Bluetooth LE pairing with NFC using STM32WB

[kcire L.]

Hello,

I am trying to find an example or application note that describes how to do OOB pairing using an NFC tag and the STM32WBx series. Has anyone out there successfully done this before, or can you point me to some good information for doing this?

Thank you for any help.

[Olivier L]

Hi,

We have a demo about BLE Out Of Band Pairing. The source code of the Android App is available and the source code for the firmware of the STM32WB55 is available as well.

Firmware: https://www.st.com/en/embedded-software/stsw-st25dv004.html

Android App: https://www.st.com/en/embedded-software/stsw-st25005.html

User manual: https://www.st.com/resource/en/user_manual/um2710-st25dvi2c-outofband-pairing-demonstration-stmicroelectronics.pdf

Best regards

Olivier

[Amogh]

Hello @Olivier L​ 

I have tried implementing the OOB from the firmware you had provided, and from the little nuggets of information that I got from the site's discussion, I haven't been able to trigger OOB Byte in the firmware version binary 1.13.0. I am using an android Android app and device is STM32Wb series microcontroller. Irrespective of permutations and combinations that I have tried, connection always falls back to numeric pairing.. :(

My Goal is to have Preset OOB Key on Device(STM32WB) and Phone(currently android) to establish a secure connection.

• Added event mask to generate 256bit key after "aci_gap_set_authentication_requirement"

uint8_t ALL_EVENTS[8]={0x9F,0x01,0x00,0x00,0x00,0x00,0x00,0x00};
 hci_le_set_event_mask(ALL_EVENTS); 
 int status = hci_le_read_local_p256_public_key();
 APP_DBG_MSG("\r\n\r EVENT MASK To Generate a LOCAL 256 Key %d \n",status );

Added "HCI_LE_READ_LOCAL_P256_PUBLIC_KEY_COMPLETE_SUBEVT_CODE" event in

switch (meta_evt->subevent)
 {
 .// few more cases not shown for clarity
  case HCI_LE_READ_LOCAL_P256_PUBLIC_KEY_COMPLETE_SUBEVT_CODE:
 { 
 APP_DBG_MSG("\n\r OOB Key Gen Event!");
 runOOB();
 }
}

• Added a runOOB Function

static void runOOB(void)
{
 
 uint8_t at = 0x00; 
 uint8_t add[6] = {0x00,0x00,0x00,0x00,0x00,0x00};
 uint8_t len = 0x10;
 uint8_t random[16] = {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
 uint8_t confirm[16] = {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
 
 int status = aci_gap_set_oob_data(0x00,0x00,0x00, 0, 0, 0);
 APP_DBG_MSG("\n\r OOB INITIALIZATION STATUS : %d", status);
 
 
 int statusRand = aci_gap_get_oob_data(0x01, &at,add,&len, random);
 int statusConfirm = aci_gap_get_oob_data(0x02, &at,add,&len, confirm);
 
 
 APP_DBG_MSG("\n\r OOB Key - Random Data: [");
 
for(int i =0; i <16; i++)
 APP_DBG_MSG("%02X:", random[i]);
 
 APP_DBG_MSG("]");
 APP_DBG_MSG("] \n\r OOB Key Hash : ");
 
for(int i =0; i <16; i++)
 APP_DBG_MSG("%02X:", confirm[i]);
 
 
}

Lastly, I was wondering if you can advise on, if there is a way to hardcode the keys on the device and bypass the pairing completely, without bonding...? in our use case, secure connection takes 2000-2700 ms, which is very bad user experience.

[Olivier L]

Hi,

I haven't worked on this recently so I need more information to help me to catch up.

What is the java code that you provide? I expect that the STM32WBx MCU writes an NDEF message info the ST25DV Tag. This NDEF message would contain a BLE record with the following fields:

• Record Type Name : “application/vnd.bluetooth.le.oob�?
• BT Device Name (ex: « ST25OOB »)
• BT Device Address (ex: 80:e1:26:00:6A:a8)
• LE Secure connections Random Value (16 bytes)
• LE Secure connections Confirmation Value (16 bytes)

The last 2 are the Out Of Band data.

The Android phone will receive this BLE record and it will be processed natively by Android (the application has nothing to do).

Lastly, I was wondering if you can advise on, if there is a way to hardcode the keys on the device and bypass the pairing completely, without bonding...?

I don't think that it is possible.

Regards

Olivier

[Amogh]

Hi Olivier,

Thank you for the response!

I have provided the C code which shows

1. I am setting the event bits to generate 256 bit key.
2. Waiting for OOB Key Generation Event from the BLE Stack
3. Initializing the OOB Stack with aci_gap_set_oob_data() function call with data values 0,
4. Extracting the BLE Key via aci_gap_get_oob_data() command.

What I have not done is to transfer the OOB keys NFC as a NDEF message, as we are first building a proof-of-concept, and will provide the keys manually to Android/STM32wb. I have tested with nRF connect app, and an in-house app that we have, that the above code is NOT able to set OOB Byte Flag during the pairing request, and pairing defaults to pin based.

Is there a working example you can provide/refer me to? (The example link you have in the post above seems to be built for a very old BLE firmware, and wrt Android, its limited to Android 9, as per the comments.)

Any help is much appreciated.

Thanks

Amogh

[Olivier L]

Hi Amogh,

Is there a working example you can provide/refer me to? (The example link you have in the post above seems to be built for a very old BLE firmware, and wrt Android, its limited to Android 9, as per the comments.)

Are you able to build the firmware from the source taken on https://www.st.com/en/embedded-software/stsw-st25dv004.html? This demo was implemented in 2018 so the firmware is from that time but I would expect that it still works.

Do you have a MB1355C board and an X-NUCLEO-NFC04A1 in order to flash and run the firmware?

Concerning Android, I expect that any version higher or equal to Android 9 would work.

Best regards

Olivier

[Amogh]

Hi Olivier,

Since I did not have the actual hardware for NFC/NDEF message transfer, I reviewed the code, and extracted the OOB pieces, and tried to get those working in my existing firmware. Everywhere, I read, for the OOB, the application notes, say, all that is needed is "oob_get", and a "oob_set" function. I have not yet tried to build the firmware in the above link in a standalone mode, but will give it a try today.

For the android, again, its the same thing, I haven't tried it yet. I will try to build the firmware you have provided with the latest binary and will update here.

Thanks

Amogh

[Olivier L]

Hi Amogh,

Unfortunately, the person who developped this firmware and wrote this app note is not in the company anymore. I will try to help you as much as I can but I'm not a specialist of this area.

I would like to suggest to order the MB1355C and X-NUCLEO-NFC04A1 boards and to use them as a reference when you develop your own fw. They are not expensive so I think that it will help if you have them to run the demo.

Best regards

Olivier