_resolution(void *arg);
397 static void sm_handle_encryption_result_dkg_dhk(void *arg);
398 static void sm_handle_encryption_result_dkg_irk(void *arg);
399 static void sm_handle_encryption_result_enc_a(void *arg);
400 static void sm_handle_encryption_result_enc_b(void *arg);
401 static void sm_handle_encryption_result_enc_c(void *arg);
402 static void sm_handle_encryption_result_enc_csrk(void *arg);
403 static void sm_handle_encryption_result_enc_d(void * arg);
404 static void sm_handle_encryption_result_enc_ph3_ltk(void *arg);
405 static void sm_handle_encryption_result_enc_ph3_y(void *arg);
406 #ifdef ENABLE_LE_PERIPHERAL
407 static void sm_handle_encryption_result_enc_ph4_ltk(void *arg);
408 static void sm_handle_encryption_result_enc_ph4_y(void *arg);
409 #endif
410 static void sm_handle_encryption_result_enc_stk(void *arg);
411 static void sm_handle_encryption_result_rau(void *arg);
412 static void sm_handle_random_result_ph2_tk(void * arg);
413 static void sm_handle_random_result_rau(void * arg);
414 #ifdef ENABLE_LE_SECURE_CONNECTIONS
415 static void sm_handle_random_result_sc_get_random(void * arg);
416 static int sm_passkey_entry(stk_generation_method_t method);
417 #endif
418 static void sm_notify_client_status_reason(sm_connection_t * sm_conn, uint8_t status, uint8_t reason);
419 
420 static void log_info_hex16(const char * name, uint16_t value){
421     log_info("%-6s 0x%04x", name, value);
422 }
423 
424 // static inline uint8_t sm_pairing_packet_get_code(sm_pairing_packet_t packet){
425 //     return packet[0];
426 // }
427 static inline uint8_t sm_pairing_packet_get_io_capability(sm_pairing_packet_t packet){
428     return packet[1];
429 }
430 static inline uint8_t sm_pairing_packet_get_oob_data_flag(sm_pairing_packet_t packet){
431     return packet[2];
432 }
433 static inline uint8_t sm_pairing_packet_get_auth_req(sm_pairing_packet_t packet){
434     return packet[3];
435 }
436 static inline uint8_t sm_pairing_packet_get_max_encryption_key_size(sm_pairing_packet_t packet){
437     return packet[4];
438 }
439 static inline uint8_t sm_pairing_packet_get_initiator_key_distribution(sm_pairing_packet_t packet){
440     return packet[5];
441 }
442 static inline uint8_t sm_pairing_packet_get_responder_key_distribution(sm_pairing_packet_t packet){
443     return packet[6];
444 }
445 
446 static inline void sm_pairing_packet_set_code(sm_pairing_packet_t packet, uint8_t code){
447     packet[0] = code;
448 }
449 static inline void sm_pairing_packet_set_io_capability(sm_pairing_packet_t packet, uint8_t io_capability){
450     packet[1] = io_capability;
451 }
452 static inline void sm_pairing_packet_set_oob_data_flag(sm_pairing_packet_t packet, uint8_t oob_data_flag){
453     packet[2] = oob_data_flag;
454 }
455 static inline void sm_pairing_packet_set_auth_req(sm_pairing_packet_t packet, uint8_t auth_req){
456     packet[3] = auth_req;
457 }
458 static inline void sm_pairing_packet_set_max_encryption_key_size(sm_pairing_packet_t packet, uint8_t max_encryption_key_size){
459     packet[4] = max_encryption_key_size;
460 }
461 static inline void sm_pairing_packet_set_initiator_key_distribution(sm_pairing_packet_t packet, uint8_t initiator_key_distribution){
462     packet[5] = initiator_key_distribution;
463 }
464 static inline void sm_pairing_packet_set_responder_key_distribution(sm_pairing_packet_t packet, uint8_t responder_key_distribution){
465     packet[6] = responder_key_distribution;
466 }
467 
468 // @returns 1 if all bytes are 0
469 static int sm_is_null(uint8_t * data, int size){
470     int i;
471     for (i=0; i < size ; i++){
472         if (data[i]) return 0;
473     }
474     return 1;
475 }
476 
477 static int sm_is_null_random(uint8_t random[8]){
478     return sm_is_null(random, 8);
479 }
480 
481 static int sm_is_null_key(uint8_t * key){
482     return sm_is_null(key, 16);
483 }
484 
485 // Key utils
486 static void sm_reset_tk(void){
487     int i;
488     for (i=0;i<16;i++){
489         setup->sm_tk[i] = 0;
490     }
491 }
492 
493 // "For example, if a 128-bit encryption key is 0x123456789ABCDEF0123456789ABCDEF0
494 // and it is reduced to 7 octets (56 bits), then the resulting key is 0x0000000000000000003456789ABCDEF0.""
495 static void sm_truncate_key(sm_key_t key, int max_encryption_size){
496     int i;
497     for (i = max_encryption_size ; i < 16 ; i++){
498         key[15-i] = 0;
499     }
500 }
501 
502 // SMP Timeout implementation
503 
504 // Upon transmission of the Pairing Request command or reception of the Pairing Request command,
505 // the Security Manager Timer shall be reset and started.
506 //
507 // The Security Manager Timer shall be reset when an L2CAP SMP command is queued for transmission.
508 //
509 // If the Security Manager Timer reaches 30 seconds, the procedure shall be considered to have failed,
510 // and the local higher layer shall be notified. No further SMP commands shall be sent over the L2CAP
511 // Security Manager Channel. A new SM procedure shall only be performed when a new physical link has been
512 // established.
513 
514 static void sm_timeout_handler(btstack_timer_source_t * timer){
515     log_info("SM timeout");
516     sm_connection_t * sm_conn = (sm_connection_t*) btstack_run_loop_get_timer_context(timer);
517     sm_conn->sm_engine_state = SM_GENERAL_TIMEOUT;
518     sm_notify_client_status_reason(sm_conn, ERROR_CODE_CONNECTION_TIMEOUT, 0);
519     sm_done_for_handle(sm_conn->sm_handle);
520 
521     // trigger handling of next ready connection
522     sm_run();
523 }
524 static void sm_timeout_start(sm_connection_t * sm_conn){
525     btstack_run_loop_remove_timer(&setup->sm_timeout);
526     btstack_run_loop_set_timer_context(&setup->sm_timeout, sm_conn);
527     btstack_run_loop_set_timer_handler(&setup->sm_timeout, sm_timeout_handler);
528     btstack_run_loop_set_timer(&setup->sm_timeout, 30000); // 30 seconds sm timeout
529     btstack_run_loop_add_timer(&setup->sm_timeout);
530 }
531 static void sm_timeout_stop(void){
532     btstack_run_loop_remove_timer(&setup->sm_timeout);
533 }
534 static void sm_timeout_reset(sm_connection_t * sm_conn){
535     sm_timeout_stop();
536     sm_timeout_start(sm_conn);
537 }
538 
539 // end of sm timeout
540 
541 // GAP Random Address updates
542 static gap_random_address_type_t gap_random_adress_type;
543 static btstack_timer_source_t gap_random_address_update_timer;
544 static uint32_t gap_random_adress_update_period;
545 
546 static void gap_random_address_trigger(void){
547     log_info("gap_random_address_trigger");
548     if (rau_state != RAU_IDLE) return;
549     rau_state = RAU_W4_RANDOM;
550     btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_address, 8, &sm_handle_random_result_rau, NULL);
551 }
552 
553 static void gap_random_address_update_handler(btstack_timer_source_t * timer){
554     UNUSED(timer);
555 
556     log_info("GAP Random Address Update due");
557     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
558     btstack_run_loop_add_timer(&gap_random_address_update_timer);
559     gap_random_address_trigger();
560 }
561 
562 static void gap_random_address_update_start(void){
563     btstack_run_loop_set_timer_handler(&gap_random_address_update_timer, gap_random_address_update_handler);
564     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
565     btstack_run_loop_add_timer(&gap_random_address_update_timer);
566 }
567 
568 static void gap_random_address_update_stop(void){
569     btstack_run_loop_remove_timer(&gap_random_address_update_timer);
570 }
571 
572 // ah(k,r) helper
573 // r = padding || r
574 // r - 24 bit value
575 static void sm_ah_r_prime(uint8_t r[3], uint8_t * r_prime){
576     // r'= padding || r
577     memset(r_prime, 0, 16);
578     memcpy(&r_prime[13], r, 3);
579 }
580 
581 // d1 helper
582 // d' = padding || r || d
583 // d,r - 16 bit values
584 static void sm_d1_d_prime(uint16_t d, uint16_t r, uint8_t * d1_prime){
585     // d'= padding || r || d
586     memset(d1_prime, 0, 16);
587     big_endian_store_16(d1_prime, 12, r);
588     big_endian_store_16(d1_prime, 14, d);
589 }
590 
591 // dm helper
592 // r’ = padding || r
593 // r - 64 bit value
594 static void sm_dm_r_prime(uint8_t r[8], uint8_t * r_prime){
595     memset(r_prime, 0, 16);
596     memcpy(&r_prime[8], r, 8);
597 }
598 
599 // calculate arguments for first AES128 operation in C1 function
600 static void sm_c1_t1(sm_key_t r, uint8_t preq[7], uint8_t pres[7], uint8_t iat, uint8_t rat, uint8_t * t1){
601 
602     // p1 = pres || preq || rat’ || iat’
603     // "The octet of iat’ becomes the least significant octet of p1 and the most signifi-
604     // cant octet of pres becomes the most significant octet of p1.
605     // For example, if the 8-bit iat’ is 0x01, the 8-bit rat’ is 0x00, the 56-bit preq
606     // is 0x07071000000101 and the 56 bit pres is 0x05000800000302 then
607     // p1 is 0x05000800000302070710000001010001."
608 
609     sm_key_t p1;
610     reverse_56(pres, &p1[0]);
611     reverse_56(preq, &p1[7]);
612     p1[14] = rat;
613     p1[15] = iat;
614     log_info_key("p1", p1);
615     log_info_key("r", r);
616 
617     // t1 = r xor p1
618     int i;
619     for (i=0;i<16;i++){
620         t1[i] = r[i] ^ p1[i];
621     }
622     log_info_key("t1", t1);
623 }
624 
625 // calculate arguments for second AES128 operation in C1 function
626 static void sm_c1_t3(sm_key_t t2, bd_addr_t ia, bd_addr_t ra, uint8_t * t3){
627      // p2 = padding || ia || ra
628     // "The least significant octet of ra becomes the least significant octet of p2 and
629     // the most significant octet of padding becomes the most significant octet of p2.
630     // For example, if 48-bit ia is 0xA1A2A3A4A5A6 and the 48-bit ra is
631     // 0xB1B2B3B4B5B6 then p2 is 0x00000000A1A2A3A4A5A6B1B2B3B4B5B6.
632 
633     sm_key_t p2;
634     memset(p2, 0, 16);
635     memcpy(&p2[4],  ia, 6);
636     memcpy(&p2[10], ra, 6);
637     log_info_key("p2", p2);
638 
639     // c1 = e(k, t2_xor_p2)
640     int i;
641     for (i=0;i<16;i++){
642         t3[i] = t2[i] ^ p2[i];
643     }
644     log_info_key("t3", t3);
645 }
646 
647 static void sm_s1_r_prime(sm_key_t r1, sm_key_t r2, uint8_t * r_prime){
648     log_info_key("r1", r1);
649     log_info_key("r2", r2);
650     memcpy(&r_prime[8], &r2[8], 8);
651     memcpy(&r_prime[0], &r1[8], 8);
652 }
653 
654 static void sm_dispatch_event(uint8_t packet_type, uint16_t channel, uint8_t * packet, uint16_t size){
655     UNUSED(channel);
656 
657     // log event
658     hci_dump_packet(packet_type, 1, packet, size);
659     // dispatch to all event handlers
660     btstack_linked_list_iterator_t it;
661     btstack_linked_list_iterator_init(&it, &sm_event_handlers);
662     while (btstack_linked_list_iterator_has_next(&it)){
663         btstack_packet_callback_registration_t * entry = (btstack_packet_callback_registration_t*) btstack_linked_list_iterator_next(&it);
664         entry->callback(packet_type, 0, packet, size);
665     }
666 }
667 
668 static void sm_setup_event_base(uint8_t * event, int event_size, uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
669     event[0] = type;
670     event[1] = event_size - 2;
671     little_endian_store_16(event, 2, con_handle);
672     event[4] = addr_type;
673     reverse_bd_addr(address, &event[5]);
674 }
675 
676 static void sm_notify_client_base(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
677     uint8_t event[11];
678     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
679     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
680 }
681 
682 static void sm_notify_client_passkey(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint32_t passkey){
683     uint8_t event[15];
684     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
685     little_endian_store_32(event, 11, passkey);
686     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
687 }
688 
689 static void sm_notify_client_index(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint16_t index){
690     // fetch addr and addr type from db
691     bd_addr_t identity_address;
692     int identity_address_type;
693     le_device_db_info(index, &identity_address_type, identity_address, NULL);
694 
695     uint8_t event[19];
696     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
697     event[11] = identity_address_type;
698     reverse_bd_addr(identity_address, &event[12]);
699     event[18] = index;
700     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
701 }
702 
703 static void sm_notify_client_status(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint8_t status){
704     uint8_t event[12];
705     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
706     event[11] = status;
707     sm_dispatch_event(HCI_EVENT_PACKET, 0, (uint8_t*) &event, sizeof(event));
708 }
709 
710 static void sm_notify_client_status_reason(sm_connection_t * sm_conn, uint8_t status, uint8_t reason){
711     uint8_t event[13];
712     sm_setup_event_base(event, sizeof(event), SM_EVENT_PAIRING_COMPLETE, sm_conn->sm_handle, setup->sm_peer_addr_type, setup->sm_peer_address);
713     event[11] = status;
714     event[12] = reason;
715     sm_dispatch_event(HCI_EVENT_PACKET, 0, (uint8_t*) &event, sizeof(event));
716 }
717 
718 // decide on stk generation based on
719 // - pairing request
720 // - io capabilities
721 // - OOB data availability
722 static void sm_setup_tk(void){
723 
724     // default: just works
725     setup->sm_stk_generation_method = JUST_WORKS;
726 
727 #ifdef ENABLE_LE_SECURE_CONNECTIONS
728     setup->sm_use_secure_connections = ( sm_pairing_packet_get_auth_req(setup->sm_m_preq)
729                                        & sm_pairing_packet_get_auth_req(setup->sm_s_pres)
730                                        & SM_AUTHREQ_SECURE_CONNECTION ) != 0;
731 #else
732     setup->sm_use_secure_connections = 0;
733 #endif
734     log_info("Secure pairing: %u", setup->sm_use_secure_connections);
735 
736 
737     // decide if OOB will be used based on SC vs. Legacy and oob flags
738     int use_oob = 0;
739     if (setup->sm_use_secure_connections){
740         // In LE Secure Connections pairing, the out of band method is used if at least
741         // one device has the peer device's out of band authentication data available.
742         use_oob = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq) | sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
743     } else {
744         // In LE legacy pairing, the out of band method is used if both the devices have
745         // the other device's out of band authentication data available.
746         use_oob = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq) & sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
747     }
748     if (use_oob){
749         log_info("SM: have OOB data");
750         log_info_key("OOB", setup->sm_tk);
751         setup->sm_stk_generation_method = OOB;
752         return;
753     }
754 
755     // If both devices have not set the MITM option in the Authentication Requirements
756     // Flags, then the IO capabilities shall be ignored and the Just Works association
757     // model shall be used.
758     if (((sm_pairing_packet_get_auth_req(setup->sm_m_preq) & SM_AUTHREQ_MITM_PROTECTION) == 0)
759     &&  ((sm_pairing_packet_get_auth_req(setup->sm_s_pres) & SM_AUTHREQ_MITM_PROTECTION) == 0)){
760         log_info("SM: MITM not required by both -> JUST WORKS");
761         return;
762     }
763 
764     // Reset TK as it has been setup in sm_init_setup
765     sm_reset_tk();
766 
767     // Also use just works if unknown io capabilites
768     if ((sm_pairing_packet_get_io_capability(setup->sm_m_preq) > IO_CAPABILITY_KEYBOARD_DISPLAY) || (sm_pairing_packet_get_io_capability(setup->sm_s_pres) > IO_CAPABILITY_KEYBOARD_DISPLAY)){
769         return;
770     }
771 
772     // Otherwise the IO capabilities of the devices shall be used to determine the
773     // pairing method as defined in Table 2.4.
774     // see http://stackoverflow.com/a/1052837/393697 for how to specify pointer to 2-dimensional array
775     const stk_generation_method_t (*generation_method)[5] = stk_generation_method;
776 
777 #ifdef ENABLE_LE_SECURE_CONNECTIONS
778     // table not define by default
779     if (setup->sm_use_secure_connections){
780         generation_method = stk_generation_method_with_secure_connection;
781     }
782 #endif
783     setup->sm_stk_generation_method = generation_method[sm_pairing_packet_get_io_capability(setup->sm_s_pres)][sm_pairing_packet_get_io_capability(setup->sm_m_preq)];
784 
785     log_info("sm_setup_tk: master io cap: %u, slave io cap: %u -> method %u",
786         sm_pairing_packet_get_io_capability(setup->sm_m_preq), sm_pairing_packet_get_io_capability(setup->sm_s_pres), setup->sm_stk_generation_method);
787 }
788 
789 static int sm_key_distribution_flags_for_set(uint8_t key_set){
790     int flags = 0;
791     if (key_set & SM_KEYDIST_ENC_KEY){
792         flags |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
793         flags |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
794     }
795     if (key_set & SM_KEYDIST_ID_KEY){
796         flags |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
797         flags |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
798     }
799     if (key_set & SM_KEYDIST_SIGN){
800         flags |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
801     }
802     return flags;
803 }
804 
805 static void sm_setup_key_distribution(uint8_t key_set){
806     setup->sm_key_distribution_received_set = 0;
807     setup->sm_key_distribution_send_set = sm_key_distribution_flags_for_set(key_set);
808 }
809 
810 // CSRK Key Lookup
811 
812 
813 static int sm_address_resolution_idle(void){
814     return sm_address_resolution_mode == ADDRESS_RESOLUTION_IDLE;
815 }
816 
817 static void sm_address_resolution_start_lookup(uint8_t addr_type, hci_con_handle_t con_handle, bd_addr_t addr, address_resolution_mode_t mode, void * context){
818     memcpy(sm_address_resolution_address, addr, 6);
819     sm_address_resolution_addr_type = addr_type;
820     sm_address_resolution_test = 0;
821     sm_address_resolution_mode = mode;
822     sm_address_resolution_context = context;
823     sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_STARTED, con_handle, addr_type, addr);
824 }
825 
826 int sm_address_resolution_lookup(uint8_t address_type, bd_addr_t address){
827     // check if already in list
828     btstack_linked_list_iterator_t it;
829     sm_lookup_entry_t * entry;
830     btstack_linked_list_iterator_init(&it, &sm_address_resolution_general_queue);
831     while(btstack_linked_list_iterator_has_next(&it)){
832         entry = (sm_lookup_entry_t *) btstack_linked_list_iterator_next(&it);
833         if (entry->address_type != address_type) continue;
834         if (memcmp(entry->address, address, 6))  continue;
835         // already in list
836         return BTSTACK_BUSY;
837     }
838     entry = btstack_memory_sm_lookup_entry_get();
839     if (!entry) return BTSTACK_MEMORY_ALLOC_FAILED;
840     entry->address_type = (bd_addr_type_t) address_type;
841     memcpy(entry->address, address, 6);
842     btstack_linked_list_add(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
843     sm_run();
844     return 0;
845 }
846 
847 // CMAC calculation using AES Engineq
848 #ifdef USE_CMAC_ENGINE
849 
850 static void sm_cmac_done_trampoline(void * arg){
851     UNUSED(arg);
852     sm_cmac_active = 0;
853     (*sm_cmac_done_callback)(sm_cmac_hash);
854     sm_run();
855 }
856 
857 int sm_cmac_ready(void){
858     return sm_cmac_active == 0;
859 }
860 
861 // generic cmac calculation
862 static void sm_cmac_message_start(const sm_key_t key, uint16_t message_len, const uint8_t * message, void (*done_callback)(uint8_t * hash)){
863     sm_cmac_active = 1;
864     sm_cmac_done_callback = done_callback;
865     btstack_crypto_aes128_cmac_message(&sm_cmac_request, key, message_len, message, sm_cmac_hash, sm_cmac_done_trampoline, NULL);
866 }
867 #endif
868 
869 // cmac for ATT Message signing
870 #ifdef ENABLE_LE_SIGNED_WRITE
871 
872 static void sm_cmac_generator_start(const sm_key_t key, uint16_t message_len, uint8_t (*get_byte_callback)(uint16_t offset), void (*done_callback)(uint8_t * hash)){
873     sm_cmac_active = 1;
874     sm_cmac_done_callback = done_callback;
875     btstack_crypto_aes128_cmac_generator(&sm_cmac_request, key, message_len, get_byte_callback, sm_cmac_hash, sm_cmac_done_trampoline, NULL);
876 }
877 
878 static uint8_t sm_cmac_signed_write_message_get_byte(uint16_t offset){
879     if (offset >= sm_cmac_signed_write_message_len) {
880         log_error("sm_cmac_signed_write_message_get_byte. out of bounds, access %u, len %u", offset, sm_cmac_signed_write_message_len);
881         return 0;
882     }
883 
884     offset = sm_cmac_signed_write_message_len - 1 - offset;
885 
886     // sm_cmac_signed_write_header[3] | message[] | sm_cmac_signed_write_sign_counter[4]
887     if (offset < 3){
888         return sm_cmac_signed_write_header[offset];
889     }
890     int actual_message_len_incl_header = sm_cmac_signed_write_message_len - 4;
891     if (offset <  actual_message_len_incl_header){
892         return sm_cmac_signed_write_message[offset - 3];
893     }
894     return sm_cmac_signed_write_sign_counter[offset - actual_message_len_incl_header];
895 }
896 
897 void sm_cmac_signed_write_start(const sm_key_t k, uint8_t opcode, hci_con_handle_t con_handle, uint16_t message_len, const uint8_t * message, uint32_t sign_counter, void (*done_handler)(uint8_t * hash)){
898     // ATT Message Signing
899     sm_cmac_signed_write_header[0] = opcode;
900     little_endian_store_16(sm_cmac_signed_write_header, 1, con_handle);
901     little_endian_store_32(sm_cmac_signed_write_sign_counter, 0, sign_counter);
902     uint16_t total_message_len = 3 + message_len + 4;  // incl. virtually prepended att opcode, handle and appended sign_counter in LE
903     sm_cmac_signed_write_message     = message;
904     sm_cmac_signed_write_message_len = total_message_len;
905     sm_cmac_generator_start(k, total_message_len, &sm_cmac_signed_write_message_get_byte, done_handler);
906 }
907 #endif
908 
909 static void sm_trigger_user_response(sm_connection_t * sm_conn){
910     // notify client for: JUST WORKS confirm, Numeric comparison confirm, PASSKEY display or input
911     setup->sm_user_response = SM_USER_RESPONSE_IDLE;
912     switch (setup->sm_stk_generation_method){
913         case PK_RESP_INPUT:
914             if (IS_RESPONDER(sm_conn->sm_role)){
915                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
916                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
917             } else {
918                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
919             }
920             break;
921         case PK_INIT_INPUT:
922             if (IS_RESPONDER(sm_conn->sm_role)){
923                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
924             } else {
925                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
926                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
927             }
928             break;
929         case PK_BOTH_INPUT:
930             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
931             sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
932             break;
933         case NUMERIC_COMPARISON:
934             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
935             sm_notify_client_passkey(SM_EVENT_NUMERIC_COMPARISON_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
936             break;
937         case JUST_WORKS:
938             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
939             sm_notify_client_base(SM_EVENT_JUST_WORKS_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
940             break;
941         case OOB:
942             // client already provided OOB data, let's skip notification.
943             break;
944     }
945 }
946 
947 static int sm_key_distribution_all_received(sm_connection_t * sm_conn){
948     int recv_flags;
949     if (IS_RESPONDER(sm_conn->sm_role)){
950         // slave / responder
951         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres));
952     } else {
953         // master / initiator
954         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
955     }
956 
957 #ifdef ENABLE_LE_SECURE_CONNECTIONS
958     // LTK (= encyrption information & master identification) only used exchanged for LE Legacy Connection
959     if (setup->sm_use_secure_connections){
960         recv_flags &= ~(SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION | SM_KEYDIST_FLAG_MASTER_IDENTIFICATION);
961     }
962 #endif
963 
964     log_debug("sm_key_distribution_all_received: received 0x%02x, expecting 0x%02x", setup->sm_key_distribution_received_set, recv_flags);
965     return recv_flags == setup->sm_key_distribution_received_set;
966 }
967 
968 static void sm_done_for_handle(hci_con_handle_t con_handle){
969     if (sm_active_connection_handle == con_handle){
970         sm_timeout_stop();
971         sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
972         log_info("sm: connection 0x%x released setup context", con_handle);
973     }
974 }
975 
976 static int sm_key_distribution_flags_for_auth_req(void){
977 
978     int flags = SM_KEYDIST_ID_KEY;
979     if (sm_auth_req & SM_AUTHREQ_BONDING){
980         // encryption and signing information only if bonding requested
981         flags |= SM_KEYDIST_ENC_KEY;
982 #ifdef ENABLE_LE_SIGNED_WRITE
983         flags |= SM_KEYDIST_SIGN;
984 #endif
985     }
986     return flags;
987 }
988 
989 static void sm_reset_setup(void){
990     // fill in sm setup
991     setup->sm_state_vars = 0;
992     setup->sm_keypress_notification = 0;
993     sm_reset_tk();
994 }
995 
996 static void sm_init_setup(sm_connection_t * sm_conn){
997 
998     // fill in sm setup
999     setup->sm_peer_addr_type = sm_conn->sm_peer_addr_type;
1000     memcpy(setup->sm_peer_address, sm_conn->sm_peer_address, 6);
1001 
1002     // query client for Legacy Pairing OOB data
1003     setup->sm_have_oob_data = 0;
1004     if (sm_get_oob_data) {
1005         setup->sm_have_oob_data = (*sm_get_oob_data)(sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, setup->sm_tk);
1006     }
1007 
1008     // if available and SC supported, also ask for SC OOB Data
1009 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1010     memset(setup->sm_ra, 0, 16);
1011     memset(setup->sm_rb, 0, 16);
1012     if (setup->sm_have_oob_data && (sm_auth_req & SM_AUTHREQ_SECURE_CONNECTION)){
1013         if (sm_get_sc_oob_data){
1014             if (IS_RESPONDER(sm_conn->sm_role)){
1015                 setup->sm_have_oob_data = (*sm_get_sc_oob_data)(
1016                     sm_conn->sm_peer_addr_type,
1017                     sm_conn->sm_peer_address,
1018                     setup->sm_peer_confirm,
1019                     setup->sm_ra);
1020             } else {
1021                 setup->sm_have_oob_data = (*sm_get_sc_oob_data)(
1022                     sm_conn->sm_peer_addr_type,
1023                     sm_conn->sm_peer_address,
1024                     setup->sm_peer_confirm,
1025                     setup->sm_rb);
1026             }
1027         } else {
1028             setup->sm_have_oob_data = 0;
1029         }
1030     }
1031 #endif
1032 
1033     sm_pairing_packet_t * local_packet;
1034     if (IS_RESPONDER(sm_conn->sm_role)){
1035         // slave
1036         local_packet = &setup->sm_s_pres;
1037         gap_le_get_own_address(&setup->sm_s_addr_type, setup->sm_s_address);
1038         setup->sm_m_addr_type = sm_conn->sm_peer_addr_type;
1039         memcpy(setup->sm_m_address, sm_conn->sm_peer_address, 6);
1040     } else {
1041         // master
1042         local_packet = &setup->sm_m_preq;
1043         gap_le_get_own_address(&setup->sm_m_addr_type, setup->sm_m_address);
1044         setup->sm_s_addr_type = sm_conn->sm_peer_addr_type;
1045         memcpy(setup->sm_s_address, sm_conn->sm_peer_address, 6);
1046 
1047         int key_distribution_flags = sm_key_distribution_flags_for_auth_req();
1048         sm_pairing_packet_set_initiator_key_distribution(setup->sm_m_preq, key_distribution_flags);
1049         sm_pairing_packet_set_responder_key_distribution(setup->sm_m_preq, key_distribution_flags);
1050     }
1051 
1052     uint8_t auth_req = sm_auth_req;
1053     sm_pairing_packet_set_io_capability(*local_packet, sm_io_capabilities);
1054     sm_pairing_packet_set_oob_data_flag(*local_packet, setup->sm_have_oob_data);
1055     sm_pairing_packet_set_auth_req(*local_packet, auth_req);
1056     sm_pairing_packet_set_max_encryption_key_size(*local_packet, sm_max_encryption_key_size);
1057 }
1058 
1059 static int sm_stk_generation_init(sm_connection_t * sm_conn){
1060 
1061     sm_pairing_packet_t * remote_packet;
1062     int                   remote_key_request;
1063     if (IS_RESPONDER(sm_conn->sm_role)){
1064         // slave / responder
1065         remote_packet      = &setup->sm_m_preq;
1066         remote_key_request = sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq);
1067     } else {
1068         // master / initiator
1069         remote_packet      = &setup->sm_s_pres;
1070         remote_key_request = sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres);
1071     }
1072 
1073     // check key size
1074     sm_conn->sm_actual_encryption_key_size = sm_calc_actual_encryption_key_size(sm_pairing_packet_get_max_encryption_key_size(*remote_packet));
1075     if (sm_conn->sm_actual_encryption_key_size == 0) return SM_REASON_ENCRYPTION_KEY_SIZE;
1076 
1077     // decide on STK generation method / SC
1078     sm_setup_tk();
1079     log_info("SMP: generation method %u", setup->sm_stk_generation_method);
1080 
1081     // check if STK generation method is acceptable by client
1082     if (!sm_validate_stk_generation_method()) return SM_REASON_AUTHENTHICATION_REQUIREMENTS;
1083 
1084 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1085     // LTK (= encyrption information & master identification) only used exchanged for LE Legacy Connection
1086     if (setup->sm_use_secure_connections){
1087         remote_key_request &= ~SM_KEYDIST_ENC_KEY;
1088     }
1089 #endif
1090 
1091     // identical to responder
1092     sm_setup_key_distribution(remote_key_request);
1093 
1094     // JUST WORKS doens't provide authentication
1095     sm_conn->sm_connection_authenticated = setup->sm_stk_generation_method == JUST_WORKS ? 0 : 1;
1096 
1097     return 0;
1098 }
1099 
1100 static void sm_address_resolution_handle_event(address_resolution_event_t event){
1101 
1102     // cache and reset context
1103     int matched_device_id = sm_address_resolution_test;
1104     address_resolution_mode_t mode = sm_address_resolution_mode;
1105     void * context = sm_address_resolution_context;
1106 
1107     // reset context
1108     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
1109     sm_address_resolution_context = NULL;
1110     sm_address_resolution_test = -1;
1111     hci_con_handle_t con_handle = 0;
1112 
1113     sm_connection_t * sm_connection;
1114 #ifdef ENABLE_LE_CENTRAL
1115     sm_key_t ltk;
1116     int have_ltk;
1117     int pairing_need;
1118 #endif
1119     switch (mode){
1120         case ADDRESS_RESOLUTION_GENERAL:
1121             break;
1122         case ADDRESS_RESOLUTION_FOR_CONNECTION:
1123             sm_connection = (sm_connection_t *) context;
1124             con_handle = sm_connection->sm_handle;
1125             switch (event){
1126                 case ADDRESS_RESOLUTION_SUCEEDED:
1127                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_SUCCEEDED;
1128                     sm_connection->sm_le_db_index = matched_device_id;
1129                     log_info("ADDRESS_RESOLUTION_SUCEEDED, index %d", sm_connection->sm_le_db_index);
1130                     if (sm_connection->sm_role) {
1131                         // LTK request received before, IRK required -> start LTK calculation
1132                         if (sm_connection->sm_engine_state == SM_RESPONDER_PH0_RECEIVED_LTK_W4_IRK){
1133                             sm_connection->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST;
1134                         }
1135                         break;
1136                     }
1137 #ifdef ENABLE_LE_CENTRAL
1138                     le_device_db_encryption_get(sm_connection->sm_le_db_index, NULL, NULL, ltk, NULL, NULL, NULL);
1139                     have_ltk = !sm_is_null_key(ltk);
1140                     pairing_need = sm_connection->sm_pairing_requested || sm_connection->sm_security_request_received;
1141                     log_info("central: pairing request local %u, remote %u => action %u. have_ltk %u",
1142                         sm_connection->sm_pairing_requested, sm_connection->sm_security_request_received, pairing_need, have_ltk);
1143                     // reset requests
1144                     sm_connection->sm_security_request_received = 0;
1145                     sm_connection->sm_pairing_requested = 0;
1146                     // have ltk -> start encryption
1147                     if (have_ltk){
1148                         sm_connection->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
1149                         break;
1150                     }
1151                     // pairint_request -> send pairing request
1152                     if (pairing_need){
1153                         sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1154                         break;
1155                     }
1156 #endif
1157                     break;
1158                 case ADDRESS_RESOLUTION_FAILED:
1159                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_FAILED;
1160                     if (sm_connection->sm_role) {
1161                         // LTK request received before, IRK required -> negative LTK reply
1162                         if (sm_connection->sm_engine_state == SM_RESPONDER_PH0_RECEIVED_LTK_W4_IRK){
1163                             sm_connection->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
1164                         }
1165                         break;
1166                     }
1167 #ifdef ENABLE_LE_CENTRAL
1168                     if (!sm_connection->sm_pairing_requested && !sm_connection->sm_security_request_received) break;
1169                     sm_connection->sm_security_request_received = 0;
1170                     sm_connection->sm_pairing_requested = 0;
1171                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1172 #endif
1173                     break;
1174             }
1175             break;
1176         default:
1177             break;
1178     }
1179 
1180     switch (event){
1181         case ADDRESS_RESOLUTION_SUCEEDED:
1182             sm_notify_client_index(SM_EVENT_IDENTITY_RESOLVING_SUCCEEDED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address, matched_device_id);
1183             break;
1184         case ADDRESS_RESOLUTION_FAILED:
1185             sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_FAILED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address);
1186             break;
1187     }
1188 }
1189 
1190 static void sm_key_distribution_handle_all_received(sm_connection_t * sm_conn){
1191 
1192     int le_db_index = -1;
1193 
1194     // only store pairing information if both sides are bondable, i.e., the bonadble flag is set
1195     int bonding_enabed = ( sm_pairing_packet_get_auth_req(setup->sm_m_preq)
1196                          & sm_pairing_packet_get_auth_req(setup->sm_s_pres)
1197                          & SM_AUTHREQ_BONDING ) != 0;
1198 
1199     if (bonding_enabed){
1200 
1201         // lookup device based on IRK
1202         if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
1203             int i;
1204             for (i=0; i < le_device_db_max_count(); i++){
1205                 sm_key_t irk;
1206                 bd_addr_t address;
1207                 int address_type = BD_ADDR_TYPE_UNKNOWN;
1208                 le_device_db_info(i, &address_type, address, irk);
1209                 // check if valid entry retrieved
1210                 if (address_type == BD_ADDR_TYPE_UNKNOWN) continue;
1211                 // compare IRK
1212                 if (memcmp(irk, setup->sm_peer_irk, 16) != 0) continue;
1213 
1214                 log_info("sm: device found for IRK, updating");
1215                 le_db_index = i;
1216                 break;
1217             }
1218         } else {
1219             // assert IRK is set to zero
1220             memset(setup->sm_peer_irk, 0, 16);
1221         }
1222 
1223         // if not found, lookup via public address if possible
1224         log_info("sm peer addr type %u, peer addres %s", setup->sm_peer_addr_type, bd_addr_to_str(setup->sm_peer_address));
1225         if (le_db_index < 0 && setup->sm_peer_addr_type == BD_ADDR_TYPE_LE_PUBLIC){
1226             int i;
1227             for (i=0; i < le_device_db_max_count(); i++){
1228                 bd_addr_t address;
1229                 int address_type;
1230                 le_device_db_info(i, &address_type, address, NULL);
1231                 log_info("device %u, sm peer addr type %u, peer addres %s", i, address_type, bd_addr_to_str(address));
1232                 if (address_type == BD_ADDR_TYPE_LE_PUBLIC && memcmp(address, setup->sm_peer_address, 6) == 0){
1233                     log_info("sm: device found for public address, updating");
1234                     le_db_index = i;
1235                     break;
1236                 }
1237             }
1238         }
1239 
1240         // if not found, add to db
1241         if (le_db_index < 0) {
1242             le_db_index = le_device_db_add(setup->sm_peer_addr_type, setup->sm_peer_address, setup->sm_peer_irk);
1243         }
1244 
1245         if (le_db_index >= 0){
1246 
1247             sm_notify_client_index(SM_EVENT_IDENTITY_CREATED, sm_conn->sm_handle, setup->sm_peer_addr_type, setup->sm_peer_address, le_db_index);
1248 
1249 #ifdef ENABLE_LE_SIGNED_WRITE
1250             // store local CSRK
1251             if (setup->sm_key_distribution_send_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1252                 log_info("sm: store local CSRK");
1253                 le_device_db_local_csrk_set(le_db_index, setup->sm_local_csrk);
1254                 le_device_db_local_counter_set(le_db_index, 0);
1255             }
1256 
1257             // store remote CSRK
1258             if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1259                 log_info("sm: store remote CSRK");
1260                 le_device_db_remote_csrk_set(le_db_index, setup->sm_peer_csrk);
1261                 le_device_db_remote_counter_set(le_db_index, 0);
1262             }
1263 #endif
1264             // store encryption information for secure connections: LTK generated by ECDH
1265             if (setup->sm_use_secure_connections){
1266                 log_info("sm: store SC LTK (key size %u, authenticated %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
1267                 uint8_t zero_rand[8];
1268                 memset(zero_rand, 0, 8);
1269                 le_device_db_encryption_set(le_db_index, 0, zero_rand, setup->sm_ltk, sm_conn->sm_actual_encryption_key_size,
1270                     sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
1271             }
1272 
1273             // store encryption information for legacy pairing: peer LTK, EDIV, RAND
1274             else if ( (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION)
1275                    && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_MASTER_IDENTIFICATION )){
1276                 log_info("sm: set encryption information (key size %u, authenticated %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
1277                 le_device_db_encryption_set(le_db_index, setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1278                     sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
1279 
1280             }
1281         }
1282     } else {
1283         log_info("Ignoring received keys, bonding not enabled");
1284     }
1285 
1286     // keep le_db_index
1287     sm_conn->sm_le_db_index = le_db_index;
1288 }
1289 
1290 static void sm_pairing_error(sm_connection_t * sm_conn, uint8_t reason){
1291     setup->sm_pairing_failed_reason = reason;
1292     sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1293 }
1294 
1295 static inline void sm_pdu_received_in_wrong_state(sm_connection_t * sm_conn){
1296     sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
1297 }
1298 
1299 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1300 
1301 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn);
1302 static int sm_passkey_used(stk_generation_method_t method);
1303 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method);
1304 
1305 static void sm_sc_start_calculating_local_confirm(sm_connection_t * sm_conn){
1306     if (sm_passkey_used(setup->sm_stk_generation_method)){
1307         // sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
1308         btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_nonce, 16, &sm_handle_random_result_sc_get_random, sm_conn);
1309     } else {
1310         sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
1311     }
1312 }
1313 
1314 static void sm_sc_state_after_receiving_random(sm_connection_t * sm_conn){
1315     if (IS_RESPONDER(sm_conn->sm_role)){
1316         // Responder
1317         if (setup->sm_stk_generation_method == OOB){
1318             // generate Nb
1319             log_info("Generate Nb");
1320             // sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
1321             btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_nonce, 16, &sm_handle_random_result_sc_get_random, sm_conn);
1322         } else {
1323             sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
1324         }
1325     } else {
1326         // Initiator role
1327         switch (setup->sm_stk_generation_method){
1328             case JUST_WORKS:
1329                 sm_sc_prepare_dhkey_check(sm_conn);
1330                 break;
1331 
1332             case NUMERIC_COMPARISON:
1333                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_G2;
1334                 break;
1335             case PK_INIT_INPUT:
1336             case PK_RESP_INPUT:
1337             case PK_BOTH_INPUT:
1338                 if (setup->sm_passkey_bit < 20) {
1339                     sm_sc_start_calculating_local_confirm(sm_conn);
1340                 } else {
1341                     sm_sc_prepare_dhkey_check(sm_conn);
1342                 }
1343                 break;
1344             case OOB:
1345                 sm_sc_prepare_dhkey_check(sm_conn);
1346                 break;
1347         }
1348     }
1349 }
1350 
1351 static void sm_sc_cmac_done(uint8_t * hash){
1352     log_info("sm_sc_cmac_done: ");
1353     log_info_hexdump(hash, 16);
1354 
1355     if (sm_sc_oob_state == SM_SC_OOB_W4_CONFIRM){
1356         sm_sc_oob_state = SM_SC_OOB_IDLE;
1357         (*sm_sc_oob_callback)(hash, sm_sc_oob_random);
1358         return;
1359     }
1360 
1361     sm_connection_t * sm_conn = sm_cmac_connection;
1362     sm_cmac_connection = NULL;
1363 #ifdef ENABLE_CLASSIC
1364     link_key_type_t link_key_type;
1365 #endif
1366 
1367     switch (sm_conn->sm_engine_state){
1368         case SM_SC_W4_CMAC_FOR_CONFIRMATION:
1369             memcpy(setup->sm_local_confirm, hash, 16);
1370             sm_conn->sm_engine_state = SM_SC_SEND_CONFIRMATION;
1371             break;
1372         case SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION:
1373             // check
1374             if (0 != memcmp(hash, setup->sm_peer_confirm, 16)){
1375                 sm_pairing_error(sm_conn, SM_REASON_CONFIRM_VALUE_FAILED);
1376                 break;
1377             }
1378             sm_sc_state_after_receiving_random(sm_conn);
1379             break;
1380         case SM_SC_W4_CALCULATE_G2: {
1381             uint32_t vab = big_endian_read_32(hash, 12) % 1000000;
1382             big_endian_store_32(setup->sm_tk, 12, vab);
1383             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
1384             sm_trigger_user_response(sm_conn);
1385             break;
1386         }
1387         case SM_SC_W4_CALCULATE_F5_SALT:
1388             memcpy(setup->sm_t, hash, 16);
1389             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_MACKEY;
1390             break;
1391         case SM_SC_W4_CALCULATE_F5_MACKEY:
1392             memcpy(setup->sm_mackey, hash, 16);
1393             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_LTK;
1394             break;
1395         case SM_SC_W4_CALCULATE_F5_LTK:
1396             // truncate sm_ltk, but keep full LTK for cross-transport key derivation in sm_local_ltk
1397             // Errata Service Release to the Bluetooth Specification: ESR09
1398             //   E6405 – Cross transport key derivation from a key of size less than 128 bits
1399             //   Note: When the BR/EDR link key is being derived from the LTK, the derivation is done before the LTK gets masked."
1400             memcpy(setup->sm_ltk, hash, 16);
1401             memcpy(setup->sm_local_ltk, hash, 16);
1402             sm_truncate_key(setup->sm_ltk, sm_conn->sm_actual_encryption_key_size);
1403             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK;
1404             break;
1405         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
1406             memcpy(setup->sm_local_dhkey_check, hash, 16);
1407             if (IS_RESPONDER(sm_conn->sm_role)){
1408                 // responder
1409                 if (setup->sm_state_vars & SM_STATE_VAR_DHKEY_COMMAND_RECEIVED){
1410                     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
1411                 } else {
1412                     sm_conn->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
1413                 }
1414             } else {
1415                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1416             }
1417             break;
1418         case SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
1419             if (0 != memcmp(hash, setup->sm_peer_dhkey_check, 16) ){
1420                 sm_pairing_error(sm_conn, SM_REASON_DHKEY_CHECK_FAILED);
1421                 break;
1422             }
1423             if (IS_RESPONDER(sm_conn->sm_role)){
1424                 // responder
1425                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1426             } else {
1427                 // initiator
1428                 sm_conn->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
1429             }
1430             break;
1431         case SM_SC_W4_CALCULATE_H6_ILK:
1432             memcpy(setup->sm_t, hash, 16);
1433             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_H6_BR_EDR_LINK_KEY;
1434             break;
1435         case SM_SC_W4_CALCULATE_H6_BR_EDR_LINK_KEY:
1436 #ifdef ENABLE_CLASSIC
1437             reverse_128(hash, setup->sm_t);
1438             link_key_type = sm_conn->sm_connection_authenticated ?
1439                 AUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256 : UNAUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256;
1440             log_info("Derived classic link key from LE using h6, type %u", (int) link_key_type);
1441             if (IS_RESPONDER(sm_conn->sm_role)){
1442                 gap_store_link_key_for_bd_addr(setup->sm_m_address, setup->sm_t, link_key_type);
1443             } else {
1444                 gap_store_link_key_for_bd_addr(setup->sm_s_address, setup->sm_t, link_key_type);
1445             }
1446 #endif
1447             if (IS_RESPONDER(sm_conn->sm_role)){
1448                 sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
1449             } else {
1450                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
1451             }
1452             sm_notify_client_status_reason(sm_conn, ERROR_CODE_SUCCESS, 0);
1453             sm_done_for_handle(sm_conn->sm_handle);
1454             break;
1455         default:
1456             log_error("sm_sc_cmac_done in state %u", sm_conn->sm_engine_state);
1457             break;
1458     }
1459     sm_run();
1460 }
1461 
1462 static void f4_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, uint8_t z){
1463     const uint16_t message_len = 65;
1464     sm_cmac_connection = sm_conn;
1465     memcpy(sm_cmac_sc_buffer, u, 32);
1466     memcpy(sm_cmac_sc_buffer+32, v, 32);
1467     sm_cmac_sc_buffer[64] = z;
1468     log_info("f4 key");
1469     log_info_hexdump(x, 16);
1470     log_info("f4 message");
1471     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1472     sm_cmac_message_start(x, message_len, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1473 }
1474 
1475 static const sm_key_t f5_salt = { 0x6C ,0x88, 0x83, 0x91, 0xAA, 0xF5, 0xA5, 0x38, 0x60, 0x37, 0x0B, 0xDB, 0x5A, 0x60, 0x83, 0xBE};
1476 static const uint8_t f5_key_id[] = { 0x62, 0x74, 0x6c, 0x65 };
1477 static const uint8_t f5_length[] = { 0x01, 0x00};
1478 
1479 static void f5_calculate_salt(sm_connection_t * sm_conn){
1480     log_info("f5_calculate_salt");
1481     // calculate salt for f5
1482     const uint16_t message_len = 32;
1483     sm_cmac_connection = sm_conn;
1484     memcpy(sm_cmac_sc_buffer, setup->sm_dhkey, message_len);
1485     sm_cmac_message_start(f5_salt, message_len, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1486 }
1487 
1488 static inline void f5_mackkey(sm_connection_t * sm_conn, sm_key_t t, const sm_key_t n1, const sm_key_t n2, const sm_key56_t a1, const sm_key56_t a2){
1489     const uint16_t message_len = 53;
1490     sm_cmac_connection = sm_conn;
1491 
1492     // f5(W, N1, N2, A1, A2) = AES-CMACT (Counter = 0 || keyID || N1 || N2|| A1|| A2 || Length = 256) -- this is the MacKey
1493     sm_cmac_sc_buffer[0] = 0;
1494     memcpy(sm_cmac_sc_buffer+01, f5_key_id, 4);
1495     memcpy(sm_cmac_sc_buffer+05, n1, 16);
1496     memcpy(sm_cmac_sc_buffer+21, n2, 16);
1497     memcpy(sm_cmac_sc_buffer+37, a1, 7);
1498     memcpy(sm_cmac_sc_buffer+44, a2, 7);
1499     memcpy(sm_cmac_sc_buffer+51, f5_length, 2);
1500     log_info("f5 key");
1501     log_info_hexdump(t, 16);
1502     log_info("f5 message for MacKey");
1503     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1504     sm_cmac_message_start(t, message_len, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1505 }
1506 
1507 static void f5_calculate_mackey(sm_connection_t * sm_conn){
1508     sm_key56_t bd_addr_master, bd_addr_slave;
1509     bd_addr_master[0] =  setup->sm_m_addr_type;
1510     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1511     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1512     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1513     if (IS_RESPONDER(sm_conn->sm_role)){
1514         // responder
1515         f5_mackkey(sm_conn, setup->sm_t, setup->sm_peer_nonce, setup->sm_local_nonce, bd_addr_master, bd_addr_slave);
1516     } else {
1517         // initiator
1518         f5_mackkey(sm_conn, setup->sm_t, setup->sm_local_nonce, setup->sm_peer_nonce, bd_addr_master, bd_addr_slave);
1519     }
1520 }
1521 
1522 // note: must be called right after f5_mackey, as sm_cmac_buffer[1..52] will be reused
1523 static inline void f5_ltk(sm_connection_t * sm_conn, sm_key_t t){
1524     const uint16_t message_len = 53;
1525     sm_cmac_connection = sm_conn;
1526     sm_cmac_sc_buffer[0] = 1;
1527     // 1..52 setup before
1528     log_info("f5 key");
1529     log_info_hexdump(t, 16);
1530     log_info("f5 message for LTK");
1531     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1532     sm_cmac_message_start(t, message_len, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1533 }
1534 
1535 static void f5_calculate_ltk(sm_connection_t * sm_conn){
1536     f5_ltk(sm_conn, setup->sm_t);
1537 }
1538 
1539 static void f6_engine(sm_connection_t * sm_conn, const sm_key_t w, const sm_key_t n1, const sm_key_t n2, const sm_key_t r, const sm_key24_t io_cap, const sm_key56_t a1, const sm_key56_t a2){
1540     const uint16_t message_len = 65;
1541     sm_cmac_connection = sm_conn;
1542     memcpy(sm_cmac_sc_buffer, n1, 16);
1543     memcpy(sm_cmac_sc_buffer+16, n2, 16);
1544     memcpy(sm_cmac_sc_buffer+32, r, 16);
1545     memcpy(sm_cmac_sc_buffer+48, io_cap, 3);
1546     memcpy(sm_cmac_sc_buffer+51, a1, 7);
1547     memcpy(sm_cmac_sc_buffer+58, a2, 7);
1548     log_info("f6 key");
1549     log_info_hexdump(w, 16);
1550     log_info("f6 message");
1551     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1552     sm_cmac_message_start(w, 65, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1553 }
1554 
1555 // g2(U, V, X, Y) = AES-CMACX(U || V || Y) mod 2^32
1556 // - U is 256 bits
1557 // - V is 256 bits
1558 // - X is 128 bits
1559 // - Y is 128 bits
1560 static void g2_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, const sm_key_t y){
1561     const uint16_t message_len = 80;
1562     sm_cmac_connection = sm_conn;
1563     memcpy(sm_cmac_sc_buffer, u, 32);
1564     memcpy(sm_cmac_sc_buffer+32, v, 32);
1565     memcpy(sm_cmac_sc_buffer+64, y, 16);
1566     log_info("g2 key");
1567     log_info_hexdump(x, 16);
1568     log_info("g2 message");
1569     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1570     sm_cmac_message_start(x, message_len, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1571 }
1572 
1573 static void g2_calculate(sm_connection_t * sm_conn) {
1574     // calc Va if numeric comparison
1575     if (IS_RESPONDER(sm_conn->sm_role)){
1576         // responder
1577         g2_engine(sm_conn, setup->sm_peer_q, ec_q, setup->sm_peer_nonce, setup->sm_local_nonce);;
1578     } else {
1579         // initiator
1580         g2_engine(sm_conn, ec_q, setup->sm_peer_q, setup->sm_local_nonce, setup->sm_peer_nonce);
1581     }
1582 }
1583 
1584 static void sm_sc_calculate_local_confirm(sm_connection_t * sm_conn){
1585     uint8_t z = 0;
1586     if (sm_passkey_entry(setup->sm_stk_generation_method)){
1587         // some form of passkey
1588         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1589         z = 0x80 | ((pk >> setup->sm_passkey_bit) & 1);
1590         setup->sm_passkey_bit++;
1591     }
1592     f4_engine(sm_conn, ec_q, setup->sm_peer_q, setup->sm_local_nonce, z);
1593 }
1594 
1595 static void sm_sc_calculate_remote_confirm(sm_connection_t * sm_conn){
1596     // OOB
1597     if (setup->sm_stk_generation_method == OOB){
1598         if (IS_RESPONDER(sm_conn->sm_role)){
1599             f4_engine(sm_conn, setup->sm_peer_q, setup->sm_peer_q, setup->sm_ra, 0);
1600         } else {
1601             f4_engine(sm_conn, setup->sm_peer_q, setup->sm_peer_q, setup->sm_rb, 0);
1602         }
1603         return;
1604     }
1605 
1606     uint8_t z = 0;
1607     if (sm_passkey_entry(setup->sm_stk_generation_method)){
1608         // some form of passkey
1609         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1610         // sm_passkey_bit was increased before sending confirm value
1611         z = 0x80 | ((pk >> (setup->sm_passkey_bit-1)) & 1);
1612     }
1613     f4_engine(sm_conn, setup->sm_peer_q, ec_q, setup->sm_peer_nonce, z);
1614 }
1615 
1616 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn){
1617     log_info("sm_sc_prepare_dhkey_check, DHKEY calculated %u", setup->sm_state_vars & SM_STATE_VAR_DHKEY_CALCULATED ? 1 : 0);
1618 
1619     if (setup->sm_state_vars & SM_STATE_VAR_DHKEY_CALCULATED){
1620         sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_SALT;
1621         return;
1622     } else {
1623         sm_conn->sm_engine_state = SM_SC_W4_CALCULATE_DHKEY;
1624     }
1625 }
1626 
1627 static void sm_sc_dhkey_calculated(void * arg){
1628     sm_connection_t * sm_conn = (sm_connection_t *) arg;
1629     log_info("dhkey");
1630     log_info_hexdump(&setup->sm_dhkey[0], 32);
1631     setup->sm_state_vars |= SM_STATE_VAR_DHKEY_CALCULATED;
1632     // trigger next step
1633     if (sm_conn->sm_engine_state == SM_SC_W4_CALCULATE_DHKEY){
1634         sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_SALT;
1635     }
1636     sm_run();
1637 }
1638 
1639 static void sm_sc_calculate_f6_for_dhkey_check(sm_connection_t * sm_conn){
1640     // calculate DHKCheck
1641     sm_key56_t bd_addr_master, bd_addr_slave;
1642     bd_addr_master[0] =  setup->sm_m_addr_type;
1643     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1644     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1645     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1646     uint8_t iocap_a[3];
1647     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1648     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1649     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1650     uint8_t iocap_b[3];
1651     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1652     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1653     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1654     if (IS_RESPONDER(sm_conn->sm_role)){
1655         // responder
1656         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1657     } else {
1658         // initiator
1659         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1660     }
1661 }
1662 
1663 static void sm_sc_calculate_f6_to_verify_dhkey_check(sm_connection_t * sm_conn){
1664     // validate E = f6()
1665     sm_key56_t bd_addr_master, bd_addr_slave;
1666     bd_addr_master[0] =  setup->sm_m_addr_type;
1667     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1668     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1669     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1670 
1671     uint8_t iocap_a[3];
1672     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1673     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1674     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1675     uint8_t iocap_b[3];
1676     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1677     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1678     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1679     if (IS_RESPONDER(sm_conn->sm_role)){
1680         // responder
1681         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1682     } else {
1683         // initiator
1684         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1685     }
1686 }
1687 
1688 
1689 //
1690 // Link Key Conversion Function h6
1691 //
1692 // h6(W, keyID) = AES-CMACW(keyID)
1693 // - W is 128 bits
1694 // - keyID is 32 bits
1695 static void h6_engine(sm_connection_t * sm_conn, const sm_key_t w, const uint32_t key_id){
1696     const uint16_t message_len = 4;
1697     sm_cmac_connection = sm_conn;
1698     big_endian_store_32(sm_cmac_sc_buffer, 0, key_id);
1699     log_info("h6 key");
1700     log_info_hexdump(w, 16);
1701     log_info("h6 message");
1702     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1703     sm_cmac_message_start(w, message_len, sm_cmac_sc_buffer, &sm_sc_cmac_done);
1704 }
1705 
1706 // For SC, setup->sm_local_ltk holds full LTK (sm_ltk is already truncated)
1707 // Errata Service Release to the Bluetooth Specification: ESR09
1708 //   E6405 – Cross transport key derivation from a key of size less than 128 bits
1709 //   "Note: When the BR/EDR link key is being derived from the LTK, the derivation is done before the LTK gets masked."
1710 static void h6_calculate_ilk(sm_connection_t * sm_conn){
1711     h6_engine(sm_conn, setup->sm_local_ltk, 0x746D7031);    // "tmp1"
1712 }
1713 
1714 static void h6_calculate_br_edr_link_key(sm_connection_t * sm_conn){
1715     h6_engine(sm_conn, setup->sm_t, 0x6c656272);    // "lebr"
1716 }
1717 
1718 #endif
1719 
1720 // key management legacy connections:
1721 // - potentially two different LTKs based on direction. each device stores LTK provided by peer
1722 // - master stores LTK, EDIV, RAND. responder optionally stored master LTK (only if it needs to reconnect)
1723 // - initiators reconnects: initiator uses stored LTK, EDIV, RAND generated by responder
1724 // - responder  reconnects: responder uses LTK receveived from master
1725 
1726 // key management secure connections:
1727 // - both devices store same LTK from ECDH key exchange.
1728 
1729 #if defined(ENABLE_LE_SECURE_CONNECTIONS) || defined(ENABLE_LE_CENTRAL)
1730 static void sm_load_security_info(sm_connection_t * sm_connection){
1731     int encryption_key_size;
1732     int authenticated;
1733     int authorized;
1734 
1735     // fetch data from device db - incl. authenticated/authorized/key size. Note all sm_connection_X require encryption enabled
1736     le_device_db_encryption_get(sm_connection->sm_le_db_index, &setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1737                                 &encryption_key_size, &authenticated, &authorized);
1738     log_info("db index %u, key size %u, authenticated %u, authorized %u", sm_connection->sm_le_db_index, encryption_key_size, authenticated, authorized);
1739     sm_connection->sm_actual_encryption_key_size = encryption_key_size;
1740     sm_connection->sm_connection_authenticated = authenticated;
1741     sm_connection->sm_connection_authorization_state = authorized ? AUTHORIZATION_GRANTED : AUTHORIZATION_UNKNOWN;
1742 }
1743 #endif
1744 
1745 #ifdef ENABLE_LE_PERIPHERAL
1746 static void sm_start_calculating_ltk_from_ediv_and_rand(sm_connection_t * sm_connection){
1747     memcpy(setup->sm_local_rand, sm_connection->sm_local_rand, 8);
1748     setup->sm_local_ediv = sm_connection->sm_local_ediv;
1749     // re-establish used key encryption size
1750     // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
1751     sm_connection->sm_actual_encryption_key_size = (setup->sm_local_rand[7] & 0x0f) + 1;
1752     // no db for authenticated flag hack: flag is stored in bit 4 of LSB
1753     sm_connection->sm_connection_authenticated = (setup->sm_local_rand[7] & 0x10) >> 4;
1754     log_info("sm: received ltk request with key size %u, authenticated %u",
1755             sm_connection->sm_actual_encryption_key_size, sm_connection->sm_connection_authenticated);
1756     sm_connection->sm_engine_state = SM_RESPONDER_PH4_Y_GET_ENC;
1757     sm_run();
1758 }
1759 #endif
1760 
1761 static void sm_run(void){
1762 
1763     btstack_linked_list_iterator_t it;
1764 
1765     // assert that stack has already bootet
1766     if (hci_get_state() != HCI_STATE_WORKING) return;
1767 
1768     // assert that we can send at least commands
1769     if (!hci_can_send_command_packet_now()) return;
1770 
1771     //
1772     // non-connection related behaviour
1773     //
1774 
1775     // distributed key generation
1776     switch (dkg_state){
1777         case DKG_CALC_IRK:
1778             // already busy?
1779             if (sm_aes128_state == SM_AES128_IDLE) {
1780                 log_info("DKG_CALC_IRK started");
1781                 // IRK = d1(IR, 1, 0)
1782                 sm_d1_d_prime(1, 0, sm_aes128_plaintext);  // plaintext = d1 prime
1783                 sm_aes128_state = SM_AES128_ACTIVE;
1784                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_ir, sm_aes128_plaintext, sm_persistent_irk, sm_handle_encryption_result_dkg_irk, NULL);
1785                 return;
1786             }
1787             break;
1788         case DKG_CALC_DHK:
1789             // already busy?
1790             if (sm_aes128_state == SM_AES128_IDLE) {
1791                 log_info("DKG_CALC_DHK started");
1792                 // DHK = d1(IR, 3, 0)
1793                 sm_d1_d_prime(3, 0, sm_aes128_plaintext);  // plaintext = d1 prime
1794                 sm_aes128_state = SM_AES128_ACTIVE;
1795                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_ir, sm_aes128_plaintext, sm_persistent_dhk, sm_handle_encryption_result_dkg_dhk, NULL);
1796                 return;
1797             }
1798             break;
1799         default:
1800             break;
1801     }
1802 
1803     // random address updates
1804     switch (rau_state){
1805         case RAU_GET_ENC:
1806             // already busy?
1807             if (sm_aes128_state == SM_AES128_IDLE) {
1808                 sm_ah_r_prime(sm_random_address, sm_aes128_plaintext);
1809                 sm_aes128_state = SM_AES128_ACTIVE;
1810                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_irk, sm_aes128_plaintext, sm_aes128_ciphertext, sm_handle_encryption_result_rau, NULL);
1811                 return;
1812             }
1813             break;
1814         case RAU_SET_ADDRESS:
1815             log_info("New random address: %s", bd_addr_to_str(sm_random_address));
1816             rau_state = RAU_IDLE;
1817             hci_send_cmd(&hci_le_set_random_address, sm_random_address);
1818             return;
1819         default:
1820             break;
1821     }
1822 
1823     // CSRK Lookup
1824     // -- if csrk lookup ready, find connection that require csrk lookup
1825     if (sm_address_resolution_idle()){
1826         hci_connections_get_iterator(&it);
1827         while(btstack_linked_list_iterator_has_next(&it)){
1828             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1829             sm_connection_t  * sm_connection  = &hci_connection->sm_connection;
1830             if (sm_connection->sm_irk_lookup_state == IRK_LOOKUP_W4_READY){
1831                 // and start lookup
1832                 sm_address_resolution_start_lookup(sm_connection->sm_peer_addr_type, sm_connection->sm_handle, sm_connection->sm_peer_address, ADDRESS_RESOLUTION_FOR_CONNECTION, sm_connection);
1833                 sm_connection->sm_irk_lookup_state = IRK_LOOKUP_STARTED;
1834                 break;
1835             }
1836         }
1837     }
1838 
1839     // -- if csrk lookup ready, resolved addresses for received addresses
1840     if (sm_address_resolution_idle()) {
1841         if (!btstack_linked_list_empty(&sm_address_resolution_general_queue)){
1842             sm_lookup_entry_t * entry = (sm_lookup_entry_t *) sm_address_resolution_general_queue;
1843             btstack_linked_list_remove(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
1844             sm_address_resolution_start_lookup(entry->address_type, 0, entry->address, ADDRESS_RESOLUTION_GENERAL, NULL);
1845             btstack_memory_sm_lookup_entry_free(entry);
1846         }
1847     }
1848 
1849     // -- Continue with CSRK device lookup by public or resolvable private address
1850     if (!sm_address_resolution_idle()){
1851         log_info("LE Device Lookup: device %u/%u", sm_address_resolution_test, le_device_db_max_count());
1852         while (sm_address_resolution_test < le_device_db_max_count()){
1853             int addr_type;
1854             bd_addr_t addr;
1855             sm_key_t irk;
1856             le_device_db_info(sm_address_resolution_test, &addr_type, addr, irk);
1857             log_info("device type %u, addr: %s", addr_type, bd_addr_to_str(addr));
1858 
1859             if (sm_address_resolution_addr_type == addr_type && memcmp(addr, sm_address_resolution_address, 6) == 0){
1860                 log_info("LE Device Lookup: found CSRK by { addr_type, address} ");
1861                 sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
1862                 break;
1863             }
1864 
1865             if (sm_address_resolution_addr_type == 0){
1866                 sm_address_resolution_test++;
1867                 continue;
1868             }
1869 
1870             if (sm_aes128_state == SM_AES128_ACTIVE) break;
1871 
1872             log_info("LE Device Lookup: calculate AH");
1873             log_info_key("IRK", irk);
1874 
1875             memcpy(sm_aes128_key, irk, 16);
1876             sm_ah_r_prime(sm_address_resolution_address, sm_aes128_plaintext);
1877             sm_address_resolution_ah_calculation_active = 1;
1878             sm_aes128_state = SM_AES128_ACTIVE;
1879             btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_aes128_key, sm_aes128_plaintext, sm_aes128_ciphertext, sm_handle_encryption_result_address_resolution, NULL);
1880             return;
1881         }
1882 
1883         if (sm_address_resolution_test >= le_device_db_max_count()){
1884             log_info("LE Device Lookup: not found");
1885             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_FAILED);
1886         }
1887     }
1888 
1889 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1890     switch (sm_sc_oob_state){
1891         case SM_SC_OOB_W2_CALC_CONFIRM:
1892             if (!sm_cmac_ready()) break;
1893             sm_sc_oob_state = SM_SC_OOB_W4_CONFIRM;
1894             f4_engine(NULL, ec_q, ec_q, sm_sc_oob_random, 0);
1895             return;
1896         default:
1897             break;
1898     }
1899 #endif
1900 
1901     // assert that we can send at least commands - cmd might have been sent by crypto engine
1902     if (!hci_can_send_command_packet_now()) return;
1903 
1904     // handle basic actions that don't requires the full context
1905     hci_connections_get_iterator(&it);
1906     while((sm_active_connection_handle == HCI_CON_HANDLE_INVALID) && btstack_linked_list_iterator_has_next(&it)){
1907         hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1908         sm_connection_t  * sm_connection = &hci_connection->sm_connection;
1909         switch(sm_connection->sm_engine_state){
1910             // responder side
1911             case SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY:
1912                 sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
1913                 hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
1914                 return;
1915 
1916 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1917             case SM_SC_RECEIVED_LTK_REQUEST:
1918                 switch (sm_connection->sm_irk_lookup_state){
1919                     case IRK_LOOKUP_FAILED:
1920                         log_info("LTK Request: ediv & random are empty, but no stored LTK (IRK Lookup Failed)");
1921                         sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
1922                         hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
1923                         return;
1924                     default:
1925                         break;
1926                 }
1927                 break;
1928 #endif
1929             default:
1930                 break;
1931         }
1932     }
1933 
1934     //
1935     // active connection handling
1936     // -- use loop to handle next connection if lock on setup context is released
1937 
1938     while (1) {
1939 
1940         // Find connections that requires setup context and make active if no other is locked
1941         hci_connections_get_iterator(&it);
1942         while((sm_active_connection_handle == HCI_CON_HANDLE_INVALID) && btstack_linked_list_iterator_has_next(&it)){
1943             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1944             sm_connection_t  * sm_connection = &hci_connection->sm_connection;
1945             // - if no connection locked and we're ready/waiting for setup context, fetch it and start
1946             int done = 1;
1947             int err;
1948             UNUSED(err);
1949             switch (sm_connection->sm_engine_state) {
1950 #ifdef ENABLE_LE_PERIPHERAL
1951                 case SM_RESPONDER_SEND_SECURITY_REQUEST:
1952                     // send packet if possible,
1953                     if (l2cap_can_send_fixed_channel_packet_now(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)){
1954                         const uint8_t buffer[2] = { SM_CODE_SECURITY_REQUEST, SM_AUTHREQ_BONDING};
1955                         sm_connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_REQUEST;
1956                         l2cap_send_connectionless(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
1957                     } else {
1958                         l2cap_request_can_send_fix_channel_now_event(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
1959                     }
1960                     // don't lock sxetup context yet
1961                     done = 0;
1962                     break;
1963                 case SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED:
1964                     sm_reset_setup();
1965                     sm_init_setup(sm_connection);
1966                     // recover pairing request
1967                     memcpy(&setup->sm_m_preq, &sm_connection->sm_m_preq, sizeof(sm_pairing_packet_t));
1968                     err = sm_stk_generation_init(sm_connection);
1969 
1970 #ifdef ENABLE_TESTING_SUPPORT
1971                     if (0 < test_pairing_failure && test_pairing_failure < SM_REASON_DHKEY_CHECK_FAILED){
1972                         log_info("testing_support: respond with pairing failure %u", test_pairing_failure);
1973                         err = test_pairing_failure;
1974                     }
1975 #endif
1976                     if (err){
1977                         setup->sm_pairing_failed_reason = err;
1978                         sm_connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1979                         break;
1980                     }
1981                     sm_timeout_start(sm_connection);
1982                     // generate random number first, if we need to show passkey
1983                     if (setup->sm_stk_generation_method == PK_INIT_INPUT){
1984                         btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 8, &sm_handle_random_result_ph2_tk, sm_connection);
1985                         break;
1986                     }
1987                     sm_connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
1988                     break;
1989                 case SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST:
1990                     sm_reset_setup();
1991                     sm_start_calculating_ltk_from_ediv_and_rand(sm_connection);
1992                     break;
1993 #endif
1994 #ifdef ENABLE_LE_CENTRAL
1995                 case SM_INITIATOR_PH0_HAS_LTK:
1996                     sm_reset_setup();
1997                     sm_load_security_info(sm_connection);
1998                     sm_connection->sm_engine_state = SM_INITIATOR_PH0_SEND_START_ENCRYPTION;
1999                     break;
2000                 case SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST:
2001                     sm_reset_setup();
2002                     sm_init_setup(sm_connection);
2003                     sm_timeout_start(sm_connection);
2004                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_SEND_PAIRING_REQUEST;
2005                     break;
2006 #endif
2007 
2008 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2009                 case SM_SC_RECEIVED_LTK_REQUEST:
2010                     switch (sm_connection->sm_irk_lookup_state){
2011                         case IRK_LOOKUP_SUCCEEDED:
2012                             // assuming Secure Connection, we have a stored LTK and the EDIV/RAND are null
2013                             // start using context by loading security info
2014                             sm_reset_setup();
2015                             sm_load_security_info(sm_connection);
2016                             if (setup->sm_peer_ediv == 0 && sm_is_null_random(setup->sm_peer_rand) && !sm_is_null_key(setup->sm_peer_ltk)){
2017                                 memcpy(setup->sm_ltk, setup->sm_peer_ltk, 16);
2018                                 sm_connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK_REPLY;
2019                                 break;
2020                             }
2021                             log_info("LTK Request: ediv & random are empty, but no stored LTK (IRK Lookup Succeeded)");
2022                             sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
2023                             hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
2024                             // don't lock setup context yet
2025                             return;
2026                         default:
2027                             // just wait until IRK lookup is completed
2028                             // don't lock setup context yet
2029                             done = 0;
2030                             break;
2031                     }
2032                     break;
2033 #endif
2034                 default:
2035                     done = 0;
2036                     break;
2037             }
2038             if (done){
2039                 sm_active_connection_handle = sm_connection->sm_handle;
2040                 log_info("sm: connection 0x%04x locked setup context as %s, state %u", sm_active_connection_handle, sm_connection->sm_role ? "responder" : "initiator", sm_connection->sm_engine_state);
2041             }
2042         }
2043 
2044         //
2045         // active connection handling
2046         //
2047 
2048         if (sm_active_connection_handle == HCI_CON_HANDLE_INVALID) return;
2049 
2050         sm_connection_t * connection = sm_get_connection_for_handle(sm_active_connection_handle);
2051         if (!connection) {
2052             log_info("no connection for handle 0x%04x", sm_active_connection_handle);
2053             return;
2054         }
2055 
2056         // assert that we could send a SM PDU - not needed for all of the following
2057         if (!l2cap_can_send_fixed_channel_packet_now(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)) {
2058             log_info("cannot send now, requesting can send now event");
2059             l2cap_request_can_send_fix_channel_now_event(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
2060             return;
2061         }
2062 
2063         // send keypress notifications
2064         if (setup->sm_keypress_notification){
2065             int i;
2066             uint8_t flags       = setup->sm_keypress_notification & 0x1f;
2067             uint8_t num_actions = setup->sm_keypress_notification >> 5;
2068             uint8_t action = 0;
2069             for (i=SM_KEYPRESS_PASSKEY_ENTRY_STARTED;i<=SM_KEYPRESS_PASSKEY_ENTRY_COMPLETED;i++){
2070                 if (flags & (1<<i)){
2071                     int clear_flag = 1;
2072                     switch (i){
2073                         case SM_KEYPRESS_PASSKEY_ENTRY_STARTED:
2074                         case SM_KEYPRESS_PASSKEY_CLEARED:
2075                         case SM_KEYPRESS_PASSKEY_ENTRY_COMPLETED:
2076                         default:
2077                             break;
2078                         case SM_KEYPRESS_PASSKEY_DIGIT_ENTERED:
2079                         case SM_KEYPRESS_PASSKEY_DIGIT_ERASED:
2080                             num_actions--;
2081                             clear_flag = num_actions == 0;
2082                             break;
2083                     }
2084                     if (clear_flag){
2085                         flags &= ~(1<<i);
2086                     }
2087                     action = i;
2088                     break;
2089                 }
2090             }
2091             setup->sm_keypress_notification = (num_actions << 5) | flags;
2092 
2093             // send keypress notification
2094             uint8_t buffer[2];
2095             buffer[0] = SM_CODE_KEYPRESS_NOTIFICATION;
2096             buffer[1] = action;
2097             l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2098 
2099             // try
2100             l2cap_request_can_send_fix_channel_now_event(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
2101             return;
2102         }
2103 
2104         int key_distribution_flags;
2105         UNUSED(key_distribution_flags);
2106 
2107         log_info("sm_run: state %u", connection->sm_engine_state);
2108         if (!l2cap_can_send_fixed_channel_packet_now(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)) {
2109             log_info("sm_run // cannot send");
2110         }
2111         switch (connection->sm_engine_state){
2112 
2113             // general
2114             case SM_GENERAL_SEND_PAIRING_FAILED: {
2115                 uint8_t buffer[2];
2116                 buffer[0] = SM_CODE_PAIRING_FAILED;
2117                 buffer[1] = setup->sm_pairing_failed_reason;
2118                 connection->sm_engine_state = connection->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
2119                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2120                 sm_notify_client_status_reason(connection, ERROR_CODE_AUTHENTICATION_FAILURE, setup->sm_pairing_failed_reason);
2121                 sm_done_for_handle(connection->sm_handle);
2122                 break;
2123             }
2124 
2125             // responding state
2126 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2127             case SM_SC_W2_CMAC_FOR_CONFIRMATION:
2128                 if (!sm_cmac_ready()) break;
2129                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CONFIRMATION;
2130                 sm_sc_calculate_local_confirm(connection);
2131                 break;
2132             case SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION:
2133                 if (!sm_cmac_ready()) break;
2134                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION;
2135                 sm_sc_calculate_remote_confirm(connection);
2136                 break;
2137             case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
2138                 if (!sm_cmac_ready()) break;
2139                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK;
2140                 sm_sc_calculate_f6_for_dhkey_check(connection);
2141                 break;
2142             case SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
2143                 if (!sm_cmac_ready()) break;
2144                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
2145                 sm_sc_calculate_f6_to_verify_dhkey_check(connection);
2146                 break;
2147             case SM_SC_W2_CALCULATE_F5_SALT:
2148                 if (!sm_cmac_ready()) break;
2149                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_SALT;
2150                 f5_calculate_salt(connection);
2151                 break;
2152             case SM_SC_W2_CALCULATE_F5_MACKEY:
2153                 if (!sm_cmac_ready()) break;
2154                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_MACKEY;
2155                 f5_calculate_mackey(connection);
2156                 break;
2157             case SM_SC_W2_CALCULATE_F5_LTK:
2158                 if (!sm_cmac_ready()) break;
2159                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_LTK;
2160                 f5_calculate_ltk(connection);
2161                 break;
2162             case SM_SC_W2_CALCULATE_G2:
2163                 if (!sm_cmac_ready()) break;
2164                 connection->sm_engine_state = SM_SC_W4_CALCULATE_G2;
2165                 g2_calculate(connection);
2166                 break;
2167             case SM_SC_W2_CALCULATE_H6_ILK:
2168                 if (!sm_cmac_ready()) break;
2169                 connection->sm_engine_state = SM_SC_W4_CALCULATE_H6_ILK;
2170                 h6_calculate_ilk(connection);
2171                 break;
2172             case SM_SC_W2_CALCULATE_H6_BR_EDR_LINK_KEY:
2173                 if (!sm_cmac_ready()) break;
2174                 connection->sm_engine_state = SM_SC_W4_CALCULATE_H6_BR_EDR_LINK_KEY;
2175                 h6_calculate_br_edr_link_key(connection);
2176                 break;
2177 #endif
2178 
2179 #ifdef ENABLE_LE_CENTRAL
2180             // initiator side
2181             case SM_INITIATOR_PH0_SEND_START_ENCRYPTION: {
2182                 sm_key_t peer_ltk_flipped;
2183                 reverse_128(setup->sm_peer_ltk, peer_ltk_flipped);
2184                 connection->sm_engine_state = SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED;
2185                 log_info("sm: hci_le_start_encryption ediv 0x%04x", setup->sm_peer_ediv);
2186                 uint32_t rand_high = big_endian_read_32(setup->sm_peer_rand, 0);
2187                 uint32_t rand_low  = big_endian_read_32(setup->sm_peer_rand, 4);
2188                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle,rand_low, rand_high, setup->sm_peer_ediv, peer_ltk_flipped);
2189                 return;
2190             }
2191 
2192             case SM_INITIATOR_PH1_SEND_PAIRING_REQUEST:
2193                 sm_pairing_packet_set_code(setup->sm_m_preq, SM_CODE_PAIRING_REQUEST);
2194                 connection->sm_engine_state = SM_INITIATOR_PH1_W4_PAIRING_RESPONSE;
2195                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_m_preq, sizeof(sm_pairing_packet_t));
2196                 sm_timeout_reset(connection);
2197                 break;
2198 #endif
2199 
2200 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2201 
2202             case SM_SC_SEND_PUBLIC_KEY_COMMAND: {
2203                 int trigger_user_response = 0;
2204 
2205                 uint8_t buffer[65];
2206                 buffer[0] = SM_CODE_PAIRING_PUBLIC_KEY;
2207                 //
2208                 reverse_256(&ec_q[0],  &buffer[1]);
2209                 reverse_256(&ec_q[32], &buffer[33]);
2210 
2211                 // stk generation method
2212                 // passkey entry: notify app to show passkey or to request passkey
2213                 switch (setup->sm_stk_generation_method){
2214                     case JUST_WORKS:
2215                     case NUMERIC_COMPARISON:
2216                         if (IS_RESPONDER(connection->sm_role)){
2217                             // responder
2218                             sm_sc_start_calculating_local_confirm(connection);
2219                         } else {
2220                             // initiator
2221                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2222                         }
2223                         break;
2224                     case PK_INIT_INPUT:
2225                     case PK_RESP_INPUT:
2226                     case PK_BOTH_INPUT:
2227                         // use random TK for display
2228                         memcpy(setup->sm_ra, setup->sm_tk, 16);
2229                         memcpy(setup->sm_rb, setup->sm_tk, 16);
2230                         setup->sm_passkey_bit = 0;
2231 
2232                         if (IS_RESPONDER(connection->sm_role)){
2233                             // responder
2234                             connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2235                         } else {
2236                             // initiator
2237                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2238                         }
2239                         trigger_user_response = 1;
2240                         break;
2241                     case OOB:
2242                         if (IS_RESPONDER(connection->sm_role)){
2243                             // responder
2244                             connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2245                         } else {
2246                             // initiator
2247                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2248                         }
2249                         break;
2250                 }
2251 
2252                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2253                 sm_timeout_reset(connection);
2254 
2255                 // trigger user response after sending pdu
2256                 if (trigger_user_response){
2257                     sm_trigger_user_response(connection);
2258                 }
2259                 break;
2260             }
2261             case SM_SC_SEND_CONFIRMATION: {
2262                 uint8_t buffer[17];
2263                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2264                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2265                 if (IS_RESPONDER(connection->sm_role)){
2266                     connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2267                 } else {
2268                     connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2269                 }
2270                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2271                 sm_timeout_reset(connection);
2272                 break;
2273             }
2274             case SM_SC_SEND_PAIRING_RANDOM: {
2275                 uint8_t buffer[17];
2276                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2277                 reverse_128(setup->sm_local_nonce, &buffer[1]);
2278                 log_info("stk method %u, num bits %u", setup->sm_stk_generation_method, setup->sm_passkey_bit);
2279                 if (sm_passkey_entry(setup->sm_stk_generation_method) && setup->sm_passkey_bit < 20){
2280                     log_info("SM_SC_SEND_PAIRING_RANDOM A");
2281                     if (IS_RESPONDER(connection->sm_role)){
2282                         // responder
2283                         connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2284                     } else {
2285                         // initiator
2286                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2287                     }
2288                 } else {
2289                     log_info("SM_SC_SEND_PAIRING_RANDOM B");
2290                     if (IS_RESPONDER(connection->sm_role)){
2291                         // responder
2292                         if (setup->sm_stk_generation_method == NUMERIC_COMPARISON){
2293                             log_info("SM_SC_SEND_PAIRING_RANDOM B1");
2294                             connection->sm_engine_state = SM_SC_W2_CALCULATE_G2;
2295                         } else {
2296                             log_info("SM_SC_SEND_PAIRING_RANDOM B2");
2297                             sm_sc_prepare_dhkey_check(connection);
2298                         }
2299                     } else {
2300                         // initiator
2301                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2302                     }
2303                 }
2304                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2305                 sm_timeout_reset(connection);
2306                 break;
2307             }
2308             case SM_SC_SEND_DHKEY_CHECK_COMMAND: {
2309                 uint8_t buffer[17];
2310                 buffer[0] = SM_CODE_PAIRING_DHKEY_CHECK;
2311                 reverse_128(setup->sm_local_dhkey_check, &buffer[1]);
2312 
2313                 if (IS_RESPONDER(connection->sm_role)){
2314                     connection->sm_engine_state = SM_SC_W4_LTK_REQUEST_SC;
2315                 } else {
2316                     connection->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
2317                 }
2318 
2319                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2320                 sm_timeout_reset(connection);
2321                 break;
2322             }
2323 
2324 #endif
2325 
2326 #ifdef ENABLE_LE_PERIPHERAL
2327             case SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE:
2328                 // echo initiator for now
2329                 sm_pairing_packet_set_code(setup->sm_s_pres,SM_CODE_PAIRING_RESPONSE);
2330                 key_distribution_flags = sm_key_distribution_flags_for_auth_req();
2331 
2332                 if (setup->sm_use_secure_connections){
2333                     connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2334                 } else {
2335                     connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_CONFIRM;
2336                 }
2337 
2338                 sm_pairing_packet_set_initiator_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_initiator_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2339                 sm_pairing_packet_set_responder_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2340                 // update key distribution after ENC was dropped
2341                 sm_setup_key_distribution(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
2342 
2343                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_s_pres, sizeof(sm_pairing_packet_t));
2344                 sm_timeout_reset(connection);
2345                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
2346                 if (!setup->sm_use_secure_connections || setup->sm_stk_generation_method == JUST_WORKS){
2347                     sm_trigger_user_response(connection);
2348                 }
2349                 return;
2350 #endif
2351 
2352             case SM_PH2_SEND_PAIRING_RANDOM: {
2353                 uint8_t buffer[17];
2354                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2355                 reverse_128(setup->sm_local_random, &buffer[1]);
2356                 if (IS_RESPONDER(connection->sm_role)){
2357                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_LTK_REQUEST;
2358                 } else {
2359                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_RANDOM;
2360                 }
2361                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2362                 sm_timeout_reset(connection);
2363                 break;
2364             }
2365 
2366             case SM_PH2_C1_GET_ENC_A:
2367                 // already busy?
2368                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2369                 // calculate confirm using aes128 engine - step 1
2370                 sm_c1_t1(setup->sm_local_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, sm_aes128_plaintext);
2371                 connection->sm_engine_state = SM_PH2_C1_W4_ENC_A;
2372                 sm_aes128_state = SM_AES128_ACTIVE;
2373                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, setup->sm_tk, sm_aes128_plaintext, sm_aes128_ciphertext, sm_handle_encryption_result_enc_a, connection);
2374                 break;
2375 
2376             case SM_PH2_C1_GET_ENC_C:
2377                 // already busy?
2378                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2379                 // calculate m_confirm using aes128 engine - step 1
2380                 sm_c1_t1(setup->sm_peer_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, sm_aes128_plaintext);
2381                 connection->sm_engine_state = SM_PH2_C1_W4_ENC_C;
2382                 sm_aes128_state = SM_AES128_ACTIVE;
2383                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, setup->sm_tk, sm_aes128_plaintext, sm_aes128_ciphertext, sm_handle_encryption_result_enc_c, connection);
2384                 break;
2385 
2386             case SM_PH2_CALC_STK:
2387                 // already busy?
2388                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2389                 // calculate STK
2390                 if (IS_RESPONDER(connection->sm_role)){
2391                     sm_s1_r_prime(setup->sm_local_random, setup->sm_peer_random, sm_aes128_plaintext);
2392                 } else {
2393                     sm_s1_r_prime(setup->sm_peer_random, setup->sm_local_random, sm_aes128_plaintext);
2394                 }
2395                 connection->sm_engine_state = SM_PH2_W4_STK;
2396                 sm_aes128_state = SM_AES128_ACTIVE;
2397                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, setup->sm_tk, sm_aes128_plaintext, setup->sm_ltk, sm_handle_encryption_result_enc_stk, connection);
2398                 break;
2399 
2400             case SM_PH3_Y_GET_ENC:
2401                 // already busy?
2402                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2403                 // PH3B2 - calculate Y from      - enc
2404                 // Y = dm(DHK, Rand)
2405                 sm_dm_r_prime(setup->sm_local_rand, sm_aes128_plaintext);
2406                 connection->sm_engine_state = SM_PH3_Y_W4_ENC;
2407                 sm_aes128_state = SM_AES128_ACTIVE;
2408                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_dhk, sm_aes128_plaintext, sm_aes128_ciphertext, sm_handle_encryption_result_enc_ph3_y, connection);
2409                 break;
2410 
2411             case SM_PH2_C1_SEND_PAIRING_CONFIRM: {
2412                 uint8_t buffer[17];
2413                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2414                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2415                 if (IS_RESPONDER(connection->sm_role)){
2416                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_PAIRING_RANDOM;
2417                 } else {
2418                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_CONFIRM;
2419                 }
2420                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2421                 sm_timeout_reset(connection);
2422                 return;
2423             }
2424 #ifdef ENABLE_LE_PERIPHERAL
2425             case SM_RESPONDER_PH2_SEND_LTK_REPLY: {
2426                 sm_key_t stk_flipped;
2427                 reverse_128(setup->sm_ltk, stk_flipped);
2428                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2429                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, stk_flipped);
2430                 return;
2431             }
2432             case SM_RESPONDER_PH4_SEND_LTK_REPLY: {
2433                 sm_key_t ltk_flipped;
2434                 reverse_128(setup->sm_ltk, ltk_flipped);
2435                 connection->sm_engine_state = SM_RESPONDER_IDLE;
2436                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, ltk_flipped);
2437                 sm_done_for_handle(connection->sm_handle);
2438                 return;
2439             }
2440             case SM_RESPONDER_PH4_Y_GET_ENC:
2441                 // already busy?
2442                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2443                 log_info("LTK Request: recalculating with ediv 0x%04x", setup->sm_local_ediv);
2444                 // Y = dm(DHK, Rand)
2445                 sm_dm_r_prime(setup->sm_local_rand, sm_aes128_plaintext);
2446                 connection->sm_engine_state = SM_RESPONDER_PH4_Y_W4_ENC;
2447                 sm_aes128_state = SM_AES128_ACTIVE;
2448                 btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_dhk, sm_aes128_plaintext, sm_aes128_ciphertext, sm_handle_encryption_result_enc_ph4_y, connection);
2449                 return;
2450 #endif
2451 #ifdef ENABLE_LE_CENTRAL
2452             case SM_INITIATOR_PH3_SEND_START_ENCRYPTION: {
2453                 sm_key_t stk_flipped;
2454                 reverse_128(setup->sm_ltk, stk_flipped);
2455                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2456                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle, 0, 0, 0, stk_flipped);
2457                 return;
2458             }
2459 #endif
2460 
2461             case SM_PH3_DISTRIBUTE_KEYS:
2462                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION){
2463                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
2464                     uint8_t buffer[17];
2465                     buffer[0] = SM_CODE_ENCRYPTION_INFORMATION;
2466                     reverse_128(setup->sm_ltk, &buffer[1]);
2467                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2468                     sm_timeout_reset(connection);
2469                     return;
2470                 }
2471                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_MASTER_IDENTIFICATION){
2472                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
2473                     uint8_t buffer[11];
2474                     buffer[0] = SM_CODE_MASTER_IDENTIFICATION;
2475                     little_endian_store_16(buffer, 1, setup->sm_local_ediv);
2476                     reverse_64(setup->sm_local_rand, &buffer[3]);
2477                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2478                     sm_timeout_reset(connection);
2479                     return;
2480                 }
2481                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
2482                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
2483                     uint8_t buffer[17];
2484                     buffer[0] = SM_CODE_IDENTITY_INFORMATION;
2485                     reverse_128(sm_persistent_irk, &buffer[1]);
2486                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2487                     sm_timeout_reset(connection);
2488                     return;
2489                 }
2490                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION){
2491                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
2492                     bd_addr_t local_address;
2493                     uint8_t buffer[8];
2494                     buffer[0] = SM_CODE_IDENTITY_ADDRESS_INFORMATION;
2495                     switch (gap_random_address_get_mode()){
2496                         case GAP_RANDOM_ADDRESS_TYPE_OFF:
2497                         case GAP_RANDOM_ADDRESS_TYPE_STATIC:
2498                             // public or static random
2499                             gap_le_get_own_address(&buffer[1], local_address);
2500                             break;
2501                         case GAP_RANDOM_ADDRESS_NON_RESOLVABLE:
2502                         case GAP_RANDOM_ADDRESS_RESOLVABLE:
2503                             // fallback to public
2504                             gap_local_bd_addr(local_address);
2505                             buffer[1] = 0;
2506                             break;
2507                     }
2508                     reverse_bd_addr(local_address, &buffer[2]);
2509                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2510                     sm_timeout_reset(connection);
2511                     return;
2512                 }
2513                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
2514                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
2515 
2516                     // hack to reproduce test runs
2517                     if (test_use_fixed_local_csrk){
2518                         memset(setup->sm_local_csrk, 0xcc, 16);
2519                     }
2520 
2521                     uint8_t buffer[17];
2522                     buffer[0] = SM_CODE_SIGNING_INFORMATION;
2523                     reverse_128(setup->sm_local_csrk, &buffer[1]);
2524                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2525                     sm_timeout_reset(connection);
2526                     return;
2527                 }
2528 
2529                 // keys are sent
2530                 if (IS_RESPONDER(connection->sm_role)){
2531                     // slave -> receive master keys if any
2532                     if (sm_key_distribution_all_received(connection)){
2533                         sm_key_distribution_handle_all_received(connection);
2534                         connection->sm_engine_state = SM_RESPONDER_IDLE;
2535                         sm_notify_client_status_reason(connection, ERROR_CODE_SUCCESS, 0);
2536                         sm_done_for_handle(connection->sm_handle);
2537                     } else {
2538                         connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2539                     }
2540                 } else {
2541                     // master -> all done
2542                     connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2543                     sm_notify_client_status_reason(connection, ERROR_CODE_SUCCESS, 0);
2544                     sm_done_for_handle(connection->sm_handle);
2545                 }
2546                 break;
2547 
2548             default:
2549                 break;
2550         }
2551 
2552         // check again if active connection was released
2553         if (sm_active_connection_handle != HCI_CON_HANDLE_INVALID) break;
2554     }
2555 }
2556 
2557 // sm_aes128_state stays active
2558 static void sm_handle_encryption_result_enc_a(void *arg){
2559     sm_connection_t * connection = (sm_connection_t*) arg;
2560     sm_c1_t3(sm_aes128_ciphertext, setup->sm_m_address, setup->sm_s_address, setup->sm_c1_t3_value);
2561     btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, setup->sm_tk, setup->sm_c1_t3_value, setup->sm_local_confirm, sm_handle_encryption_result_enc_b, connection);
2562 }
2563 
2564 static void sm_handle_encryption_result_enc_b(void *arg){
2565     sm_connection_t * connection = (sm_connection_t*) arg;
2566     sm_aes128_state = SM_AES128_IDLE;
2567     log_info_key("c1!", setup->sm_local_confirm);
2568     connection->sm_engine_state = SM_PH2_C1_SEND_PAIRING_CONFIRM;
2569     sm_run();
2570 }
2571 
2572 // sm_aes128_state stays active
2573 static void sm_handle_encryption_result_enc_c(void *arg){
2574     sm_connection_t * connection = (sm_connection_t*) arg;
2575     sm_c1_t3(sm_aes128_ciphertext, setup->sm_m_address, setup->sm_s_address, setup->sm_c1_t3_value);
2576     btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, setup->sm_tk, setup->sm_c1_t3_value, sm_aes128_ciphertext, sm_handle_encryption_result_enc_d, connection);
2577 }
2578 
2579 static void sm_handle_encryption_result_enc_d(void * arg){
2580     sm_connection_t * connection = (sm_connection_t*) arg;
2581     sm_aes128_state = SM_AES128_IDLE;
2582     log_info_key("c1!", sm_aes128_ciphertext);
2583     if (memcmp(setup->sm_peer_confirm, sm_aes128_ciphertext, 16) != 0){
2584         setup->sm_pairing_failed_reason = SM_REASON_CONFIRM_VALUE_FAILED;
2585         connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
2586         sm_run();
2587         return;
2588     }
2589     if (IS_RESPONDER(connection->sm_role)){
2590         connection->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
2591         sm_run();
2592     } else {
2593         sm_s1_r_prime(setup->sm_peer_random, setup->sm_local_random, sm_aes128_plaintext);
2594         sm_aes128_state = SM_AES128_ACTIVE;
2595         btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, setup->sm_tk, sm_aes128_plaintext, setup->sm_ltk, sm_handle_encryption_result_enc_stk, connection);
2596     }
2597 }
2598 
2599 static void sm_handle_encryption_result_enc_stk(void *arg){
2600     sm_connection_t * connection = (sm_connection_t*) arg;
2601     sm_aes128_state = SM_AES128_IDLE;
2602     sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2603     log_info_key("stk", setup->sm_ltk);
2604     if (IS_RESPONDER(connection->sm_role)){
2605         connection->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2606     } else {
2607         connection->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
2608     }
2609     sm_run();
2610 }
2611 
2612 // sm_aes128_state stays active
2613 static void sm_handle_encryption_result_enc_ph3_y(void *arg){
2614     sm_connection_t * connection = (sm_connection_t*) arg;
2615     setup->sm_local_y = big_endian_read_16(sm_aes128_ciphertext, 14);
2616     log_info_hex16("y", setup->sm_local_y);
2617     // PH3B3 - calculate EDIV
2618     setup->sm_local_ediv = setup->sm_local_y ^ setup->sm_local_div;
2619     log_info_hex16("ediv", setup->sm_local_ediv);
2620     // PH3B4 - calculate LTK         - enc
2621     // LTK = d1(ER, DIV, 0))
2622     sm_d1_d_prime(setup->sm_local_div, 0, sm_aes128_plaintext);
2623     btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_er, sm_aes128_plaintext, setup->sm_ltk, sm_handle_encryption_result_enc_ph3_ltk, connection);
2624 }
2625 
2626 #ifdef ENABLE_LE_PERIPHERAL
2627 // sm_aes128_state stays active
2628 static void sm_handle_encryption_result_enc_ph4_y(void *arg){
2629     sm_connection_t * connection = (sm_connection_t*) arg;
2630     setup->sm_local_y = big_endian_read_16(sm_aes128_ciphertext, 14);
2631     log_info_hex16("y", setup->sm_local_y);
2632 
2633     // PH3B3 - calculate DIV
2634     setup->sm_local_div = setup->sm_local_y ^ setup->sm_local_ediv;
2635     log_info_hex16("ediv", setup->sm_local_ediv);
2636     // PH3B4 - calculate LTK         - enc
2637     // LTK = d1(ER, DIV, 0))
2638     sm_d1_d_prime(setup->sm_local_div, 0, sm_aes128_plaintext);
2639     btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_er, sm_aes128_plaintext, setup->sm_ltk, sm_handle_encryption_result_enc_ph4_ltk, connection);
2640 }
2641 #endif
2642 
2643 // sm_aes128_state stays active
2644 static void sm_handle_encryption_result_enc_ph3_ltk(void *arg){
2645     sm_connection_t * connection = (sm_connection_t*) arg;
2646     log_info_key("ltk", setup->sm_ltk);
2647     // calc CSRK next
2648     sm_d1_d_prime(setup->sm_local_div, 1, sm_aes128_plaintext);
2649     btstack_crypto_aes128_encrypt(&sm_crypto_aes128_request, sm_persistent_er, sm_aes128_plaintext, setup->sm_local_csrk, sm_handle_encryption_result_enc_csrk, connection);
2650 }
2651 
2652 static void sm_handle_encryption_result_enc_csrk(void *arg){
2653     sm_connection_t * connection = (sm_connection_t*) arg;
2654     sm_aes128_state = SM_AES128_IDLE;
2655     log_info_key("csrk", setup->sm_local_csrk);
2656     if (setup->sm_key_distribution_send_set){
2657         connection->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
2658     } else {
2659         // no keys to send, just continue
2660         if (IS_RESPONDER(connection->sm_role)){
2661             // slave -> receive master keys
2662             connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2663         } else {
2664             if (setup->sm_use_secure_connections && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION)){
2665                 connection->sm_engine_state = SM_SC_W2_CALCULATE_H6_ILK;
2666             } else {
2667                 // master -> all done
2668                 connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2669                 sm_done_for_handle(connection->sm_handle);
2670             }
2671         }
2672     }
2673     sm_run();
2674 }
2675 
2676 #ifdef ENABLE_LE_PERIPHERAL
2677 static void sm_handle_encryption_result_enc_ph4_ltk(void *arg){
2678     sm_connection_t * connection = (sm_connection_t*) arg;
2679     sm_aes128_state = SM_AES128_IDLE;
2680     sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2681     log_info_key("ltk", setup->sm_ltk);
2682     connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK_REPLY;
2683     sm_run();
2684 }
2685 #endif
2686 
2687 static void sm_handle_encryption_result_address_resolution(void *arg){
2688     UNUSED(arg);
2689     sm_aes128_state = SM_AES128_IDLE;
2690     sm_address_resolution_ah_calculation_active = 0;
2691     // compare calulated address against connecting device
2692     uint8_t * hash = &sm_aes128_ciphertext[13];
2693     if (memcmp(&sm_address_resolution_address[3], hash, 3) == 0){
2694         log_info("LE Device Lookup: matched resolvable private address");
2695         sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
2696         sm_run();
2697         return;
2698     }
2699     // no match, try next
2700     sm_address_resolution_test++;
2701     sm_run();
2702 }
2703 
2704 static void sm_handle_encryption_result_dkg_irk(void *arg){
2705     UNUSED(arg);
2706     sm_aes128_state = SM_AES128_IDLE;
2707     log_info_key("irk", sm_persistent_irk);
2708     dkg_state = DKG_CALC_DHK;
2709     sm_run();
2710 }
2711 
2712 static void sm_handle_encryption_result_dkg_dhk(void *arg){
2713     UNUSED(arg);
2714     sm_aes128_state = SM_AES128_IDLE;
2715     log_info_key("dhk", sm_persistent_dhk);
2716     dkg_state = DKG_READY;
2717     // DKG calculation complete => SM Init Finished
2718     sm_run();
2719 }
2720 
2721 static void sm_handle_encryption_result_rau(void *arg){
2722     UNUSED(arg);
2723     sm_aes128_state = SM_AES128_IDLE;
2724     memcpy(&sm_random_address[3], &sm_aes128_ciphertext[13], 3);
2725     rau_state = RAU_SET_ADDRESS;
2726     sm_run();
2727 }
2728 
2729 static void sm_handle_random_result_rau(void * arg){
2730     UNUSED(arg);
2731     // non-resolvable vs. resolvable
2732     switch (gap_random_adress_type){
2733         case GAP_RANDOM_ADDRESS_RESOLVABLE:
2734             // resolvable: use random as prand and calc address hash
2735             // "The two most significant bits of prand shall be equal to ‘0’ and ‘1"
2736             sm_random_address[0] &= 0x3f;
2737             sm_random_address[0] |= 0x40;
2738             rau_state = RAU_GET_ENC;
2739             break;
2740         case GAP_RANDOM_ADDRESS_NON_RESOLVABLE:
2741         default:
2742             // "The two most significant bits of the address shall be equal to ‘0’""
2743             sm_random_address[0] &= 0x3f;
2744             rau_state = RAU_SET_ADDRESS;
2745             break;
2746     }
2747     sm_run();
2748 }
2749 
2750 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2751 static void sm_handle_random_result_sc_get_random(void * arg){
2752     sm_connection_t * connection = (sm_connection_t*) arg;
2753 
2754     // OOB
2755     if (setup->sm_stk_generation_method == OOB){
2756         connection->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
2757         sm_run();
2758         return;
2759     }
2760 
2761     // initiator & jw/nc -> send pairing random
2762     if (connection->sm_role == 0 && sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
2763         connection->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
2764     } else {
2765         connection->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
2766     }
2767     sm_run();
2768 }
2769 #endif
2770 
2771 static void sm_handle_random_result_ph2_random(void * arg){
2772     sm_connection_t * connection = (sm_connection_t*) arg;
2773     connection->sm_engine_state = SM_PH2_C1_GET_ENC_A;
2774     sm_run();
2775 }
2776 
2777 static void sm_handle_random_result_ph2_tk(void * arg){
2778     sm_connection_t * connection = (sm_connection_t*) arg;
2779     sm_reset_tk();
2780     uint32_t tk;
2781     if (sm_fixed_passkey_in_display_role == 0xffffffff){
2782         // map random to 0-999999 without speding much cycles on a modulus operation
2783         tk = little_endian_read_32(sm_random_data,0);
2784         tk = tk & 0xfffff;  // 1048575
2785         if (tk >= 999999){
2786             tk = tk - 999999;
2787         }
2788     } else {
2789         // override with pre-defined passkey
2790         tk = sm_fixed_passkey_in_display_role;
2791     }
2792     big_endian_store_32(setup->sm_tk, 12, tk);
2793     if (IS_RESPONDER(connection->sm_role)){
2794         connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
2795     } else {
2796         if (setup->sm_use_secure_connections){
2797             connection->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
2798         } else {
2799             connection->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
2800             sm_trigger_user_response(connection);
2801             // response_idle == nothing <--> sm_trigger_user_response() did not require response
2802             if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
2803                 btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_random, 16, &sm_handle_random_result_ph2_random, connection);
2804             }
2805         }
2806     }
2807     sm_run();
2808 }
2809 
2810 static void sm_handle_random_result_ph3_div(void * arg){
2811     sm_connection_t * connection = (sm_connection_t*) arg;
2812     // use 16 bit from random value as div
2813     setup->sm_local_div = big_endian_read_16(sm_random_data, 0);
2814     log_info_hex16("div", setup->sm_local_div);
2815     connection->sm_engine_state = SM_PH3_Y_GET_ENC;
2816     sm_run();
2817 }
2818 
2819 static void sm_handle_random_result_ph3_random(void * arg){
2820     sm_connection_t * connection = (sm_connection_t*) arg;
2821     reverse_64(sm_random_data, setup->sm_local_rand);
2822     // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
2823     setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xf0) + (connection->sm_actual_encryption_key_size - 1);
2824     // no db for authenticated flag hack: store flag in bit 4 of LSB
2825     setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xef) + (connection->sm_connection_authenticated << 4);
2826     btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 2, &sm_handle_random_result_ph3_div, connection);
2827 }
2828 
2829 static void sm_event_packet_handler (uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
2830 
2831     UNUSED(channel);    // ok: there is no channel
2832     UNUSED(size);       // ok: fixed format HCI events
2833 
2834     sm_connection_t  * sm_conn;
2835     hci_con_handle_t con_handle;
2836 
2837     switch (packet_type) {
2838 
2839 		case HCI_EVENT_PACKET:
2840 			switch (hci_event_packet_get_type(packet)) {
2841 
2842                 case BTSTACK_EVENT_STATE:
2843 					// bt stack activated, get started
2844 					if (btstack_event_state_get_state(packet) == HCI_STATE_WORKING){
2845                         log_info("HCI Working!");
2846 
2847                         dkg_state = sm_persistent_irk_ready ? DKG_CALC_DHK : DKG_CALC_IRK;
2848 
2849                         // trigger Random Address generation if requested before
2850                         switch (gap_random_adress_type){
2851                             case GAP_RANDOM_ADDRESS_TYPE_OFF:
2852                                 rau_state = RAU_IDLE;
2853                                 break;
2854                             case GAP_RANDOM_ADDRESS_TYPE_STATIC:
2855                                 rau_state = RAU_SET_ADDRESS;
2856                                 break;
2857                             default:
2858                                 rau_state = RAU_W4_RANDOM;
2859                                 btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_address, 8, &sm_handle_random_result_rau, NULL);
2860                                 break;
2861                         }
2862                         sm_run();
2863 					}
2864 					break;
2865 
2866                 case HCI_EVENT_LE_META:
2867                     switch (packet[2]) {
2868                         case HCI_SUBEVENT_LE_CONNECTION_COMPLETE:
2869 
2870                             log_info("sm: connected");
2871 
2872                             if (packet[3]) return; // connection failed
2873 
2874                             con_handle = little_endian_read_16(packet, 4);
2875                             sm_conn = sm_get_connection_for_handle(con_handle);
2876                             if (!sm_conn) break;
2877 
2878                             sm_conn->sm_handle = con_handle;
2879                             sm_conn->sm_role = packet[6];
2880                             sm_conn->sm_peer_addr_type = packet[7];
2881                             reverse_bd_addr(&packet[8], sm_conn->sm_peer_address);
2882 
2883                             log_info("New sm_conn, role %s", sm_conn->sm_role ? "slave" : "master");
2884 
2885                             // reset security properties
2886                             sm_conn->sm_connection_encrypted = 0;
2887                             sm_conn->sm_connection_authenticated = 0;
2888                             sm_conn->sm_connection_authorization_state = AUTHORIZATION_UNKNOWN;
2889                             sm_conn->sm_le_db_index = -1;
2890 
2891                             // prepare CSRK lookup (does not involve setup)
2892                             sm_conn->sm_irk_lookup_state = IRK_LOOKUP_W4_READY;
2893 
2894                             // just connected -> everything else happens in sm_run()
2895                             if (IS_RESPONDER(sm_conn->sm_role)){
2896                                 // slave - state already could be SM_RESPONDER_SEND_SECURITY_REQUEST instead
2897                                 if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
2898                                     if (sm_slave_request_security) {
2899                                         // request security if requested by app
2900                                         sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
2901                                     } else {
2902                                         // otherwise, wait for pairing request
2903                                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
2904                                     }
2905                                 }
2906                                 break;
2907                             } else {
2908                                 // master
2909                                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2910                             }
2911                             break;
2912 
2913                         case HCI_SUBEVENT_LE_LONG_TERM_KEY_REQUEST:
2914                             con_handle = little_endian_read_16(packet, 3);
2915                             sm_conn = sm_get_connection_for_handle(con_handle);
2916                             if (!sm_conn) break;
2917 
2918                             log_info("LTK Request: state %u", sm_conn->sm_engine_state);
2919                             if (sm_conn->sm_engine_state == SM_RESPONDER_PH2_W4_LTK_REQUEST){
2920                                 sm_conn->sm_engine_state = SM_PH2_CALC_STK;
2921                                 break;
2922                             }
2923                             if (sm_conn->sm_engine_state == SM_SC_W4_LTK_REQUEST_SC){
2924                                 // PH2 SEND LTK as we need to exchange keys in PH3
2925                                 sm_conn->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2926                                 break;
2927                             }
2928 
2929                             // store rand and ediv
2930                             reverse_64(&packet[5], sm_conn->sm_local_rand);
2931                             sm_conn->sm_local_ediv = little_endian_read_16(packet, 13);
2932 
2933                             // For Legacy Pairing (<=> EDIV != 0 || RAND != NULL), we need to recalculated our LTK as a
2934                             // potentially stored LTK is from the master
2935                             if (sm_conn->sm_local_ediv != 0 || !sm_is_null_random(sm_conn->sm_local_rand)){
2936                                 if (sm_reconstruct_ltk_without_le_device_db_entry){
2937                                     sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST;
2938                                     break;
2939                                 }
2940                                 // additionally check if remote is in LE Device DB if requested
2941                                 switch(sm_conn->sm_irk_lookup_state){
2942                                     case IRK_LOOKUP_FAILED:
2943                                         log_info("LTK Request: device not in device db");
2944                                         sm_conn->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
2945                                         break;
2946                                     case IRK_LOOKUP_SUCCEEDED:
2947                                         sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST;
2948                                         break;
2949                                     default:
2950                                         // wait for irk look doen
2951                                         sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK_W4_IRK;
2952                                         break;
2953                                 }
2954                                 break;
2955                             }
2956 
2957 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2958                             sm_conn->sm_engine_state = SM_SC_RECEIVED_LTK_REQUEST;
2959 #else
2960                             log_info("LTK Request: ediv & random are empty, but LE Secure Connections not supported");
2961                             sm_conn->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
2962 #endif
2963                             break;
2964 
2965                         default:
2966                             break;
2967                     }
2968                     break;
2969 
2970                 case HCI_EVENT_ENCRYPTION_CHANGE:
2971                     con_handle = little_endian_read_16(packet, 3);
2972                     sm_conn = sm_get_connection_for_handle(con_handle);
2973                     if (!sm_conn) break;
2974 
2975                     sm_conn->sm_connection_encrypted = packet[5];
2976                     log_info("Encryption state change: %u, key size %u", sm_conn->sm_connection_encrypted,
2977                         sm_conn->sm_actual_encryption_key_size);
2978                     log_info("event handler, state %u", sm_conn->sm_engine_state);
2979                     if (!sm_conn->sm_connection_encrypted) break;
2980                     // continue if part of initial pairing
2981                     switch (sm_conn->sm_engine_state){
2982                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
2983                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2984                             sm_done_for_handle(sm_conn->sm_handle);
2985                             break;
2986                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
2987                             if (IS_RESPONDER(sm_conn->sm_role)){
2988                                 // slave
2989                                 if (setup->sm_use_secure_connections){
2990                                     sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
2991                                 } else {
2992                                     btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 8, &sm_handle_random_result_ph3_random, sm_conn);
2993                                 }
2994                             } else {
2995                                 // master
2996                                 if (sm_key_distribution_all_received(sm_conn)){
2997                                     // skip receiving keys as there are none
2998                                     sm_key_distribution_handle_all_received(sm_conn);
2999                                     btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 8, &sm_handle_random_result_ph3_random, sm_conn);
3000                                 } else {
3001                                     sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
3002                                 }
3003                             }
3004                             break;
3005                         default:
3006                             break;
3007                     }
3008                     break;
3009 
3010                 case HCI_EVENT_ENCRYPTION_KEY_REFRESH_COMPLETE:
3011                     con_handle = little_endian_read_16(packet, 3);
3012                     sm_conn = sm_get_connection_for_handle(con_handle);
3013                     if (!sm_conn) break;
3014 
3015                     log_info("Encryption key refresh complete, key size %u", sm_conn->sm_actual_encryption_key_size);
3016                     log_info("event handler, state %u", sm_conn->sm_engine_state);
3017                     // continue if part of initial pairing
3018                     switch (sm_conn->sm_engine_state){
3019                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
3020                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
3021                             sm_done_for_handle(sm_conn->sm_handle);
3022                             break;
3023                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
3024                             if (IS_RESPONDER(sm_conn->sm_role)){
3025                                 // slave
3026                                 btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 8, &sm_handle_random_result_ph3_random, sm_conn);
3027                             } else {
3028                                 // master
3029                                 sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
3030                             }
3031                             break;
3032                         default:
3033                             break;
3034                     }
3035                     break;
3036 
3037 
3038                 case HCI_EVENT_DISCONNECTION_COMPLETE:
3039                     con_handle = little_endian_read_16(packet, 3);
3040                     sm_done_for_handle(con_handle);
3041                     sm_conn = sm_get_connection_for_handle(con_handle);
3042                     if (!sm_conn) break;
3043 
3044                     // delete stored bonding on disconnect with authentication failure in ph0
3045                     if (sm_conn->sm_role == 0
3046                         && sm_conn->sm_engine_state == SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED
3047                         && packet[2] == ERROR_CODE_AUTHENTICATION_FAILURE){
3048                         le_device_db_remove(sm_conn->sm_le_db_index);
3049                     }
3050 
3051                     // pairing failed, if it was ongoing
3052                     if (sm_conn->sm_engine_state != SM_INITIATOR_CONNECTED && sm_conn->sm_engine_state != SM_GENERAL_IDLE){
3053                         sm_notify_client_status_reason(sm_conn, ERROR_CODE_REMOTE_USER_TERMINATED_CONNECTION, 0);
3054                     }
3055 
3056                     sm_conn->sm_engine_state = SM_GENERAL_IDLE;
3057                     sm_conn->sm_handle = 0;
3058                     break;
3059 
3060 				case HCI_EVENT_COMMAND_COMPLETE:
3061                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_read_bd_addr)){
3062                         // set local addr for le device db
3063                         bd_addr_t addr;
3064                         reverse_bd_addr(&packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE + 1], addr);
3065                         le_device_db_set_local_bd_addr(addr);
3066                     }
3067                     break;
3068                 default:
3069                     break;
3070 			}
3071             break;
3072         default:
3073             break;
3074 	}
3075 
3076     sm_run();
3077 }
3078 
3079 static inline int sm_calc_actual_encryption_key_size(int other){
3080     if (other < sm_min_encryption_key_size) return 0;
3081     if (other < sm_max_encryption_key_size) return other;
3082     return sm_max_encryption_key_size;
3083 }
3084 
3085 
3086 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3087 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method){
3088     switch (method){
3089         case JUST_WORKS:
3090         case NUMERIC_COMPARISON:
3091             return 1;
3092         default:
3093             return 0;
3094     }
3095 }
3096 // responder
3097 
3098 static int sm_passkey_used(stk_generation_method_t method){
3099     switch (method){
3100         case PK_RESP_INPUT:
3101             return 1;
3102         default:
3103             return 0;
3104     }
3105 }
3106 
3107 static int sm_passkey_entry(stk_generation_method_t method){
3108     switch (method){
3109         case PK_RESP_INPUT:
3110         case PK_INIT_INPUT:
3111         case PK_BOTH_INPUT:
3112             return 1;
3113         default:
3114             return 0;
3115     }
3116 }
3117 
3118 #endif
3119 
3120 /**
3121  * @return ok
3122  */
3123 static int sm_validate_stk_generation_method(void){
3124     // check if STK generation method is acceptable by client
3125     switch (setup->sm_stk_generation_method){
3126         case JUST_WORKS:
3127             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_JUST_WORKS) != 0;
3128         case PK_RESP_INPUT:
3129         case PK_INIT_INPUT:
3130         case PK_BOTH_INPUT:
3131             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_PASSKEY) != 0;
3132         case OOB:
3133             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_OOB) != 0;
3134         case NUMERIC_COMPARISON:
3135             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON) != 0;
3136             return 1;
3137         default:
3138             return 0;
3139     }
3140 }
3141 
3142 // size of complete sm_pdu used to validate input
3143 static const uint8_t sm_pdu_size[] = {
3144     0,  // 0x00 invalid opcode
3145     7,  // 0x01 pairing request
3146     7,  // 0x02 pairing response
3147     17, // 0x03 pairing confirm
3148     17, // 0x04 pairing random
3149     2,  // 0x05 pairing failed
3150     17, // 0x06 encryption information
3151     11, // 0x07 master identification
3152     17, // 0x08 identification information
3153     8,  // 0x09 identify address information
3154     17, // 0x0a signing information
3155     2,  // 0x0b security request
3156     65, // 0x0c pairing public key
3157     17, // 0x0d pairing dhk check
3158     2,  // 0x0e keypress notification
3159 };
3160 
3161 static void sm_pdu_handler(uint8_t packet_type, hci_con_handle_t con_handle, uint8_t *packet, uint16_t size){
3162 
3163     if (packet_type == HCI_EVENT_PACKET && packet[0] == L2CAP_EVENT_CAN_SEND_NOW){
3164         sm_run();
3165     }
3166 
3167     if (packet_type != SM_DATA_PACKET) return;
3168     if (size == 0) return;
3169 
3170     uint8_t sm_pdu_code = packet[0];
3171 
3172     // validate pdu size
3173     if (sm_pdu_code >= sizeof(sm_pdu_size)) return;
3174     if (sm_pdu_size[sm_pdu_code] != size)   return;
3175 
3176     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3177     if (!sm_conn) return;
3178 
3179     if (sm_pdu_code == SM_CODE_PAIRING_FAILED){
3180         sm_notify_client_status_reason(sm_conn, ERROR_CODE_AUTHENTICATION_FAILURE, packet[1]);
3181         sm_done_for_handle(con_handle);
3182         sm_conn->sm_engine_state = sm_conn->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
3183         return;
3184     }
3185 
3186     log_debug("sm_pdu_handler: state %u, pdu 0x%02x", sm_conn->sm_engine_state, sm_pdu_code);
3187 
3188     int err;
3189     UNUSED(err);
3190 
3191     if (sm_pdu_code == SM_CODE_KEYPRESS_NOTIFICATION){
3192         uint8_t buffer[5];
3193         buffer[0] = SM_EVENT_KEYPRESS_NOTIFICATION;
3194         buffer[1] = 3;
3195         little_endian_store_16(buffer, 2, con_handle);
3196         buffer[4] = packet[1];
3197         sm_dispatch_event(HCI_EVENT_PACKET, 0, buffer, sizeof(buffer));
3198         return;
3199     }
3200 
3201     switch (sm_conn->sm_engine_state){
3202 
3203         // a sm timeout requries a new physical connection
3204         case SM_GENERAL_TIMEOUT:
3205             return;
3206 
3207 #ifdef ENABLE_LE_CENTRAL
3208 
3209         // Initiator
3210         case SM_INITIATOR_CONNECTED:
3211             if ((sm_pdu_code != SM_CODE_SECURITY_REQUEST) || (sm_conn->sm_role)){
3212                 sm_pdu_received_in_wrong_state(sm_conn);
3213                 break;
3214             }
3215             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_FAILED){
3216                 sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3217                 break;
3218             }
3219             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_SUCCEEDED){
3220                 sm_key_t ltk;
3221                 le_device_db_encryption_get(sm_conn->sm_le_db_index, NULL, NULL, ltk, NULL, NULL, NULL);
3222                 if (!sm_is_null_key(ltk)){
3223                     log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3224                     sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3225                 } else {
3226                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3227                 }
3228                 break;
3229             }
3230             // otherwise, store security request
3231             sm_conn->sm_security_request_received = 1;
3232             break;
3233 
3234         case SM_INITIATOR_PH1_W4_PAIRING_RESPONSE:
3235             if (sm_pdu_code != SM_CODE_PAIRING_RESPONSE){
3236                 sm_pdu_received_in_wrong_state(sm_conn);
3237                 break;
3238             }
3239 
3240             // store pairing request
3241             memcpy(&setup->sm_s_pres, packet, sizeof(sm_pairing_packet_t));
3242             err = sm_stk_generation_init(sm_conn);
3243 
3244 #ifdef ENABLE_TESTING_SUPPORT
3245             if (0 < test_pairing_failure && test_pairing_failure < SM_REASON_DHKEY_CHECK_FAILED){
3246                 log_info("testing_support: abort with pairing failure %u", test_pairing_failure);
3247                 err = test_pairing_failure;
3248             }
3249 #endif
3250 
3251             if (err){
3252                 setup->sm_pairing_failed_reason = err;
3253                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3254                 break;
3255             }
3256 
3257             // generate random number first, if we need to show passkey
3258             if (setup->sm_stk_generation_method == PK_RESP_INPUT){
3259                 btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 8, &sm_handle_random_result_ph2_tk, sm_conn);
3260                 break;
3261             }
3262 
3263 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3264             if (setup->sm_use_secure_connections){
3265                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
3266                 if (setup->sm_stk_generation_method == JUST_WORKS){
3267                     sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3268                     sm_trigger_user_response(sm_conn);
3269                     if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3270                         sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3271                     }
3272                 } else {
3273                     sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3274                 }
3275                 break;
3276             }
3277 #endif
3278             sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3279             sm_trigger_user_response(sm_conn);
3280             // response_idle == nothing <--> sm_trigger_user_response() did not require response
3281             if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3282                 btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_random, 16, &sm_handle_random_result_ph2_random, sm_conn);
3283             }
3284             break;
3285 
3286         case SM_INITIATOR_PH2_W4_PAIRING_CONFIRM:
3287             if (sm_pdu_code != SM_CODE_PAIRING_CONFIRM){
3288                 sm_pdu_received_in_wrong_state(sm_conn);
3289                 break;
3290             }
3291 
3292             // store s_confirm
3293             reverse_128(&packet[1], setup->sm_peer_confirm);
3294 
3295 #ifdef ENABLE_TESTING_SUPPORT
3296             if (test_pairing_failure == SM_REASON_CONFIRM_VALUE_FAILED){
3297                 log_info("testing_support: reset confirm value");
3298                 memset(setup->sm_peer_confirm, 0, 16);
3299             }
3300 #endif
3301             sm_conn->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
3302             break;
3303 
3304         case SM_INITIATOR_PH2_W4_PAIRING_RANDOM:
3305             if (sm_pdu_code != SM_CODE_PAIRING_RANDOM){
3306                 sm_pdu_received_in_wrong_state(sm_conn);
3307                 break;;
3308             }
3309 
3310             // received random value
3311             reverse_128(&packet[1], setup->sm_peer_random);
3312             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3313             break;
3314 #endif
3315 
3316 #ifdef ENABLE_LE_PERIPHERAL
3317         // Responder
3318         case SM_RESPONDER_IDLE:
3319         case SM_RESPONDER_SEND_SECURITY_REQUEST:
3320         case SM_RESPONDER_PH1_W4_PAIRING_REQUEST:
3321             if (sm_pdu_code != SM_CODE_PAIRING_REQUEST){
3322                 sm_pdu_received_in_wrong_state(sm_conn);
3323                 break;;
3324             }
3325 
3326             // store pairing request
3327             memcpy(&sm_conn->sm_m_preq, packet, sizeof(sm_pairing_packet_t));
3328             sm_conn->sm_engine_state = SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED;
3329             break;
3330 #endif
3331 
3332 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3333         case SM_SC_W4_PUBLIC_KEY_COMMAND:
3334             if (sm_pdu_code != SM_CODE_PAIRING_PUBLIC_KEY){
3335                 sm_pdu_received_in_wrong_state(sm_conn);
3336                 break;
3337             }
3338 
3339             // store public key for DH Key calculation
3340             reverse_256(&packet[01], &setup->sm_peer_q[0]);
3341             reverse_256(&packet[33], &setup->sm_peer_q[32]);
3342 
3343             // validate public key
3344             err = btstack_crypto_ecc_p256_validate_public_key(setup->sm_peer_q);
3345             if (err){
3346                 log_error("sm: peer public key invalid %x", err);
3347                 // uses "unspecified reason", there is no "public key invalid" error code
3348                 sm_pdu_received_in_wrong_state(sm_conn);
3349                 break;
3350             }
3351 
3352             // start calculating dhkey
3353             btstack_crypto_ecc_p256_calculate_dhkey(&sm_crypto_ecc_p256_request, setup->sm_peer_q, setup->sm_dhkey, sm_sc_dhkey_calculated, sm_conn);
3354 
3355 
3356             log_info("public key received, generation method %u", setup->sm_stk_generation_method);
3357             if (IS_RESPONDER(sm_conn->sm_role)){
3358                 // responder
3359                 sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3360             } else {
3361                 // initiator
3362                 // stk generation method
3363                 // passkey entry: notify app to show passkey or to request passkey
3364                 switch (setup->sm_stk_generation_method){
3365                     case JUST_WORKS:
3366                     case NUMERIC_COMPARISON:
3367                         sm_conn->sm_engine_state = SM_SC_W4_CONFIRMATION;
3368                         break;
3369                     case PK_RESP_INPUT:
3370                         sm_sc_start_calculating_local_confirm(sm_conn);
3371                         break;
3372                     case PK_INIT_INPUT:
3373                     case PK_BOTH_INPUT:
3374                         if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3375                             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3376                             break;
3377                         }
3378                         sm_sc_start_calculating_local_confirm(sm_conn);
3379                         break;
3380                     case OOB:
3381                         // generate Nx
3382                         log_info("Generate Na");
3383                         btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_nonce, 16, &sm_handle_random_result_sc_get_random, sm_conn);
3384                         break;
3385                 }
3386             }
3387             break;
3388 
3389         case SM_SC_W4_CONFIRMATION:
3390             if (sm_pdu_code != SM_CODE_PAIRING_CONFIRM){
3391                 sm_pdu_received_in_wrong_state(sm_conn);
3392                 break;
3393             }
3394             // received confirm value
3395             reverse_128(&packet[1], setup->sm_peer_confirm);
3396 
3397 #ifdef ENABLE_TESTING_SUPPORT
3398             if (test_pairing_failure == SM_REASON_CONFIRM_VALUE_FAILED){
3399                 log_info("testing_support: reset confirm value");
3400                 memset(setup->sm_peer_confirm, 0, 16);
3401             }
3402 #endif
3403             if (IS_RESPONDER(sm_conn->sm_role)){
3404                 // responder
3405                 if (sm_passkey_used(setup->sm_stk_generation_method)){
3406                     if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3407                         // still waiting for passkey
3408                         sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3409                         break;
3410                     }
3411                 }
3412                 sm_sc_start_calculating_local_confirm(sm_conn);
3413             } else {
3414                 // initiator
3415                 if (sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
3416                     // sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
3417                     btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_nonce, 16, &sm_handle_random_result_sc_get_random, sm_conn);
3418                 } else {
3419                     sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
3420                 }
3421             }
3422             break;
3423 
3424         case SM_SC_W4_PAIRING_RANDOM:
3425             if (sm_pdu_code != SM_CODE_PAIRING_RANDOM){
3426                 sm_pdu_received_in_wrong_state(sm_conn);
3427                 break;
3428             }
3429 
3430             // received random value
3431             reverse_128(&packet[1], setup->sm_peer_nonce);
3432 
3433             // validate confirm value if Cb = f4(Pkb, Pka, Nb, z)
3434             // only check for JUST WORK/NC in initiator role OR passkey entry
3435             if ( (!IS_RESPONDER(sm_conn->sm_role) && sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method))
3436             ||   (sm_passkey_used(setup->sm_stk_generation_method)) ) {
3437                  sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION;
3438                  break;
3439             }
3440 
3441             // OOB
3442             if (setup->sm_stk_generation_method == OOB){
3443 
3444                 // setup local random, set to zero if remote did not receive our data
3445                 log_info("Received nonce, setup local random ra/rb for dhkey check");
3446                 if (IS_RESPONDER(sm_conn->sm_role)){
3447                     if (sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq) == 0){
3448                         log_info("Reset rb as A does not have OOB data");
3449                         memset(setup->sm_rb, 0, 16);
3450                     } else {
3451                         memcpy(setup->sm_rb, sm_sc_oob_random, 16);
3452                         log_info("Use stored rb");
3453                         log_info_hexdump(setup->sm_rb, 16);
3454                     }
3455                 }  else {
3456                     if (sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres) == 0){
3457                         log_info("Reset ra as B does not have OOB data");
3458                         memset(setup->sm_ra, 0, 16);
3459                     } else {
3460                         memcpy(setup->sm_ra, sm_sc_oob_random, 16);
3461                         log_info("Use stored ra");
3462                         log_info_hexdump(setup->sm_ra, 16);
3463                     }
3464                 }
3465 
3466                 // validate confirm value if Cb = f4(PKb, Pkb, rb, 0) for OOB if data received
3467                 if (setup->sm_have_oob_data){
3468                      sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION;
3469                      break;
3470                 }
3471             }
3472 
3473             // TODO: we only get here for Responder role with JW/NC
3474             sm_sc_state_after_receiving_random(sm_conn);
3475             break;
3476 
3477         case SM_SC_W2_CALCULATE_G2:
3478         case SM_SC_W4_CALCULATE_G2:
3479         case SM_SC_W4_CALCULATE_DHKEY:
3480         case SM_SC_W2_CALCULATE_F5_SALT:
3481         case SM_SC_W4_CALCULATE_F5_SALT:
3482         case SM_SC_W2_CALCULATE_F5_MACKEY:
3483         case SM_SC_W4_CALCULATE_F5_MACKEY:
3484         case SM_SC_W2_CALCULATE_F5_LTK:
3485         case SM_SC_W4_CALCULATE_F5_LTK:
3486         case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
3487         case SM_SC_W4_DHKEY_CHECK_COMMAND:
3488         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
3489             if (sm_pdu_code != SM_CODE_PAIRING_DHKEY_CHECK){
3490                 sm_pdu_received_in_wrong_state(sm_conn);
3491                 break;
3492             }
3493             // store DHKey Check
3494             setup->sm_state_vars |= SM_STATE_VAR_DHKEY_COMMAND_RECEIVED;
3495             reverse_128(&packet[01], setup->sm_peer_dhkey_check);
3496 
3497             // have we been only waiting for dhkey check command?
3498             if (sm_conn->sm_engine_state == SM_SC_W4_DHKEY_CHECK_COMMAND){
3499                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
3500             }
3501             break;
3502 #endif
3503 
3504 #ifdef ENABLE_LE_PERIPHERAL
3505         case SM_RESPONDER_PH1_W4_PAIRING_CONFIRM:
3506             if (sm_pdu_code != SM_CODE_PAIRING_CONFIRM){
3507                 sm_pdu_received_in_wrong_state(sm_conn);
3508                 break;
3509             }
3510 
3511             // received confirm value
3512             reverse_128(&packet[1], setup->sm_peer_confirm);
3513 
3514 #ifdef ENABLE_TESTING_SUPPORT
3515             if (test_pairing_failure == SM_REASON_CONFIRM_VALUE_FAILED){
3516                 log_info("testing_support: reset confirm value");
3517                 memset(setup->sm_peer_confirm, 0, 16);
3518             }
3519 #endif
3520             // notify client to hide shown passkey
3521             if (setup->sm_stk_generation_method == PK_INIT_INPUT){
3522                 sm_notify_client_base(SM_EVENT_PASSKEY_DISPLAY_CANCEL, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
3523             }
3524 
3525             // handle user cancel pairing?
3526             if (setup->sm_user_response == SM_USER_RESPONSE_DECLINE){
3527                 setup->sm_pairing_failed_reason = SM_REASON_PASSKEY_ENTRY_FAILED;
3528                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3529                 break;
3530             }
3531 
3532             // wait for user action?
3533             if (setup->sm_user_response == SM_USER_RESPONSE_PENDING){
3534                 sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3535                 break;
3536             }
3537 
3538             // calculate and send local_confirm
3539             btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_random, 16, &sm_handle_random_result_ph2_random, sm_conn);
3540             break;
3541 
3542         case SM_RESPONDER_PH2_W4_PAIRING_RANDOM:
3543             if (sm_pdu_code != SM_CODE_PAIRING_RANDOM){
3544                 sm_pdu_received_in_wrong_state(sm_conn);
3545                 break;;
3546             }
3547 
3548             // received random value
3549             reverse_128(&packet[1], setup->sm_peer_random);
3550             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3551             break;
3552 #endif
3553 
3554         case SM_PH3_RECEIVE_KEYS:
3555             switch(sm_pdu_code){
3556                 case SM_CODE_ENCRYPTION_INFORMATION:
3557                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
3558                     reverse_128(&packet[1], setup->sm_peer_ltk);
3559                     break;
3560 
3561                 case SM_CODE_MASTER_IDENTIFICATION:
3562                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
3563                     setup->sm_peer_ediv = little_endian_read_16(packet, 1);
3564                     reverse_64(&packet[3], setup->sm_peer_rand);
3565                     break;
3566 
3567                 case SM_CODE_IDENTITY_INFORMATION:
3568                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
3569                     reverse_128(&packet[1], setup->sm_peer_irk);
3570                     break;
3571 
3572                 case SM_CODE_IDENTITY_ADDRESS_INFORMATION:
3573                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
3574                     setup->sm_peer_addr_type = packet[1];
3575                     reverse_bd_addr(&packet[2], setup->sm_peer_address);
3576                     break;
3577 
3578                 case SM_CODE_SIGNING_INFORMATION:
3579                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
3580                     reverse_128(&packet[1], setup->sm_peer_csrk);
3581                     break;
3582                 default:
3583                     // Unexpected PDU
3584                     log_info("Unexpected PDU %u in SM_PH3_RECEIVE_KEYS", packet[0]);
3585                     break;
3586             }
3587             // done with key distribution?
3588             if (sm_key_distribution_all_received(sm_conn)){
3589 
3590                 sm_key_distribution_handle_all_received(sm_conn);
3591 
3592                 if (IS_RESPONDER(sm_conn->sm_role)){
3593                     if (setup->sm_use_secure_connections && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION)){
3594                         sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_H6_ILK;
3595                     } else {
3596                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
3597                         sm_notify_client_status_reason(sm_conn, ERROR_CODE_SUCCESS, 0);
3598                         sm_done_for_handle(sm_conn->sm_handle);
3599                     }
3600                 } else {
3601                     if (setup->sm_use_secure_connections){
3602                         sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
3603                     } else {
3604                         btstack_crypto_random_generate(&sm_crypto_random_request, sm_random_data, 8, &sm_handle_random_result_ph3_random, sm_conn);
3605                     }
3606                 }
3607             }
3608             break;
3609         default:
3610             // Unexpected PDU
3611             log_info("Unexpected PDU %u in state %u", packet[0], sm_conn->sm_engine_state);
3612             break;
3613     }
3614 
3615     // try to send preparared packet
3616     sm_run();
3617 }
3618 
3619 // Security Manager Client API
3620 void sm_register_oob_data_callback( int (*get_oob_data_callback)(uint8_t address_type, bd_addr_t addr, uint8_t * oob_data)){
3621     sm_get_oob_data = get_oob_data_callback;
3622 }
3623 
3624 void sm_register_sc_oob_data_callback( int (*get_sc_oob_data_callback)(uint8_t address_type, bd_addr_t addr, uint8_t * oob_sc_peer_confirm, uint8_t * oob_sc_peer_random)){
3625     sm_get_sc_oob_data = get_sc_oob_data_callback;
3626 }
3627 
3628 void sm_add_event_handler(btstack_packet_callback_registration_t * callback_handler){
3629     btstack_linked_list_add_tail(&sm_event_handlers, (btstack_linked_item_t*) callback_handler);
3630 }
3631 
3632 void sm_set_accepted_stk_generation_methods(uint8_t accepted_stk_generation_methods){
3633     sm_accepted_stk_generation_methods = accepted_stk_generation_methods;
3634 }
3635 
3636 void sm_set_encryption_key_size_range(uint8_t min_size, uint8_t max_size){
3637 	sm_min_encryption_key_size = min_size;
3638 	sm_max_encryption_key_size = max_size;
3639 }
3640 
3641 void sm_set_authentication_requirements(uint8_t auth_req){
3642 #ifndef ENABLE_LE_SECURE_CONNECTIONS
3643     if (auth_req & SM_AUTHREQ_SECURE_CONNECTION){
3644         log_error("ENABLE_LE_SECURE_CONNECTIONS not defined, but requested by app. Dropping SC flag");
3645         auth_req &= ~SM_AUTHREQ_SECURE_CONNECTION;
3646     }
3647 #endif
3648     sm_auth_req = auth_req;
3649 }
3650 
3651 void sm_set_io_capabilities(io_capability_t io_capability){
3652     sm_io_capabilities = io_capability;
3653 }
3654 
3655 #ifdef ENABLE_LE_PERIPHERAL
3656 void sm_set_request_security(int enable){
3657     sm_slave_request_security = enable;
3658 }
3659 #endif
3660 
3661 void sm_set_er(sm_key_t er){
3662     memcpy(sm_persistent_er, er, 16);
3663 }
3664 
3665 void sm_set_ir(sm_key_t ir){
3666     memcpy(sm_persistent_ir, ir, 16);
3667 }
3668 
3669 // Testing support only
3670 void sm_test_set_irk(sm_key_t irk){
3671     memcpy(sm_persistent_irk, irk, 16);
3672     sm_persistent_irk_ready = 1;
3673 }
3674 
3675 void sm_test_use_fixed_local_csrk(void){
3676     test_use_fixed_local_csrk = 1;
3677 }
3678 
3679 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3680 static void sm_ec_generated(void * arg){
3681     UNUSED(arg);
3682     ec_key_generation_state = EC_KEY_GENERATION_DONE;
3683 }
3684 #endif
3685 
3686 #ifdef ENABLE_TESTING_SUPPORT
3687 void sm_test_set_pairing_failure(int reason){
3688     test_pairing_failure = reason;
3689 }
3690 #endif
3691 
3692 void sm_init(void){
3693     // set some (BTstack default) ER and IR
3694     int i;
3695     sm_key_t er;
3696     sm_key_t ir;
3697     for (i=0;i<16;i++){
3698         er[i] = 0x30 + i;
3699         ir[i] = 0x90 + i;
3700     }
3701     sm_set_er(er);
3702     sm_set_ir(ir);
3703     // defaults
3704     sm_accepted_stk_generation_methods = SM_STK_GENERATION_METHOD_JUST_WORKS
3705                                        | SM_STK_GENERATION_METHOD_OOB
3706                                        | SM_STK_GENERATION_METHOD_PASSKEY
3707                                        | SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON;
3708 
3709     sm_max_encryption_key_size = 16;
3710     sm_min_encryption_key_size = 7;
3711 
3712     sm_fixed_passkey_in_display_role = 0xffffffff;
3713     sm_reconstruct_ltk_without_le_device_db_entry = 1;
3714 
3715 #ifdef USE_CMAC_ENGINE
3716     sm_cmac_active  = 0;
3717 #endif
3718     dkg_state = DKG_W4_WORKING;
3719     rau_state = RAU_W4_WORKING;
3720     sm_aes128_state = SM_AES128_IDLE;
3721     sm_address_resolution_test = -1;    // no private address to resolve yet
3722     sm_address_resolution_ah_calculation_active = 0;
3723     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
3724     sm_address_resolution_general_queue = NULL;
3725 
3726     gap_random_adress_update_period = 15 * 60 * 1000L;
3727     sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
3728 
3729     test_use_fixed_local_csrk = 0;
3730 
3731     // register for HCI Events from HCI
3732     hci_event_callback_registration.callback = &sm_event_packet_handler;
3733     hci_add_event_handler(&hci_event_callback_registration);
3734 
3735     //
3736     btstack_crypto_init();
3737 
3738     // and L2CAP PDUs + L2CAP_EVENT_CAN_SEND_NOW
3739     l2cap_register_fixed_channel(sm_pdu_handler, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
3740 
3741 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3742     ec_key_generation_state = EC_KEY_GENERATION_ACTIVE;
3743     btstack_crypto_ecc_p256_generate_key(&sm_crypto_ecc_p256_request, ec_q, &sm_ec_generated, NULL);
3744 #endif
3745 }
3746 
3747 void sm_use_fixed_passkey_in_display_role(uint32_t passkey){
3748     sm_fixed_passkey_in_display_role = passkey;
3749 }
3750 
3751 void sm_allow_ltk_reconstruction_without_le_device_db_entry(int allow){
3752     sm_reconstruct_ltk_without_le_device_db_entry = allow;
3753 }
3754 
3755 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle){
3756     hci_connection_t * hci_con = hci_connection_for_handle(con_handle);
3757     if (!hci_con) return NULL;
3758     return &hci_con->sm_connection;
3759 }
3760 
3761 static void sm_send_security_request_for_connection(sm_connection_t * sm_conn){
3762     switch (sm_conn->sm_engine_state){
3763         case SM_GENERAL_IDLE:
3764         case SM_RESPONDER_IDLE:
3765             sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
3766             sm_run();
3767             break;
3768         default:
3769             break;
3770     }
3771 }
3772 
3773 /**
3774  * @brief Trigger Security Request
3775  */
3776 void sm_send_security_request(hci_con_handle_t con_handle){
3777     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3778     if (!sm_conn) return;
3779     sm_send_security_request_for_connection(sm_conn);
3780 }
3781 
3782 // request pairing
3783 void sm_request_pairing(hci_con_handle_t con_handle){
3784     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3785     if (!sm_conn) return;     // wrong connection
3786 
3787     log_info("sm_request_pairing in role %u, state %u", sm_conn->sm_role, sm_conn->sm_engine_state);
3788     if (IS_RESPONDER(sm_conn->sm_role)){
3789         sm_send_security_request_for_connection(sm_conn);
3790     } else {
3791         // used as a trigger to start central/master/initiator security procedures
3792         uint16_t ediv;
3793         sm_key_t ltk;
3794         if (sm_conn->sm_engine_state == SM_INITIATOR_CONNECTED){
3795             switch (sm_conn->sm_irk_lookup_state){
3796                 case IRK_LOOKUP_FAILED:
3797                     log_info("irk lookup failed, send pairing request");
3798                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3799                     break;
3800                 case IRK_LOOKUP_SUCCEEDED:
3801                         le_device_db_encryption_get(sm_conn->sm_le_db_index, &ediv, NULL, ltk, NULL, NULL, NULL);
3802                         if (!sm_is_null_key(ltk) || ediv){
3803                             log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3804                             sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3805                         } else {
3806                             sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3807                         }
3808                         break;
3809                 default:
3810                     log_info("irk lookup pending");
3811                     sm_conn->sm_pairing_requested = 1;
3812                     break;
3813             }
3814         } else if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
3815             sm_conn->sm_pairing_requested = 1;
3816         }
3817     }
3818     sm_run();
3819 }
3820 
3821 // called by client app on authorization request
3822 void sm_authorization_decline(hci_con_handle_t con_handle){
3823     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3824     if (!sm_conn) return;     // wrong connection
3825     sm_conn->sm_connection_authorization_state = AUTHORIZATION_DECLINED;
3826     sm_notify_client_status(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 0);
3827 }
3828 
3829 void sm_authorization_grant(hci_con_handle_t con_handle){
3830     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3831     if (!sm_conn) return;     // wrong connection
3832     sm_conn->sm_connection_authorization_state = AUTHORIZATION_GRANTED;
3833     sm_notify_client_status(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 1);
3834 }
3835 
3836 // GAP Bonding API
3837 
3838 void sm_bonding_decline(hci_con_handle_t con_handle){
3839     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3840     if (!sm_conn) return;     // wrong connection
3841     setup->sm_user_response = SM_USER_RESPONSE_DECLINE;
3842     log_info("decline, state %u", sm_conn->sm_engine_state);
3843     switch(sm_conn->sm_engine_state){
3844 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3845         case SM_SC_W4_USER_RESPONSE:
3846         case SM_SC_W4_CONFIRMATION:
3847         case SM_SC_W4_PUBLIC_KEY_COMMAND:
3848 #endif
3849         case SM_PH1_W4_USER_RESPONSE:
3850             switch (setup->sm_stk_generation_method){
3851                 case PK_RESP_INPUT:
3852                 case PK_INIT_INPUT:
3853                 case PK_BOTH_INPUT:
3854                     sm_pairing_error(sm_conn, SM_REASON_PASSKEY_ENTRY_FAILED);
3855                     break;
3856                 case NUMERIC_COMPARISON:
3857                     sm_pairing_error(sm_conn, SM_REASON_NUMERIC_COMPARISON_FAILED);
3858                     break;
3859                 case JUST_WORKS:
3860                 case OOB:
3861                     sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
3862                     break;
3863             }
3864             break;
3865         default:
3866             break;
3867     }
3868     sm_run();
3869 }
3870 
3871 void sm_just_works_confirm(hci_con_handle_t con_handle){
3872     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3873     if (!sm_conn) return;     // wrong connection
3874     setup->sm_user_response = SM_USER_RESPONSE_CONFIRM;
3875     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3876         if (setup->sm_use_secure_connections){
3877             sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3878         } else {
3879             btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_random, 16, &sm_handle_random_result_ph2_random, sm_conn);
3880         }
3881     }
3882 
3883 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3884     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
3885         sm_sc_prepare_dhkey_check(sm_conn);
3886     }
3887 #endif
3888 
3889     sm_run();
3890 }
3891 
3892 void sm_numeric_comparison_confirm(hci_con_handle_t con_handle){
3893     // for now, it's the same
3894     sm_just_works_confirm(con_handle);
3895 }
3896 
3897 void sm_passkey_input(hci_con_handle_t con_handle, uint32_t passkey){
3898     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3899     if (!sm_conn) return;     // wrong connection
3900     sm_reset_tk();
3901     big_endian_store_32(setup->sm_tk, 12, passkey);
3902     setup->sm_user_response = SM_USER_RESPONSE_PASSKEY;
3903     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3904         btstack_crypto_random_generate(&sm_crypto_random_request, setup->sm_local_random, 16, &sm_handle_random_result_ph2_random, sm_conn);
3905     }
3906 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3907     memcpy(setup->sm_ra, setup->sm_tk, 16);
3908     memcpy(setup->sm_rb, setup->sm_tk, 16);
3909     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
3910         sm_sc_start_calculating_local_confirm(sm_conn);
3911     }
3912 #endif
3913     sm_run();
3914 }
3915 
3916 void sm_keypress_notification(hci_con_handle_t con_handle, uint8_t action){
3917     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3918     if (!sm_conn) return;     // wrong connection
3919     if (action > SM_KEYPRESS_PASSKEY_ENTRY_COMPLETED) return;
3920     uint8_t num_actions = setup->sm_keypress_notification >> 5;
3921     uint8_t flags = setup->sm_keypress_notification & 0x1f;
3922     switch (action){
3923         case SM_KEYPRESS_PASSKEY_ENTRY_STARTED:
3924         case SM_KEYPRESS_PASSKEY_ENTRY_COMPLETED:
3925             flags |= (1 << action);
3926             break;
3927         case SM_KEYPRESS_PASSKEY_CLEARED:
3928             // clear counter, keypress & erased flags + set passkey cleared
3929             flags = (flags & 0x19) | (1 << SM_KEYPRESS_PASSKEY_CLEARED);
3930             break;
3931         case SM_KEYPRESS_PASSKEY_DIGIT_ENTERED:
3932             if (flags & (1 << SM_KEYPRESS_PASSKEY_DIGIT_ERASED)){
3933                 // erase actions queued
3934                 num_actions--;
3935                 if (num_actions == 0){
3936                     // clear counter, keypress & erased flags
3937                     flags &= 0x19;
3938                 }
3939                 break;
3940             }
3941             num_actions++;
3942             flags |= (1 << SM_KEYPRESS_PASSKEY_DIGIT_ENTERED);
3943             break;
3944         case SM_KEYPRESS_PASSKEY_DIGIT_ERASED:
3945             if (flags & (1 << SM_KEYPRESS_PASSKEY_DIGIT_ENTERED)){
3946                 // enter actions queued
3947                 num_actions--;
3948                 if (num_actions == 0){
3949                     // clear counter, keypress & erased flags
3950                     flags &= 0x19;
3951                 }
3952                 break;
3953             }
3954             num_actions++;
3955             flags |= (1 << SM_KEYPRESS_PASSKEY_DIGIT_ERASED);
3956             break;
3957         default:
3958             break;
3959     }
3960     setup->sm_keypress_notification = (num_actions << 5) | flags;
3961     sm_run();
3962 }
3963 
3964 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3965 static void sm_handle_random_result_oob(void * arg){
3966     UNUSED(arg);
3967     sm_sc_oob_state = SM_SC_OOB_W2_CALC_CONFIRM;
3968     sm_run();
3969 }
3970 uint8_t sm_generate_sc_oob_data(void (*callback)(const uint8_t * confirm_value, const uint8_t * random_value)){
3971     if (sm_sc_oob_state != SM_SC_OOB_IDLE) return ERROR_CODE_COMMAND_DISALLOWED;
3972     sm_sc_oob_callback = callback;
3973     sm_sc_oob_state = SM_SC_OOB_W4_RANDOM;
3974     btstack_crypto_random_generate(&sm_crypto_random_oob_request, sm_sc_oob_random, 16, &sm_handle_random_result_oob, NULL);
3975     return 0;
3976 }
3977 #endif
3978 
3979 /**
3980  * @brief Identify device in LE Device DB
3981  * @param handle
3982  * @returns index from le_device_db or -1 if not found/identified
3983  */
3984 int sm_le_device_index(hci_con_handle_t con_handle ){
3985     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3986     if (!sm_conn) return -1;
3987     return sm_conn->sm_le_db_index;
3988 }
3989 
3990 static int gap_random_address_type_requires_updates(void){
3991     if (gap_random_adress_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return 0;
3992     if (gap_random_adress_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return 0;
3993     return 1;
3994 }
3995 
3996 static uint8_t own_address_type(void){
3997     switch (gap_random_adress_type){
3998         case GAP_RANDOM_ADDRESS_TYPE_OFF:
3999             return BD_ADDR_TYPE_LE_PUBLIC;
4000         default:
4001             return BD_ADDR_TYPE_LE_RANDOM;
4002     }
4003 }
4004 
4005 // GAP LE API
4006 void gap_random_address_set_mode(gap_random_address_type_t random_address_type){
4007     gap_random_address_update_stop();
4008     gap_random_adress_type = random_address_type;
4009     hci_le_set_own_address_type(own_address_type());
4010     if (!gap_random_address_type_requires_updates()) return;
4011     gap_random_address_update_start();
4012     gap_random_address_trigger();
4013 }
4014 
4015 gap_random_address_type_t gap_random_address_get_mode(void){
4016     return gap_random_adress_type;
4017 }
4018 
4019 void gap_random_address_set_update_period(int period_ms){
4020     gap_random_adress_update_period = period_ms;
4021     if (!gap_random_address_type_requires_updates()) return;
4022     gap_random_address_update_stop();
4023     gap_random_address_update_start();
4024 }
4025 
4026 void gap_random_address_set(bd_addr_t addr){
4027     gap_random_address_set_mode(GAP_RANDOM_ADDRESS_TYPE_STATIC);
4028     memcpy(sm_random_address, addr, 6);
4029     if (rau_state == RAU_W4_WORKING) return;
4030     rau_state = RAU_SET_ADDRESS;
4031     sm_run();
4032 }
4033 
4034 #ifdef ENABLE_LE_PERIPHERAL
4035 /*
4036  * @brief Set Advertisement Paramters
4037  * @param adv_int_min
4038  * @param adv_int_max
4039  * @param adv_type
4040  * @param direct_address_type
4041  * @param direct_address
4042  * @param channel_map
4043  * @param filter_policy
4044  *
4045  * @note own_address_type is used from gap_random_address_set_mode
4046  */
4047 void gap_advertisements_set_params(uint16_t adv_int_min, uint16_t adv_int_max, uint8_t adv_type,
4048     uint8_t direct_address_typ, bd_addr_t direct_address, uint8_t channel_map, uint8_t filter_policy){
4049     hci_le_advertisements_set_params(adv_int_min, adv_int_max, adv_type,
4050         direct_address_typ, direct_address, channel_map, filter_policy);
4051 }
4052 #endif
4053 
4054 int gap_reconnect_security_setup_active(hci_con_handle_t con_handle){
4055     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4056      // wrong connection
4057     if (!sm_conn) return 0;
4058     // already encrypted
4059     if (sm_conn->sm_connection_encrypted) return 0;
4060     // only central can re-encrypt
4061     if (sm_conn->sm_role == HCI_ROLE_SLAVE) return 0;
4062     // irk status?
4063     switch(sm_conn->sm_irk_lookup_state){
4064         case IRK_LOOKUP_FAILED:
4065             // done, cannot setup encryption
4066             return 0;
4067         case IRK_LOOKUP_SUCCEEDED:
4068             break;
4069         default:
4070             // IR Lookup pending
4071             return 1;
4072     }
4073     // IRK Lookup Succeeded, re-encryption should be initiated. When done, state gets reset
4074     return sm_conn->sm_engine_state != SM_INITIATOR_CONNECTED;
4075 }
4076