xref: /btstack/src/ble/sm.c (revision 07036a04732cecdfbf475f5be178c07269de195d)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #include <stdio.h>
39 #include <string.h>
40 #include <inttypes.h>
41 
42 #include "ble/le_device_db.h"
43 #include "ble/core.h"
44 #include "ble/sm.h"
45 #include "btstack_debug.h"
46 #include "btstack_event.h"
47 #include "btstack_linked_list.h"
48 #include "btstack_memory.h"
49 #include "gap.h"
50 #include "hci.h"
51 #include "l2cap.h"
52 
53 #ifdef ENABLE_LE_SECURE_CONNECTIONS
54 // TODO: remove software AES
55 #include "rijndael.h"
56 #endif
57 
58 #if defined(ENABLE_LE_SECURE_CONNECTIONS) && !defined(HAVE_HCI_CONTROLLER_DHKEY_SUPPORT)
59 #define USE_MBEDTLS_FOR_ECDH
60 #endif
61 
62 #ifdef ENABLE_LE_SECURE_CONNECTIONS
63 #ifdef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
64 #error "Support for DHKEY Support in HCI Controller not implemented yet. Please use software implementation"
65 #else
66 #define USE_MBEDTLS_FOR_ECDH
67 #endif
68 #endif
69 
70 
71 // Software ECDH implementation provided by mbedtls
72 #ifdef USE_MBEDTLS_FOR_ECDH
73 #if !defined(MBEDTLS_CONFIG_FILE)
74 #include "mbedtls/config.h"
75 #else
76 #include MBEDTLS_CONFIG_FILE
77 #endif
78 #if defined(MBEDTLS_PLATFORM_C)
79 #include "mbedtls/platform.h"
80 #else
81 #include <stdio.h>
82 #define mbedtls_printf     printf
83 #endif
84 #include "mbedtls/ecp.h"
85 #endif
86 
87 //
88 // SM internal types and globals
89 //
90 
91 typedef enum {
92     DKG_W4_WORKING,
93     DKG_CALC_IRK,
94     DKG_W4_IRK,
95     DKG_CALC_DHK,
96     DKG_W4_DHK,
97     DKG_READY
98 } derived_key_generation_t;
99 
100 typedef enum {
101     RAU_W4_WORKING,
102     RAU_IDLE,
103     RAU_GET_RANDOM,
104     RAU_W4_RANDOM,
105     RAU_GET_ENC,
106     RAU_W4_ENC,
107     RAU_SET_ADDRESS,
108 } random_address_update_t;
109 
110 typedef enum {
111     CMAC_IDLE,
112     CMAC_CALC_SUBKEYS,
113     CMAC_W4_SUBKEYS,
114     CMAC_CALC_MI,
115     CMAC_W4_MI,
116     CMAC_CALC_MLAST,
117     CMAC_W4_MLAST
118 } cmac_state_t;
119 
120 typedef enum {
121     JUST_WORKS,
122     PK_RESP_INPUT,  // Initiator displays PK, responder inputs PK
123     PK_INIT_INPUT,  // Responder displays PK, initiator inputs PK
124     OK_BOTH_INPUT,  // Only input on both, both input PK
125     NK_BOTH_INPUT,  // Only numerical compparison (yes/no) on on both sides
126     OOB             // OOB available on both sides
127 } stk_generation_method_t;
128 
129 typedef enum {
130     SM_USER_RESPONSE_IDLE,
131     SM_USER_RESPONSE_PENDING,
132     SM_USER_RESPONSE_CONFIRM,
133     SM_USER_RESPONSE_PASSKEY,
134     SM_USER_RESPONSE_DECLINE
135 } sm_user_response_t;
136 
137 typedef enum {
138     SM_AES128_IDLE,
139     SM_AES128_ACTIVE
140 } sm_aes128_state_t;
141 
142 typedef enum {
143     ADDRESS_RESOLUTION_IDLE,
144     ADDRESS_RESOLUTION_GENERAL,
145     ADDRESS_RESOLUTION_FOR_CONNECTION,
146 } address_resolution_mode_t;
147 
148 typedef enum {
149     ADDRESS_RESOLUTION_SUCEEDED,
150     ADDRESS_RESOLUTION_FAILED,
151 } address_resolution_event_t;
152 
153 typedef enum {
154     EC_KEY_GENERATION_IDLE,
155     EC_KEY_GENERATION_ACTIVE,
156     EC_KEY_GENERATION_DONE,
157 } ec_key_generation_state_t;
158 
159 typedef enum {
160     SM_STATE_VAR_DHKEY_COMMAND_RECEIVED = 1 << 0
161 } sm_state_var_t;
162 
163 //
164 // GLOBAL DATA
165 //
166 
167 static uint8_t test_use_fixed_local_csrk;
168 static uint8_t test_use_fixed_ec_keypair;
169 
170 // configuration
171 static uint8_t sm_accepted_stk_generation_methods;
172 static uint8_t sm_max_encryption_key_size;
173 static uint8_t sm_min_encryption_key_size;
174 static uint8_t sm_auth_req = 0;
175 static uint8_t sm_io_capabilities = IO_CAPABILITY_NO_INPUT_NO_OUTPUT;
176 static uint8_t sm_slave_request_security;
177 
178 // Security Manager Master Keys, please use sm_set_er(er) and sm_set_ir(ir) with your own 128 bit random values
179 static sm_key_t sm_persistent_er;
180 static sm_key_t sm_persistent_ir;
181 
182 // derived from sm_persistent_ir
183 static sm_key_t sm_persistent_dhk;
184 static sm_key_t sm_persistent_irk;
185 static uint8_t  sm_persistent_irk_ready = 0;    // used for testing
186 static derived_key_generation_t dkg_state;
187 
188 // derived from sm_persistent_er
189 // ..
190 
191 // random address update
192 static random_address_update_t rau_state;
193 static bd_addr_t sm_random_address;
194 
195 // CMAC Calculation: General
196 static cmac_state_t sm_cmac_state;
197 static uint16_t     sm_cmac_message_len;
198 static sm_key_t     sm_cmac_k;
199 static sm_key_t     sm_cmac_x;
200 static sm_key_t     sm_cmac_m_last;
201 static uint8_t      sm_cmac_block_current;
202 static uint8_t      sm_cmac_block_count;
203 static uint8_t      (*sm_cmac_get_byte)(uint16_t offset);
204 static void         (*sm_cmac_done_handler)(uint8_t * hash);
205 
206 // CMAC for ATT Signed Writes
207 static uint8_t      sm_cmac_header[3];
208 static const uint8_t * sm_cmac_message;
209 static uint8_t      sm_cmac_sign_counter[4];
210 
211 // CMAC for Secure Connection functions
212 #ifdef ENABLE_LE_SECURE_CONNECTIONS
213 static sm_connection_t * sm_cmac_connection;
214 static uint8_t           sm_cmac_sc_buffer[80];
215 #endif
216 
217 // resolvable private address lookup / CSRK calculation
218 static int       sm_address_resolution_test;
219 static int       sm_address_resolution_ah_calculation_active;
220 static uint8_t   sm_address_resolution_addr_type;
221 static bd_addr_t sm_address_resolution_address;
222 static void *    sm_address_resolution_context;
223 static address_resolution_mode_t sm_address_resolution_mode;
224 static btstack_linked_list_t sm_address_resolution_general_queue;
225 
226 // aes128 crypto engine. store current sm_connection_t in sm_aes128_context
227 static sm_aes128_state_t  sm_aes128_state;
228 static void *             sm_aes128_context;
229 
230 // random engine. store context (ususally sm_connection_t)
231 static void * sm_random_context;
232 
233 // to receive hci events
234 static btstack_packet_callback_registration_t hci_event_callback_registration;
235 
236 /* to dispatch sm event */
237 static btstack_linked_list_t sm_event_handlers;
238 
239 // Software ECDH implementation provided by mbedtls
240 #ifdef USE_MBEDTLS_FOR_ECDH
241 static mbedtls_ecp_keypair le_keypair;
242 static ec_key_generation_state_t ec_key_generation_state;
243 #endif
244 
245 //
246 // Volume 3, Part H, Chapter 24
247 // "Security shall be initiated by the Security Manager in the device in the master role.
248 // The device in the slave role shall be the responding device."
249 // -> master := initiator, slave := responder
250 //
251 
252 // data needed for security setup
253 typedef struct sm_setup_context {
254 
255     btstack_timer_source_t sm_timeout;
256 
257     // used in all phases
258     uint8_t   sm_pairing_failed_reason;
259 
260     // user response, (Phase 1 and/or 2)
261     uint8_t   sm_user_response;
262 
263     // defines which keys will be send after connection is encrypted - calculated during Phase 1, used Phase 3
264     int       sm_key_distribution_send_set;
265     int       sm_key_distribution_received_set;
266 
267     // Phase 2 (Pairing over SMP)
268     stk_generation_method_t sm_stk_generation_method;
269     sm_key_t  sm_tk;
270     uint8_t   sm_use_secure_connections;
271 
272     sm_key_t  sm_c1_t3_value;   // c1 calculation
273     sm_pairing_packet_t sm_m_preq; // pairing request - needed only for c1
274     sm_pairing_packet_t sm_s_pres; // pairing response - needed only for c1
275     sm_key_t  sm_local_random;
276     sm_key_t  sm_local_confirm;
277     sm_key_t  sm_peer_random;
278     sm_key_t  sm_peer_confirm;
279     uint8_t   sm_m_addr_type;   // address and type can be removed
280     uint8_t   sm_s_addr_type;   //  ''
281     bd_addr_t sm_m_address;     //  ''
282     bd_addr_t sm_s_address;     //  ''
283     sm_key_t  sm_ltk;
284 
285 #ifdef ENABLE_LE_SECURE_CONNECTIONS
286     uint8_t   sm_peer_qx[32];   // also stores random for EC key generation during init
287     uint8_t   sm_peer_qy[32];   //  ''
288     sm_key_t  sm_peer_nonce;    // might be combined with sm_peer_random
289     sm_key_t  sm_local_nonce;   // might be combined with sm_local_random
290     sm_key_t  sm_peer_dhkey_check;
291     sm_key_t  sm_local_dhkey_check;
292     sm_key_t  sm_ra;
293     sm_key_t  sm_rb;
294     sm_key_t  sm_t;             // used for f5
295     sm_key_t  sm_mackey;
296     uint8_t   sm_passkey_bit;   // also stores number of generated random bytes for EC key generation
297     uint8_t   sm_state_vars;
298 #endif
299 
300     // Phase 3
301 
302     // key distribution, we generate
303     uint16_t  sm_local_y;
304     uint16_t  sm_local_div;
305     uint16_t  sm_local_ediv;
306     uint8_t   sm_local_rand[8];
307     sm_key_t  sm_local_ltk;
308     sm_key_t  sm_local_csrk;
309     sm_key_t  sm_local_irk;
310     // sm_local_address/addr_type not needed
311 
312     // key distribution, received from peer
313     uint16_t  sm_peer_y;
314     uint16_t  sm_peer_div;
315     uint16_t  sm_peer_ediv;
316     uint8_t   sm_peer_rand[8];
317     sm_key_t  sm_peer_ltk;
318     sm_key_t  sm_peer_irk;
319     sm_key_t  sm_peer_csrk;
320     uint8_t   sm_peer_addr_type;
321     bd_addr_t sm_peer_address;
322 
323 } sm_setup_context_t;
324 
325 //
326 static sm_setup_context_t the_setup;
327 static sm_setup_context_t * setup = &the_setup;
328 
329 // active connection - the one for which the_setup is used for
330 static uint16_t sm_active_connection = 0;
331 
332 // @returns 1 if oob data is available
333 // stores oob data in provided 16 byte buffer if not null
334 static int (*sm_get_oob_data)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data) = NULL;
335 
336 // used to notify applicationss that user interaction is neccessary, see sm_notify_t below
337 static btstack_packet_handler_t sm_client_packet_handler = NULL;
338 
339 // horizontal: initiator capabilities
340 // vertial:    responder capabilities
341 static const stk_generation_method_t stk_generation_method [5] [5] = {
342     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
343     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
344     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
345     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
346     { PK_RESP_INPUT,   PK_RESP_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
347 };
348 
349 // uses numeric comparison if one side has DisplayYesNo and KeyboardDisplay combinations
350 #ifdef ENABLE_LE_SECURE_CONNECTIONS
351 static const stk_generation_method_t stk_generation_method_with_secure_connection[5][5] = {
352     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
353     { JUST_WORKS,      NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
354     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
355     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
356     { PK_RESP_INPUT,   NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
357 };
358 #endif
359 
360 static void sm_run(void);
361 static void sm_done_for_handle(hci_con_handle_t con_handle);
362 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle);
363 static inline int sm_calc_actual_encryption_key_size(int other);
364 static int sm_validate_stk_generation_method(void);
365 static void sm_shift_left_by_one_bit_inplace(int len, uint8_t * data);
366 
367 static void log_info_hex16(const char * name, uint16_t value){
368     log_info("%-6s 0x%04x", name, value);
369 }
370 
371 // @returns 1 if all bytes are 0
372 static int sm_is_null_random(uint8_t random[8]){
373     int i;
374     for (i=0; i < 8 ; i++){
375         if (random[i]) return 0;
376     }
377     return 1;
378 }
379 
380 // Key utils
381 static void sm_reset_tk(void){
382     int i;
383     for (i=0;i<16;i++){
384         setup->sm_tk[i] = 0;
385     }
386 }
387 
388 // "For example, if a 128-bit encryption key is 0x123456789ABCDEF0123456789ABCDEF0
389 // and it is reduced to 7 octets (56 bits), then the resulting key is 0x0000000000000000003456789ABCDEF0.""
390 static void sm_truncate_key(sm_key_t key, int max_encryption_size){
391     int i;
392     for (i = max_encryption_size ; i < 16 ; i++){
393         key[15-i] = 0;
394     }
395 }
396 
397 // SMP Timeout implementation
398 
399 // Upon transmission of the Pairing Request command or reception of the Pairing Request command,
400 // the Security Manager Timer shall be reset and started.
401 //
402 // The Security Manager Timer shall be reset when an L2CAP SMP command is queued for transmission.
403 //
404 // If the Security Manager Timer reaches 30 seconds, the procedure shall be considered to have failed,
405 // and the local higher layer shall be notified. No further SMP commands shall be sent over the L2CAP
406 // Security Manager Channel. A new SM procedure shall only be performed when a new physical link has been
407 // established.
408 
409 static void sm_timeout_handler(btstack_timer_source_t * timer){
410     log_info("SM timeout");
411     sm_connection_t * sm_conn = (sm_connection_t*) btstack_run_loop_get_timer_context(timer);
412     sm_conn->sm_engine_state = SM_GENERAL_TIMEOUT;
413     sm_done_for_handle(sm_conn->sm_handle);
414 
415     // trigger handling of next ready connection
416     sm_run();
417 }
418 static void sm_timeout_start(sm_connection_t * sm_conn){
419     btstack_run_loop_remove_timer(&setup->sm_timeout);
420     btstack_run_loop_set_timer_context(&setup->sm_timeout, sm_conn);
421     btstack_run_loop_set_timer_handler(&setup->sm_timeout, sm_timeout_handler);
422     btstack_run_loop_set_timer(&setup->sm_timeout, 30000); // 30 seconds sm timeout
423     btstack_run_loop_add_timer(&setup->sm_timeout);
424 }
425 static void sm_timeout_stop(void){
426     btstack_run_loop_remove_timer(&setup->sm_timeout);
427 }
428 static void sm_timeout_reset(sm_connection_t * sm_conn){
429     sm_timeout_stop();
430     sm_timeout_start(sm_conn);
431 }
432 
433 // end of sm timeout
434 
435 // GAP Random Address updates
436 static gap_random_address_type_t gap_random_adress_type;
437 static btstack_timer_source_t gap_random_address_update_timer;
438 static uint32_t gap_random_adress_update_period;
439 
440 static void gap_random_address_trigger(void){
441     if (rau_state != RAU_IDLE) return;
442     log_info("gap_random_address_trigger");
443     rau_state = RAU_GET_RANDOM;
444     sm_run();
445 }
446 
447 static void gap_random_address_update_handler(btstack_timer_source_t * timer){
448     log_info("GAP Random Address Update due");
449     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
450     btstack_run_loop_add_timer(&gap_random_address_update_timer);
451     gap_random_address_trigger();
452 }
453 
454 static void gap_random_address_update_start(void){
455     btstack_run_loop_set_timer_handler(&gap_random_address_update_timer, gap_random_address_update_handler);
456     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
457     btstack_run_loop_add_timer(&gap_random_address_update_timer);
458 }
459 
460 static void gap_random_address_update_stop(void){
461     btstack_run_loop_remove_timer(&gap_random_address_update_timer);
462 }
463 
464 
465 static void sm_random_start(void * context){
466     sm_random_context = context;
467     hci_send_cmd(&hci_le_rand);
468 }
469 
470 // pre: sm_aes128_state != SM_AES128_ACTIVE, hci_can_send_command == 1
471 // context is made availabe to aes128 result handler by this
472 static void sm_aes128_start(sm_key_t key, sm_key_t plaintext, void * context){
473     sm_aes128_state = SM_AES128_ACTIVE;
474     sm_key_t key_flipped, plaintext_flipped;
475     reverse_128(key, key_flipped);
476     reverse_128(plaintext, plaintext_flipped);
477     sm_aes128_context = context;
478     hci_send_cmd(&hci_le_encrypt, key_flipped, plaintext_flipped);
479 }
480 
481 // ah(k,r) helper
482 // r = padding || r
483 // r - 24 bit value
484 static void sm_ah_r_prime(uint8_t r[3], sm_key_t r_prime){
485     // r'= padding || r
486     memset(r_prime, 0, 16);
487     memcpy(&r_prime[13], r, 3);
488 }
489 
490 // d1 helper
491 // d' = padding || r || d
492 // d,r - 16 bit values
493 static void sm_d1_d_prime(uint16_t d, uint16_t r, sm_key_t d1_prime){
494     // d'= padding || r || d
495     memset(d1_prime, 0, 16);
496     big_endian_store_16(d1_prime, 12, r);
497     big_endian_store_16(d1_prime, 14, d);
498 }
499 
500 // dm helper
501 // r’ = padding || r
502 // r - 64 bit value
503 static void sm_dm_r_prime(uint8_t r[8], sm_key_t r_prime){
504     memset(r_prime, 0, 16);
505     memcpy(&r_prime[8], r, 8);
506 }
507 
508 // calculate arguments for first AES128 operation in C1 function
509 static void sm_c1_t1(sm_key_t r, uint8_t preq[7], uint8_t pres[7], uint8_t iat, uint8_t rat, sm_key_t t1){
510 
511     // p1 = pres || preq || rat’ || iat’
512     // "The octet of iat’ becomes the least significant octet of p1 and the most signifi-
513     // cant octet of pres becomes the most significant octet of p1.
514     // For example, if the 8-bit iat’ is 0x01, the 8-bit rat’ is 0x00, the 56-bit preq
515     // is 0x07071000000101 and the 56 bit pres is 0x05000800000302 then
516     // p1 is 0x05000800000302070710000001010001."
517 
518     sm_key_t p1;
519     reverse_56(pres, &p1[0]);
520     reverse_56(preq, &p1[7]);
521     p1[14] = rat;
522     p1[15] = iat;
523     log_info_key("p1", p1);
524     log_info_key("r", r);
525 
526     // t1 = r xor p1
527     int i;
528     for (i=0;i<16;i++){
529         t1[i] = r[i] ^ p1[i];
530     }
531     log_info_key("t1", t1);
532 }
533 
534 // calculate arguments for second AES128 operation in C1 function
535 static void sm_c1_t3(sm_key_t t2, bd_addr_t ia, bd_addr_t ra, sm_key_t t3){
536      // p2 = padding || ia || ra
537     // "The least significant octet of ra becomes the least significant octet of p2 and
538     // the most significant octet of padding becomes the most significant octet of p2.
539     // For example, if 48-bit ia is 0xA1A2A3A4A5A6 and the 48-bit ra is
540     // 0xB1B2B3B4B5B6 then p2 is 0x00000000A1A2A3A4A5A6B1B2B3B4B5B6.
541 
542     sm_key_t p2;
543     memset(p2, 0, 16);
544     memcpy(&p2[4],  ia, 6);
545     memcpy(&p2[10], ra, 6);
546     log_info_key("p2", p2);
547 
548     // c1 = e(k, t2_xor_p2)
549     int i;
550     for (i=0;i<16;i++){
551         t3[i] = t2[i] ^ p2[i];
552     }
553     log_info_key("t3", t3);
554 }
555 
556 static void sm_s1_r_prime(sm_key_t r1, sm_key_t r2, sm_key_t r_prime){
557     log_info_key("r1", r1);
558     log_info_key("r2", r2);
559     memcpy(&r_prime[8], &r2[8], 8);
560     memcpy(&r_prime[0], &r1[8], 8);
561 }
562 
563 #ifdef ENABLE_LE_SECURE_CONNECTIONS
564 // Software implementations of crypto toolbox for LE Secure Connection
565 // TODO: replace with code to use AES Engine of HCI Controller
566 typedef uint8_t sm_key24_t[3];
567 typedef uint8_t sm_key56_t[7];
568 typedef uint8_t sm_key256_t[32];
569 
570 #if 0
571 static void aes128_calc_cyphertext(const uint8_t key[16], const uint8_t plaintext[16], uint8_t cyphertext[16]){
572     uint32_t rk[RKLENGTH(KEYBITS)];
573     int nrounds = rijndaelSetupEncrypt(rk, &key[0], KEYBITS);
574     rijndaelEncrypt(rk, nrounds, plaintext, cyphertext);
575 }
576 
577 static void calc_subkeys(sm_key_t k0, sm_key_t k1, sm_key_t k2){
578     memcpy(k1, k0, 16);
579     sm_shift_left_by_one_bit_inplace(16, k1);
580     if (k0[0] & 0x80){
581         k1[15] ^= 0x87;
582     }
583     memcpy(k2, k1, 16);
584     sm_shift_left_by_one_bit_inplace(16, k2);
585     if (k1[0] & 0x80){
586         k2[15] ^= 0x87;
587     }
588 }
589 
590 static void aes_cmac(sm_key_t aes_cmac, const sm_key_t key, const uint8_t * data, int cmac_message_len){
591     sm_key_t k0, k1, k2, zero;
592     memset(zero, 0, 16);
593 
594     aes128_calc_cyphertext(key, zero, k0);
595     calc_subkeys(k0, k1, k2);
596 
597     int cmac_block_count = (cmac_message_len + 15) / 16;
598 
599     // step 3: ..
600     if (cmac_block_count==0){
601         cmac_block_count = 1;
602     }
603 
604     // step 4: set m_last
605     sm_key_t cmac_m_last;
606     int sm_cmac_last_block_complete = cmac_message_len != 0 && (cmac_message_len & 0x0f) == 0;
607     int i;
608     if (sm_cmac_last_block_complete){
609         for (i=0;i<16;i++){
610             cmac_m_last[i] = data[cmac_message_len - 16 + i] ^ k1[i];
611         }
612     } else {
613         int valid_octets_in_last_block = cmac_message_len & 0x0f;
614         for (i=0;i<16;i++){
615             if (i < valid_octets_in_last_block){
616                 cmac_m_last[i] = data[(cmac_message_len & 0xfff0) + i] ^ k2[i];
617                 continue;
618             }
619             if (i == valid_octets_in_last_block){
620                 cmac_m_last[i] = 0x80 ^ k2[i];
621                 continue;
622             }
623             cmac_m_last[i] = k2[i];
624         }
625     }
626 
627     // printf("sm_cmac_start: len %u, block count %u\n", cmac_message_len, cmac_block_count);
628     // LOG_KEY(cmac_m_last);
629 
630     // Step 5
631     sm_key_t cmac_x;
632     memset(cmac_x, 0, 16);
633 
634     // Step 6
635     sm_key_t sm_cmac_y;
636     for (int block = 0 ; block < cmac_block_count-1 ; block++){
637         for (i=0;i<16;i++){
638             sm_cmac_y[i] = cmac_x[i] ^ data[block * 16 + i];
639         }
640         aes128_calc_cyphertext(key, sm_cmac_y, cmac_x);
641     }
642     for (i=0;i<16;i++){
643         sm_cmac_y[i] = cmac_x[i] ^ cmac_m_last[i];
644     }
645 
646     // Step 7
647     aes128_calc_cyphertext(key, sm_cmac_y, aes_cmac);
648 }
649 #endif
650 
651 #if 0
652 //
653 // Link Key Conversion Function h6
654 //
655 // h6(W, keyID) = AES-CMACW(keyID)
656 // - W is 128 bits
657 // - keyID is 32 bits
658 static void h6(sm_key_t res, const sm_key_t w, const uint32_t key_id){
659     uint8_t key_id_buffer[4];
660     big_endian_store_32(key_id_buffer, 0, key_id);
661     aes_cmac(res, w, key_id_buffer, 4);
662 }
663 #endif
664 #endif
665 
666 static void sm_setup_event_base(uint8_t * event, int event_size, uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
667     event[0] = type;
668     event[1] = event_size - 2;
669     little_endian_store_16(event, 2, con_handle);
670     event[4] = addr_type;
671     reverse_bd_addr(address, &event[5]);
672 }
673 
674 static void sm_dispatch_event(uint8_t packet_type, uint16_t channel, uint8_t * packet, uint16_t size){
675     if (sm_client_packet_handler) {
676         sm_client_packet_handler(HCI_EVENT_PACKET, 0, packet, size);
677     }
678     // dispatch to all event handlers
679     btstack_linked_list_iterator_t it;
680     btstack_linked_list_iterator_init(&it, &sm_event_handlers);
681     while (btstack_linked_list_iterator_has_next(&it)){
682         btstack_packet_callback_registration_t * entry = (btstack_packet_callback_registration_t*) btstack_linked_list_iterator_next(&it);
683         entry->callback(packet_type, 0, packet, size);
684     }
685 }
686 
687 static void sm_notify_client_base(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
688     uint8_t event[11];
689     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
690     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
691 }
692 
693 static void sm_notify_client_passkey(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint32_t passkey){
694     uint8_t event[15];
695     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
696     little_endian_store_32(event, 11, passkey);
697     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
698 }
699 
700 static void sm_notify_client_index(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint16_t index){
701     uint8_t event[13];
702     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
703     little_endian_store_16(event, 11, index);
704     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
705 }
706 
707 static void sm_notify_client_authorization(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint8_t result){
708 
709     uint8_t event[18];
710     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
711     event[11] = result;
712     sm_dispatch_event(HCI_EVENT_PACKET, 0, (uint8_t*) &event, sizeof(event));
713 }
714 
715 // decide on stk generation based on
716 // - pairing request
717 // - io capabilities
718 // - OOB data availability
719 static void sm_setup_tk(void){
720 
721     // default: just works
722     setup->sm_stk_generation_method = JUST_WORKS;
723 
724 #ifdef ENABLE_LE_SECURE_CONNECTIONS
725     setup->sm_use_secure_connections = ( sm_pairing_packet_get_auth_req(setup->sm_m_preq)
726                                        & sm_pairing_packet_get_auth_req(setup->sm_s_pres)
727                                        & SM_AUTHREQ_SECURE_CONNECTION ) != 0;
728     memset(setup->sm_ra, 0, 16);
729     memset(setup->sm_rb, 0, 16);
730 #else
731     setup->sm_use_secure_connections = 0;
732 #endif
733 
734     // If both devices have not set the MITM option in the Authentication Requirements
735     // Flags, then the IO capabilities shall be ignored and the Just Works association
736     // model shall be used.
737     if (((sm_pairing_packet_get_auth_req(setup->sm_m_preq) & SM_AUTHREQ_MITM_PROTECTION) == 0)
738     &&  ((sm_pairing_packet_get_auth_req(setup->sm_s_pres) & SM_AUTHREQ_MITM_PROTECTION) == 0)){
739         log_info("SM: MITM not required by both -> JUST WORKS");
740         return;
741     }
742 
743     // TODO: with LE SC, OOB is used to transfer data OOB during pairing, single device with OOB is sufficient
744 
745     // If both devices have out of band authentication data, then the Authentication
746     // Requirements Flags shall be ignored when selecting the pairing method and the
747     // Out of Band pairing method shall be used.
748     if (sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq)
749     &&  sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres)){
750         log_info("SM: have OOB data");
751         log_info_key("OOB", setup->sm_tk);
752         setup->sm_stk_generation_method = OOB;
753         return;
754     }
755 
756     // Reset TK as it has been setup in sm_init_setup
757     sm_reset_tk();
758 
759     // Also use just works if unknown io capabilites
760     if ((sm_pairing_packet_get_io_capability(setup->sm_m_preq) > IO_CAPABILITY_KEYBOARD_DISPLAY) || (sm_pairing_packet_get_io_capability(setup->sm_s_pres) > IO_CAPABILITY_KEYBOARD_DISPLAY)){
761         return;
762     }
763 
764     // Otherwise the IO capabilities of the devices shall be used to determine the
765     // pairing method as defined in Table 2.4.
766     // see http://stackoverflow.com/a/1052837/393697 for how to specify pointer to 2-dimensional array
767     const stk_generation_method_t (*generation_method)[5] = stk_generation_method;
768 
769 #ifdef ENABLE_LE_SECURE_CONNECTIONS
770     // table not define by default
771     if (setup->sm_use_secure_connections){
772         generation_method = stk_generation_method_with_secure_connection;
773     }
774 #endif
775     setup->sm_stk_generation_method = generation_method[sm_pairing_packet_get_io_capability(setup->sm_s_pres)][sm_pairing_packet_get_io_capability(setup->sm_m_preq)];
776 
777     log_info("sm_setup_tk: master io cap: %u, slave io cap: %u -> method %u",
778         sm_pairing_packet_get_io_capability(setup->sm_m_preq), sm_pairing_packet_get_io_capability(setup->sm_s_pres), setup->sm_stk_generation_method);
779 }
780 
781 static int sm_key_distribution_flags_for_set(uint8_t key_set){
782     int flags = 0;
783     if (key_set & SM_KEYDIST_ENC_KEY){
784         flags |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
785         flags |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
786     }
787     if (key_set & SM_KEYDIST_ID_KEY){
788         flags |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
789         flags |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
790     }
791     if (key_set & SM_KEYDIST_SIGN){
792         flags |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
793     }
794     return flags;
795 }
796 
797 static void sm_setup_key_distribution(uint8_t key_set){
798     setup->sm_key_distribution_received_set = 0;
799     setup->sm_key_distribution_send_set = sm_key_distribution_flags_for_set(key_set);
800 }
801 
802 // CSRK Key Lookup
803 
804 
805 static int sm_address_resolution_idle(void){
806     return sm_address_resolution_mode == ADDRESS_RESOLUTION_IDLE;
807 }
808 
809 static void sm_address_resolution_start_lookup(uint8_t addr_type, hci_con_handle_t con_handle, bd_addr_t addr, address_resolution_mode_t mode, void * context){
810     memcpy(sm_address_resolution_address, addr, 6);
811     sm_address_resolution_addr_type = addr_type;
812     sm_address_resolution_test = 0;
813     sm_address_resolution_mode = mode;
814     sm_address_resolution_context = context;
815     sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_STARTED, con_handle, addr_type, addr);
816 }
817 
818 int sm_address_resolution_lookup(uint8_t address_type, bd_addr_t address){
819     // check if already in list
820     btstack_linked_list_iterator_t it;
821     sm_lookup_entry_t * entry;
822     btstack_linked_list_iterator_init(&it, &sm_address_resolution_general_queue);
823     while(btstack_linked_list_iterator_has_next(&it)){
824         entry = (sm_lookup_entry_t *) btstack_linked_list_iterator_next(&it);
825         if (entry->address_type != address_type) continue;
826         if (memcmp(entry->address, address, 6))  continue;
827         // already in list
828         return BTSTACK_BUSY;
829     }
830     entry = btstack_memory_sm_lookup_entry_get();
831     if (!entry) return BTSTACK_MEMORY_ALLOC_FAILED;
832     entry->address_type = (bd_addr_type_t) address_type;
833     memcpy(entry->address, address, 6);
834     btstack_linked_list_add(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
835     sm_run();
836     return 0;
837 }
838 
839 // CMAC Implementation using AES128 engine
840 static void sm_shift_left_by_one_bit_inplace(int len, uint8_t * data){
841     int i;
842     int carry = 0;
843     for (i=len-1; i >= 0 ; i--){
844         int new_carry = data[i] >> 7;
845         data[i] = data[i] << 1 | carry;
846         carry = new_carry;
847     }
848 }
849 
850 // while x_state++ for an enum is possible in C, it isn't in C++. we use this helpers to avoid compile errors for now
851 static inline void sm_next_responding_state(sm_connection_t * sm_conn){
852     sm_conn->sm_engine_state = (security_manager_state_t) (((int)sm_conn->sm_engine_state) + 1);
853 }
854 static inline void dkg_next_state(void){
855     dkg_state = (derived_key_generation_t) (((int)dkg_state) + 1);
856 }
857 static inline void rau_next_state(void){
858     rau_state = (random_address_update_t) (((int)rau_state) + 1);
859 }
860 
861 // CMAC calculation using AES Engine
862 
863 static inline void sm_cmac_next_state(void){
864     sm_cmac_state = (cmac_state_t) (((int)sm_cmac_state) + 1);
865 }
866 
867 static int sm_cmac_last_block_complete(void){
868     if (sm_cmac_message_len == 0) return 0;
869     return (sm_cmac_message_len & 0x0f) == 0;
870 }
871 
872 static inline uint8_t sm_cmac_message_get_byte(uint16_t offset){
873     if (offset >= sm_cmac_message_len) {
874         log_error("sm_cmac_message_get_byte. out of bounds, access %u, len %u", offset, sm_cmac_message_len);
875         return 0;
876     }
877 
878     offset = sm_cmac_message_len - 1 - offset;
879 
880     // sm_cmac_header[3] | message[] | sm_cmac_sign_counter[4]
881     if (offset < 3){
882         return sm_cmac_header[offset];
883     }
884     int actual_message_len_incl_header = sm_cmac_message_len - 4;
885     if (offset <  actual_message_len_incl_header){
886         return sm_cmac_message[offset - 3];
887     }
888     return sm_cmac_sign_counter[offset - actual_message_len_incl_header];
889 }
890 
891 // generic cmac calculation
892 void sm_cmac_general_start(const sm_key_t key, uint16_t message_len, uint8_t (*get_byte_callback)(uint16_t offset), void (*done_callback)(uint8_t hash[8])){
893     // Generalized CMAC
894     memcpy(sm_cmac_k, key, 16);
895     memset(sm_cmac_x, 0, 16);
896     sm_cmac_block_current = 0;
897     sm_cmac_message_len  = message_len;
898     sm_cmac_done_handler = done_callback;
899     sm_cmac_get_byte     = get_byte_callback;
900 
901     // step 2: n := ceil(len/const_Bsize);
902     sm_cmac_block_count = (sm_cmac_message_len + 15) / 16;
903 
904     // step 3: ..
905     if (sm_cmac_block_count==0){
906         sm_cmac_block_count = 1;
907     }
908     log_info("sm_cmac_connection %p", sm_cmac_connection);
909     log_info("sm_cmac_general_start: len %u, block count %u", sm_cmac_message_len, sm_cmac_block_count);
910 
911     // first, we need to compute l for k1, k2, and m_last
912     sm_cmac_state = CMAC_CALC_SUBKEYS;
913 
914     // let's go
915     sm_run();
916 }
917 
918 // cmac for ATT Message signing
919 void sm_cmac_start(const sm_key_t k, uint8_t opcode, hci_con_handle_t con_handle, uint16_t message_len, const uint8_t * message, uint32_t sign_counter, void (*done_handler)(uint8_t * hash)){
920     // ATT Message Signing
921     sm_cmac_header[0] = opcode;
922     little_endian_store_16(sm_cmac_header, 1, con_handle);
923     little_endian_store_32(sm_cmac_sign_counter, 0, sign_counter);
924     uint16_t total_message_len = 3 + message_len + 4;  // incl. virtually prepended att opcode, handle and appended sign_counter in LE
925     sm_cmac_message = message;
926     sm_cmac_general_start(k, total_message_len, &sm_cmac_message_get_byte, done_handler);
927 }
928 
929 int sm_cmac_ready(void){
930     return sm_cmac_state == CMAC_IDLE;
931 }
932 
933 static void sm_cmac_handle_aes_engine_ready(void){
934     switch (sm_cmac_state){
935         case CMAC_CALC_SUBKEYS: {
936             sm_key_t const_zero;
937             memset(const_zero, 0, 16);
938             sm_cmac_next_state();
939             sm_aes128_start(sm_cmac_k, const_zero, NULL);
940             break;
941         }
942         case CMAC_CALC_MI: {
943             int j;
944             sm_key_t y;
945             for (j=0;j<16;j++){
946                 y[j] = sm_cmac_x[j] ^ sm_cmac_get_byte(sm_cmac_block_current*16 + j);
947             }
948             sm_cmac_block_current++;
949             sm_cmac_next_state();
950             sm_aes128_start(sm_cmac_k, y, NULL);
951             break;
952         }
953         case CMAC_CALC_MLAST: {
954             int i;
955             sm_key_t y;
956             for (i=0;i<16;i++){
957                 y[i] = sm_cmac_x[i] ^ sm_cmac_m_last[i];
958             }
959             log_info_key("Y", y);
960             sm_cmac_block_current++;
961             sm_cmac_next_state();
962             sm_aes128_start(sm_cmac_k, y, NULL);
963             break;
964         }
965         default:
966             log_info("sm_cmac_handle_aes_engine_ready called in state %u", sm_cmac_state);
967             break;
968     }
969 }
970 
971 static void sm_cmac_handle_encryption_result(sm_key_t data){
972     switch (sm_cmac_state){
973         case CMAC_W4_SUBKEYS: {
974             sm_key_t k1;
975             memcpy(k1, data, 16);
976             sm_shift_left_by_one_bit_inplace(16, k1);
977             if (data[0] & 0x80){
978                 k1[15] ^= 0x87;
979             }
980             sm_key_t k2;
981             memcpy(k2, k1, 16);
982             sm_shift_left_by_one_bit_inplace(16, k2);
983             if (k1[0] & 0x80){
984                 k2[15] ^= 0x87;
985             }
986 
987             log_info_key("k", sm_cmac_k);
988             log_info_key("k1", k1);
989             log_info_key("k2", k2);
990 
991             // step 4: set m_last
992             int i;
993             if (sm_cmac_last_block_complete()){
994                 for (i=0;i<16;i++){
995                     sm_cmac_m_last[i] = sm_cmac_get_byte(sm_cmac_message_len - 16 + i) ^ k1[i];
996                 }
997             } else {
998                 int valid_octets_in_last_block = sm_cmac_message_len & 0x0f;
999                 for (i=0;i<16;i++){
1000                     if (i < valid_octets_in_last_block){
1001                         sm_cmac_m_last[i] = sm_cmac_get_byte((sm_cmac_message_len & 0xfff0) + i) ^ k2[i];
1002                         continue;
1003                     }
1004                     if (i == valid_octets_in_last_block){
1005                         sm_cmac_m_last[i] = 0x80 ^ k2[i];
1006                         continue;
1007                     }
1008                     sm_cmac_m_last[i] = k2[i];
1009                 }
1010             }
1011 
1012             // next
1013             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
1014             break;
1015         }
1016         case CMAC_W4_MI:
1017             memcpy(sm_cmac_x, data, 16);
1018             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
1019             break;
1020         case CMAC_W4_MLAST:
1021             // done
1022             log_info("Setting CMAC Engine to IDLE");
1023             sm_cmac_state = CMAC_IDLE;
1024             log_info_key("CMAC", data);
1025             sm_cmac_done_handler(data);
1026             break;
1027         default:
1028             log_info("sm_cmac_handle_encryption_result called in state %u", sm_cmac_state);
1029             break;
1030     }
1031 }
1032 
1033 static void sm_trigger_user_response(sm_connection_t * sm_conn){
1034     // notify client for: JUST WORKS confirm, Numeric comparison confirm, PASSKEY display or input
1035     setup->sm_user_response = SM_USER_RESPONSE_IDLE;
1036     switch (setup->sm_stk_generation_method){
1037         case PK_RESP_INPUT:
1038             if (sm_conn->sm_role){
1039                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1040                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1041             } else {
1042                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1043             }
1044             break;
1045         case PK_INIT_INPUT:
1046             if (sm_conn->sm_role){
1047                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1048             } else {
1049                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1050                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1051             }
1052             break;
1053         case OK_BOTH_INPUT:
1054             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1055             sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1056             break;
1057         case NK_BOTH_INPUT:
1058             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1059             sm_notify_client_passkey(SM_EVENT_NUMERIC_COMPARISON_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1060             break;
1061         case JUST_WORKS:
1062             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1063             sm_notify_client_base(SM_EVENT_JUST_WORKS_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1064             break;
1065         case OOB:
1066             // client already provided OOB data, let's skip notification.
1067             break;
1068     }
1069 }
1070 
1071 static int sm_key_distribution_all_received(sm_connection_t * sm_conn){
1072     int recv_flags;
1073     if (sm_conn->sm_role){
1074         // slave / responder
1075         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres));
1076     } else {
1077         // master / initiator
1078         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
1079     }
1080     log_debug("sm_key_distribution_all_received: received 0x%02x, expecting 0x%02x", setup->sm_key_distribution_received_set, recv_flags);
1081     return recv_flags == setup->sm_key_distribution_received_set;
1082 }
1083 
1084 static void sm_done_for_handle(hci_con_handle_t con_handle){
1085     if (sm_active_connection == con_handle){
1086         sm_timeout_stop();
1087         sm_active_connection = 0;
1088         log_info("sm: connection 0x%x released setup context", con_handle);
1089     }
1090 }
1091 
1092 static int sm_key_distribution_flags_for_auth_req(void){
1093     int flags = SM_KEYDIST_ID_KEY | SM_KEYDIST_SIGN;
1094     if (sm_auth_req & SM_AUTHREQ_BONDING){
1095         // encryption information only if bonding requested
1096         flags |= SM_KEYDIST_ENC_KEY;
1097     }
1098     return flags;
1099 }
1100 
1101 static void sm_init_setup(sm_connection_t * sm_conn){
1102 
1103     // fill in sm setup
1104     setup->sm_state_vars = 0;
1105     sm_reset_tk();
1106     setup->sm_peer_addr_type = sm_conn->sm_peer_addr_type;
1107     memcpy(setup->sm_peer_address, sm_conn->sm_peer_address, 6);
1108 
1109     // query client for OOB data
1110     int have_oob_data = 0;
1111     if (sm_get_oob_data) {
1112         have_oob_data = (*sm_get_oob_data)(sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, setup->sm_tk);
1113     }
1114 
1115     sm_pairing_packet_t * local_packet;
1116     if (sm_conn->sm_role){
1117         // slave
1118         local_packet = &setup->sm_s_pres;
1119         gap_advertisements_get_address(&setup->sm_s_addr_type, setup->sm_s_address);
1120         setup->sm_m_addr_type = sm_conn->sm_peer_addr_type;
1121         memcpy(setup->sm_m_address, sm_conn->sm_peer_address, 6);
1122     } else {
1123         // master
1124         local_packet = &setup->sm_m_preq;
1125         gap_advertisements_get_address(&setup->sm_m_addr_type, setup->sm_m_address);
1126         setup->sm_s_addr_type = sm_conn->sm_peer_addr_type;
1127         memcpy(setup->sm_s_address, sm_conn->sm_peer_address, 6);
1128 
1129         int key_distribution_flags = sm_key_distribution_flags_for_auth_req();
1130         sm_pairing_packet_set_initiator_key_distribution(setup->sm_m_preq, key_distribution_flags);
1131         sm_pairing_packet_set_responder_key_distribution(setup->sm_m_preq, key_distribution_flags);
1132     }
1133 
1134     sm_pairing_packet_set_io_capability(*local_packet, sm_io_capabilities);
1135     sm_pairing_packet_set_oob_data_flag(*local_packet, have_oob_data);
1136     sm_pairing_packet_set_auth_req(*local_packet, sm_auth_req);
1137     sm_pairing_packet_set_max_encryption_key_size(*local_packet, sm_max_encryption_key_size);
1138 }
1139 
1140 static int sm_stk_generation_init(sm_connection_t * sm_conn){
1141 
1142     sm_pairing_packet_t * remote_packet;
1143     int                   remote_key_request;
1144     if (sm_conn->sm_role){
1145         // slave / responder
1146         remote_packet      = &setup->sm_m_preq;
1147         remote_key_request = sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq);
1148     } else {
1149         // master / initiator
1150         remote_packet      = &setup->sm_s_pres;
1151         remote_key_request = sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres);
1152     }
1153 
1154     // check key size
1155     sm_conn->sm_actual_encryption_key_size = sm_calc_actual_encryption_key_size(sm_pairing_packet_get_max_encryption_key_size(*remote_packet));
1156     if (sm_conn->sm_actual_encryption_key_size == 0) return SM_REASON_ENCRYPTION_KEY_SIZE;
1157 
1158     // decide on STK generation method
1159     sm_setup_tk();
1160     log_info("SMP: generation method %u", setup->sm_stk_generation_method);
1161 
1162     // check if STK generation method is acceptable by client
1163     if (!sm_validate_stk_generation_method()) return SM_REASON_AUTHENTHICATION_REQUIREMENTS;
1164 
1165     // identical to responder
1166     sm_setup_key_distribution(remote_key_request);
1167 
1168     // JUST WORKS doens't provide authentication
1169     sm_conn->sm_connection_authenticated = setup->sm_stk_generation_method == JUST_WORKS ? 0 : 1;
1170 
1171     return 0;
1172 }
1173 
1174 static void sm_address_resolution_handle_event(address_resolution_event_t event){
1175 
1176     // cache and reset context
1177     int matched_device_id = sm_address_resolution_test;
1178     address_resolution_mode_t mode = sm_address_resolution_mode;
1179     void * context = sm_address_resolution_context;
1180 
1181     // reset context
1182     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
1183     sm_address_resolution_context = NULL;
1184     sm_address_resolution_test = -1;
1185     hci_con_handle_t con_handle = 0;
1186 
1187     sm_connection_t * sm_connection;
1188     uint16_t ediv;
1189     switch (mode){
1190         case ADDRESS_RESOLUTION_GENERAL:
1191             break;
1192         case ADDRESS_RESOLUTION_FOR_CONNECTION:
1193             sm_connection = (sm_connection_t *) context;
1194             con_handle = sm_connection->sm_handle;
1195             switch (event){
1196                 case ADDRESS_RESOLUTION_SUCEEDED:
1197                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_SUCCEEDED;
1198                     sm_connection->sm_le_db_index = matched_device_id;
1199                     log_info("ADDRESS_RESOLUTION_SUCEEDED, index %d", sm_connection->sm_le_db_index);
1200                     if (sm_connection->sm_role) break;
1201                     if (!sm_connection->sm_bonding_requested && !sm_connection->sm_security_request_received) break;
1202                     sm_connection->sm_security_request_received = 0;
1203                     sm_connection->sm_bonding_requested = 0;
1204                     le_device_db_encryption_get(sm_connection->sm_le_db_index, &ediv, NULL, NULL, NULL, NULL, NULL);
1205                     if (ediv){
1206                         sm_connection->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
1207                     } else {
1208                         sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1209                     }
1210                     break;
1211                 case ADDRESS_RESOLUTION_FAILED:
1212                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_FAILED;
1213                     if (sm_connection->sm_role) break;
1214                     if (!sm_connection->sm_bonding_requested && !sm_connection->sm_security_request_received) break;
1215                     sm_connection->sm_security_request_received = 0;
1216                     sm_connection->sm_bonding_requested = 0;
1217                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1218                     break;
1219             }
1220             break;
1221         default:
1222             break;
1223     }
1224 
1225     switch (event){
1226         case ADDRESS_RESOLUTION_SUCEEDED:
1227             sm_notify_client_index(SM_EVENT_IDENTITY_RESOLVING_SUCCEEDED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address, matched_device_id);
1228             break;
1229         case ADDRESS_RESOLUTION_FAILED:
1230             sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_FAILED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address);
1231             break;
1232     }
1233 }
1234 
1235 static void sm_key_distribution_handle_all_received(sm_connection_t * sm_conn){
1236 
1237     int le_db_index = -1;
1238 
1239     // lookup device based on IRK
1240     if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
1241         int i;
1242         for (i=0; i < le_device_db_count(); i++){
1243             sm_key_t irk;
1244             bd_addr_t address;
1245             int address_type;
1246             le_device_db_info(i, &address_type, address, irk);
1247             if (memcmp(irk, setup->sm_peer_irk, 16) == 0){
1248                 log_info("sm: device found for IRK, updating");
1249                 le_db_index = i;
1250                 break;
1251             }
1252         }
1253     }
1254 
1255     // if not found, lookup via public address if possible
1256     log_info("sm peer addr type %u, peer addres %s", setup->sm_peer_addr_type, bd_addr_to_str(setup->sm_peer_address));
1257     if (le_db_index < 0 && setup->sm_peer_addr_type == BD_ADDR_TYPE_LE_PUBLIC){
1258         int i;
1259         for (i=0; i < le_device_db_count(); i++){
1260             bd_addr_t address;
1261             int address_type;
1262             le_device_db_info(i, &address_type, address, NULL);
1263             log_info("device %u, sm peer addr type %u, peer addres %s", i, address_type, bd_addr_to_str(address));
1264             if (address_type == BD_ADDR_TYPE_LE_PUBLIC && memcmp(address, setup->sm_peer_address, 6) == 0){
1265                 log_info("sm: device found for public address, updating");
1266                 le_db_index = i;
1267                 break;
1268             }
1269         }
1270     }
1271 
1272     // if not found, add to db
1273     if (le_db_index < 0) {
1274         le_db_index = le_device_db_add(setup->sm_peer_addr_type, setup->sm_peer_address, setup->sm_peer_irk);
1275     }
1276 
1277     if (le_db_index >= 0){
1278         le_device_db_local_counter_set(le_db_index, 0);
1279 
1280         // store local CSRK
1281         if (setup->sm_key_distribution_send_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1282             log_info("sm: store local CSRK");
1283             le_device_db_local_csrk_set(le_db_index, setup->sm_local_csrk);
1284             le_device_db_local_counter_set(le_db_index, 0);
1285         }
1286 
1287         // store remote CSRK
1288         if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1289             log_info("sm: store remote CSRK");
1290             le_device_db_remote_csrk_set(le_db_index, setup->sm_peer_csrk);
1291             le_device_db_remote_counter_set(le_db_index, 0);
1292         }
1293 
1294         // store encryption information
1295         if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION
1296             && setup->sm_key_distribution_received_set &  SM_KEYDIST_FLAG_MASTER_IDENTIFICATION){
1297             log_info("sm: set encryption information (key size %u, authenticatd %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
1298             le_device_db_encryption_set(le_db_index, setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1299                 sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
1300         }
1301     }
1302 
1303     // keep le_db_index
1304     sm_conn->sm_le_db_index = le_db_index;
1305 }
1306 
1307 static void sm_pairing_error(sm_connection_t * sm_conn, uint8_t reason){
1308     setup->sm_pairing_failed_reason = reason;
1309     sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1310 }
1311 
1312 static inline void sm_pdu_received_in_wrong_state(sm_connection_t * sm_conn){
1313     sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
1314 }
1315 
1316 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1317 
1318 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn);
1319 static int sm_passkey_used(stk_generation_method_t method);
1320 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method);
1321 
1322 static void sm_sc_start_calculating_local_confirm(sm_connection_t * sm_conn){
1323     if (sm_passkey_used(setup->sm_stk_generation_method)){
1324         sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
1325     } else {
1326         sm_conn->sm_engine_state = SM_SC_W4_CMAC_FOR_CONFIRMATION;
1327     }
1328 }
1329 
1330 static void sm_sc_state_after_receiving_random(sm_connection_t * sm_conn){
1331     if (sm_conn->sm_role){
1332         // Responder
1333         sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
1334     } else {
1335         // Initiator role
1336         switch (setup->sm_stk_generation_method){
1337             case JUST_WORKS:
1338                 sm_sc_prepare_dhkey_check(sm_conn);
1339                 break;
1340 
1341             case NK_BOTH_INPUT:
1342                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_G2;
1343                 break;
1344             case PK_INIT_INPUT:
1345             case PK_RESP_INPUT:
1346             case OK_BOTH_INPUT:
1347                 if (setup->sm_passkey_bit < 20) {
1348                     sm_sc_start_calculating_local_confirm(sm_conn);
1349                 } else {
1350                     sm_sc_prepare_dhkey_check(sm_conn);
1351                 }
1352                 break;
1353             case OOB:
1354                 // TODO: implement SC OOB
1355                 break;
1356         }
1357     }
1358 }
1359 
1360 static uint8_t sm_sc_cmac_get_byte(uint16_t offset){
1361     return sm_cmac_sc_buffer[offset];
1362 }
1363 
1364 static void sm_sc_cmac_done(uint8_t * hash){
1365     log_info("sm_sc_cmac_done: ");
1366     log_info_hexdump(hash, 16);
1367 
1368     sm_connection_t * sm_conn = sm_cmac_connection;
1369     sm_cmac_connection = NULL;
1370 
1371     switch (sm_conn->sm_engine_state){
1372         case SM_SC_W4_CMAC_FOR_CONFIRMATION:
1373             memcpy(setup->sm_local_confirm, hash, 16);
1374             sm_conn->sm_engine_state = SM_SC_SEND_CONFIRMATION;
1375             break;
1376         case SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION:
1377             // check
1378             if (0 != memcmp(hash, setup->sm_peer_confirm, 16)){
1379                 sm_pairing_error(sm_conn, SM_REASON_CONFIRM_VALUE_FAILED);
1380                 break;
1381             }
1382             sm_sc_state_after_receiving_random(sm_conn);
1383             break;
1384         case SM_SC_W4_CALCULATE_G2: {
1385             uint32_t vab = big_endian_read_32(hash, 12) % 1000000;
1386             big_endian_store_32(setup->sm_tk, 12, vab);
1387             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
1388             sm_trigger_user_response(sm_conn);
1389             break;
1390         }
1391         case SM_SC_W4_CALCULATE_F5_SALT:
1392             memcpy(setup->sm_t, hash, 16);
1393             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_MACKEY;
1394             break;
1395         case SM_SC_W4_CALCULATE_F5_MACKEY:
1396             memcpy(setup->sm_mackey, hash, 16);
1397             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_LTK;
1398             break;
1399         case SM_SC_W4_CALCULATE_F5_LTK:
1400             memcpy(setup->sm_ltk, hash, 16);
1401             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK;
1402             break;
1403         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
1404             memcpy(setup->sm_local_dhkey_check, hash, 16);
1405             if (sm_conn->sm_role){
1406                 // responder
1407                 if (setup->sm_state_vars & SM_STATE_VAR_DHKEY_COMMAND_RECEIVED){
1408                     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
1409                 } else {
1410                     sm_conn->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
1411                 }
1412             } else {
1413                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1414             }
1415             break;
1416         case SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
1417             if (0 != memcmp(hash, setup->sm_peer_dhkey_check, 16) ){
1418                 sm_pairing_error(sm_conn, SM_REASON_DHKEY_CHECK_FAILED);
1419                 break;
1420             }
1421             if (sm_conn->sm_role){
1422                 // responder
1423                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1424             } else {
1425                 // initiator
1426                 sm_conn->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
1427             }
1428             break;
1429         default:
1430             log_error("sm_sc_cmac_done in state %u", sm_conn->sm_engine_state);
1431             break;
1432     }
1433     sm_run();
1434 }
1435 
1436 static void f4_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, uint8_t z){
1437     const uint16_t message_len = 65;
1438     sm_cmac_connection = sm_conn;
1439     memcpy(sm_cmac_sc_buffer, u, 32);
1440     memcpy(sm_cmac_sc_buffer+32, v, 32);
1441     sm_cmac_sc_buffer[64] = z;
1442     log_info("f4 key");
1443     log_info_hexdump(x, 16);
1444     log_info("f4 message");
1445     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1446     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1447 }
1448 
1449 static const sm_key_t f5_salt = { 0x6C ,0x88, 0x83, 0x91, 0xAA, 0xF5, 0xA5, 0x38, 0x60, 0x37, 0x0B, 0xDB, 0x5A, 0x60, 0x83, 0xBE};
1450 static const uint8_t f5_key_id[] = { 0x62, 0x74, 0x6c, 0x65 };
1451 static const uint8_t f5_length[] = { 0x01, 0x00};
1452 
1453 static void sm_sc_calculate_dhkey(sm_key256_t dhkey){
1454 #ifdef USE_MBEDTLS_FOR_ECDH
1455     // da * Pb
1456     mbedtls_ecp_group grp;
1457     mbedtls_ecp_group_init( &grp );
1458     mbedtls_ecp_group_load(&grp, MBEDTLS_ECP_DP_SECP256R1);
1459     mbedtls_ecp_point Q;
1460     mbedtls_ecp_point_init( &Q );
1461     mbedtls_mpi_read_binary(&Q.X, setup->sm_peer_qx, 32);
1462     mbedtls_mpi_read_binary(&Q.Y, setup->sm_peer_qy, 32);
1463     mbedtls_mpi_read_string(&Q.Z, 16, "1" );
1464     mbedtls_ecp_point DH;
1465     mbedtls_ecp_point_init( &DH );
1466     mbedtls_ecp_mul(&grp, &DH, &le_keypair.d, &Q, NULL, NULL);
1467     mbedtls_mpi_write_binary(&DH.X, dhkey, 32);
1468 #endif
1469     log_info("dhkey");
1470     log_info_hexdump(dhkey, 32);
1471 }
1472 
1473 static void f5_calculate_salt(sm_connection_t * sm_conn){
1474     // calculate DHKEY
1475     sm_key256_t dhkey;
1476     sm_sc_calculate_dhkey(dhkey);
1477 
1478     // calculate salt for f5
1479     const uint16_t message_len = 32;
1480     sm_cmac_connection = sm_conn;
1481     memcpy(sm_cmac_sc_buffer, dhkey, message_len);
1482     sm_cmac_general_start(f5_salt, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1483 }
1484 
1485 static inline void f5_mackkey(sm_connection_t * sm_conn, sm_key_t t, const sm_key_t n1, const sm_key_t n2, const sm_key56_t a1, const sm_key56_t a2){
1486     const uint16_t message_len = 53;
1487     sm_cmac_connection = sm_conn;
1488 
1489     // f5(W, N1, N2, A1, A2) = AES-CMACT (Counter = 0 || keyID || N1 || N2|| A1|| A2 || Length = 256) -- this is the MacKey
1490     sm_cmac_sc_buffer[0] = 0;
1491     memcpy(sm_cmac_sc_buffer+01, f5_key_id, 4);
1492     memcpy(sm_cmac_sc_buffer+05, n1, 16);
1493     memcpy(sm_cmac_sc_buffer+21, n2, 16);
1494     memcpy(sm_cmac_sc_buffer+37, a1, 7);
1495     memcpy(sm_cmac_sc_buffer+44, a2, 7);
1496     memcpy(sm_cmac_sc_buffer+51, f5_length, 2);
1497     log_info("f5 key");
1498     log_info_hexdump(t, 16);
1499     log_info("f5 message for MacKey");
1500     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1501     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1502 }
1503 
1504 static void f5_calculate_mackey(sm_connection_t * sm_conn){
1505     sm_key56_t bd_addr_master, bd_addr_slave;
1506     bd_addr_master[0] =  setup->sm_m_addr_type;
1507     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1508     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1509     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1510     if (sm_conn->sm_role){
1511         // responder
1512         f5_mackkey(sm_conn, setup->sm_t, setup->sm_peer_nonce, setup->sm_local_nonce, bd_addr_master, bd_addr_slave);
1513     } else {
1514         // initiator
1515         f5_mackkey(sm_conn, setup->sm_t, setup->sm_local_nonce, setup->sm_peer_nonce, bd_addr_master, bd_addr_slave);
1516     }
1517 }
1518 
1519 // note: must be called right after f5_mackey, as sm_cmac_buffer[1..52] will be reused
1520 static inline void f5_ltk(sm_connection_t * sm_conn, sm_key_t t){
1521     const uint16_t message_len = 53;
1522     sm_cmac_connection = sm_conn;
1523     sm_cmac_sc_buffer[0] = 1;
1524     // 1..52 setup before
1525     log_info("f5 key");
1526     log_info_hexdump(t, 16);
1527     log_info("f5 message for LTK");
1528     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1529     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1530 }
1531 
1532 static void f5_calculate_ltk(sm_connection_t * sm_conn){
1533     f5_ltk(sm_conn, setup->sm_t);
1534 }
1535 
1536 static void f6_engine(sm_connection_t * sm_conn, const sm_key_t w, const sm_key_t n1, const sm_key_t n2, const sm_key_t r, const sm_key24_t io_cap, const sm_key56_t a1, const sm_key56_t a2){
1537     const uint16_t message_len = 65;
1538     sm_cmac_connection = sm_conn;
1539     memcpy(sm_cmac_sc_buffer, n1, 16);
1540     memcpy(sm_cmac_sc_buffer+16, n2, 16);
1541     memcpy(sm_cmac_sc_buffer+32, r, 16);
1542     memcpy(sm_cmac_sc_buffer+48, io_cap, 3);
1543     memcpy(sm_cmac_sc_buffer+51, a1, 7);
1544     memcpy(sm_cmac_sc_buffer+58, a2, 7);
1545     log_info("f6 key");
1546     log_info_hexdump(w, 16);
1547     log_info("f6 message");
1548     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1549     sm_cmac_general_start(w, 65, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1550 }
1551 
1552 // g2(U, V, X, Y) = AES-CMACX(U || V || Y) mod 2^32
1553 // - U is 256 bits
1554 // - V is 256 bits
1555 // - X is 128 bits
1556 // - Y is 128 bits
1557 static void g2_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, const sm_key_t y){
1558     const uint16_t message_len = 80;
1559     sm_cmac_connection = sm_conn;
1560     memcpy(sm_cmac_sc_buffer, u, 32);
1561     memcpy(sm_cmac_sc_buffer+32, v, 32);
1562     memcpy(sm_cmac_sc_buffer+64, y, 16);
1563     log_info("g2 key");
1564     log_info_hexdump(x, 16);
1565     log_info("g2 message");
1566     log_info_hexdump(sm_cmac_sc_buffer, sizeof(sm_cmac_sc_buffer));
1567     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1568 }
1569 
1570 static void g2_calculate(sm_connection_t * sm_conn) {
1571     // calc Va if numeric comparison
1572     uint8_t value[32];
1573     mbedtls_mpi_write_binary(&le_keypair.Q.X, value, sizeof(value));
1574     if (sm_conn->sm_role){
1575         // responder
1576         g2_engine(sm_conn, setup->sm_peer_qx, value, setup->sm_peer_nonce, setup->sm_local_nonce);;
1577     } else {
1578         // initiator
1579         g2_engine(sm_conn, value, setup->sm_peer_qx, setup->sm_local_nonce, setup->sm_peer_nonce);
1580     }
1581 }
1582 
1583 static void sm_sc_calculate_local_confirm(sm_connection_t * sm_conn){
1584     uint8_t z = 0;
1585     if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT){
1586         // some form of passkey
1587         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1588         z = 0x80 | ((pk >> setup->sm_passkey_bit) & 1);
1589         setup->sm_passkey_bit++;
1590     }
1591 #ifdef USE_MBEDTLS_FOR_ECDH
1592     uint8_t local_qx[32];
1593     mbedtls_mpi_write_binary(&le_keypair.Q.X, local_qx, sizeof(local_qx));
1594 #endif
1595     f4_engine(sm_conn, local_qx, setup->sm_peer_qx, setup->sm_local_nonce, z);
1596 }
1597 
1598 static void sm_sc_calculate_remote_confirm(sm_connection_t * sm_conn){
1599     uint8_t z = 0;
1600     if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT){
1601         // some form of passkey
1602         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1603         // sm_passkey_bit was increased before sending confirm value
1604         z = 0x80 | ((pk >> (setup->sm_passkey_bit-1)) & 1);
1605     }
1606 #ifdef USE_MBEDTLS_FOR_ECDH
1607     uint8_t local_qx[32];
1608     mbedtls_mpi_write_binary(&le_keypair.Q.X, local_qx, sizeof(local_qx));
1609 #endif
1610     f4_engine(sm_conn, setup->sm_peer_qx, local_qx, setup->sm_peer_nonce, z);
1611 }
1612 
1613 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn){
1614     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_SALT;
1615 }
1616 
1617 static void sm_sc_calculate_f6_for_dhkey_check(sm_connection_t * sm_conn){
1618     // calculate DHKCheck
1619     sm_key56_t bd_addr_master, bd_addr_slave;
1620     bd_addr_master[0] =  setup->sm_m_addr_type;
1621     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1622     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1623     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1624     uint8_t iocap_a[3];
1625     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1626     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1627     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1628     uint8_t iocap_b[3];
1629     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1630     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1631     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1632     if (sm_conn->sm_role){
1633         // responder
1634         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1635     } else {
1636         // initiator
1637         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1638     }
1639 }
1640 
1641 static void sm_sc_calculate_f6_to_verify_dhkey_check(sm_connection_t * sm_conn){
1642     // validate E = f6()
1643     sm_key56_t bd_addr_master, bd_addr_slave;
1644     bd_addr_master[0] =  setup->sm_m_addr_type;
1645     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1646     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1647     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1648 
1649     uint8_t iocap_a[3];
1650     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1651     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1652     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1653     uint8_t iocap_b[3];
1654     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1655     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1656     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1657     if (sm_conn->sm_role){
1658         // responder
1659         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1660     } else {
1661         // initiator
1662         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1663     }
1664 }
1665 #endif
1666 
1667 
1668 static void sm_run(void){
1669 
1670     btstack_linked_list_iterator_t it;
1671 
1672     // assert that we can send at least commands
1673     if (!hci_can_send_command_packet_now()) return;
1674 
1675     //
1676     // non-connection related behaviour
1677     //
1678 
1679     // distributed key generation
1680     switch (dkg_state){
1681         case DKG_CALC_IRK:
1682             // already busy?
1683             if (sm_aes128_state == SM_AES128_IDLE) {
1684                 // IRK = d1(IR, 1, 0)
1685                 sm_key_t d1_prime;
1686                 sm_d1_d_prime(1, 0, d1_prime);  // plaintext
1687                 dkg_next_state();
1688                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
1689                 return;
1690             }
1691             break;
1692         case DKG_CALC_DHK:
1693             // already busy?
1694             if (sm_aes128_state == SM_AES128_IDLE) {
1695                 // DHK = d1(IR, 3, 0)
1696                 sm_key_t d1_prime;
1697                 sm_d1_d_prime(3, 0, d1_prime);  // plaintext
1698                 dkg_next_state();
1699                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
1700                 return;
1701             }
1702             break;
1703         default:
1704             break;
1705     }
1706 
1707 #ifdef USE_MBEDTLS_FOR_ECDH
1708     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
1709         sm_random_start(NULL);
1710         return;
1711     }
1712 #endif
1713 
1714     // random address updates
1715     switch (rau_state){
1716         case RAU_GET_RANDOM:
1717             rau_next_state();
1718             sm_random_start(NULL);
1719             return;
1720         case RAU_GET_ENC:
1721             // already busy?
1722             if (sm_aes128_state == SM_AES128_IDLE) {
1723                 sm_key_t r_prime;
1724                 sm_ah_r_prime(sm_random_address, r_prime);
1725                 rau_next_state();
1726                 sm_aes128_start(sm_persistent_irk, r_prime, NULL);
1727                 return;
1728             }
1729             break;
1730         case RAU_SET_ADDRESS:
1731             log_info("New random address: %s", bd_addr_to_str(sm_random_address));
1732             rau_state = RAU_IDLE;
1733             hci_send_cmd(&hci_le_set_random_address, sm_random_address);
1734             return;
1735         default:
1736             break;
1737     }
1738 
1739     // CMAC
1740     switch (sm_cmac_state){
1741         case CMAC_CALC_SUBKEYS:
1742         case CMAC_CALC_MI:
1743         case CMAC_CALC_MLAST:
1744             // already busy?
1745             if (sm_aes128_state == SM_AES128_ACTIVE) break;
1746             sm_cmac_handle_aes_engine_ready();
1747             return;
1748         default:
1749             break;
1750     }
1751 
1752     // CSRK Lookup
1753     // -- if csrk lookup ready, find connection that require csrk lookup
1754     if (sm_address_resolution_idle()){
1755         hci_connections_get_iterator(&it);
1756         while(btstack_linked_list_iterator_has_next(&it)){
1757             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1758             sm_connection_t  * sm_connection  = &hci_connection->sm_connection;
1759             if (sm_connection->sm_irk_lookup_state == IRK_LOOKUP_W4_READY){
1760                 // and start lookup
1761                 sm_address_resolution_start_lookup(sm_connection->sm_peer_addr_type, sm_connection->sm_handle, sm_connection->sm_peer_address, ADDRESS_RESOLUTION_FOR_CONNECTION, sm_connection);
1762                 sm_connection->sm_irk_lookup_state = IRK_LOOKUP_STARTED;
1763                 break;
1764             }
1765         }
1766     }
1767 
1768     // -- if csrk lookup ready, resolved addresses for received addresses
1769     if (sm_address_resolution_idle()) {
1770         if (!btstack_linked_list_empty(&sm_address_resolution_general_queue)){
1771             sm_lookup_entry_t * entry = (sm_lookup_entry_t *) sm_address_resolution_general_queue;
1772             btstack_linked_list_remove(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
1773             sm_address_resolution_start_lookup(entry->address_type, 0, entry->address, ADDRESS_RESOLUTION_GENERAL, NULL);
1774             btstack_memory_sm_lookup_entry_free(entry);
1775         }
1776     }
1777 
1778     // -- Continue with CSRK device lookup by public or resolvable private address
1779     if (!sm_address_resolution_idle()){
1780         log_info("LE Device Lookup: device %u/%u", sm_address_resolution_test, le_device_db_count());
1781         while (sm_address_resolution_test < le_device_db_count()){
1782             int addr_type;
1783             bd_addr_t addr;
1784             sm_key_t irk;
1785             le_device_db_info(sm_address_resolution_test, &addr_type, addr, irk);
1786             log_info("device type %u, addr: %s", addr_type, bd_addr_to_str(addr));
1787 
1788             if (sm_address_resolution_addr_type == addr_type && memcmp(addr, sm_address_resolution_address, 6) == 0){
1789                 log_info("LE Device Lookup: found CSRK by { addr_type, address} ");
1790                 sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
1791                 break;
1792             }
1793 
1794             if (sm_address_resolution_addr_type == 0){
1795                 sm_address_resolution_test++;
1796                 continue;
1797             }
1798 
1799             if (sm_aes128_state == SM_AES128_ACTIVE) break;
1800 
1801             log_info("LE Device Lookup: calculate AH");
1802             log_info_key("IRK", irk);
1803 
1804             sm_key_t r_prime;
1805             sm_ah_r_prime(sm_address_resolution_address, r_prime);
1806             sm_address_resolution_ah_calculation_active = 1;
1807             sm_aes128_start(irk, r_prime, sm_address_resolution_context);   // keep context
1808             return;
1809         }
1810 
1811         if (sm_address_resolution_test >= le_device_db_count()){
1812             log_info("LE Device Lookup: not found");
1813             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_FAILED);
1814         }
1815     }
1816 
1817 
1818     //
1819     // active connection handling
1820     // -- use loop to handle next connection if lock on setup context is released
1821 
1822     while (1) {
1823 
1824         // Find connections that requires setup context and make active if no other is locked
1825         hci_connections_get_iterator(&it);
1826         while(!sm_active_connection && btstack_linked_list_iterator_has_next(&it)){
1827             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1828             sm_connection_t  * sm_connection = &hci_connection->sm_connection;
1829             // - if no connection locked and we're ready/waiting for setup context, fetch it and start
1830             int done = 1;
1831             int err;
1832             int encryption_key_size;
1833             int authenticated;
1834             int authorized;
1835             switch (sm_connection->sm_engine_state) {
1836                 case SM_RESPONDER_SEND_SECURITY_REQUEST:
1837                     // send packet if possible,
1838                     if (l2cap_can_send_fixed_channel_packet_now(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)){
1839                         const uint8_t buffer[2] = { SM_CODE_SECURITY_REQUEST, SM_AUTHREQ_BONDING};
1840                         sm_connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_REQUEST;
1841                         l2cap_send_connectionless(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
1842                     } else {
1843                         l2cap_request_can_send_fix_channel_now_event(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
1844                     }
1845                     // don't lock setup context yet
1846                     done = 0;
1847                     break;
1848                 case SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED:
1849                     sm_init_setup(sm_connection);
1850                     // recover pairing request
1851                     memcpy(&setup->sm_m_preq, &sm_connection->sm_m_preq, sizeof(sm_pairing_packet_t));
1852                     err = sm_stk_generation_init(sm_connection);
1853                     if (err){
1854                         setup->sm_pairing_failed_reason = err;
1855                         sm_connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1856                         break;
1857                     }
1858                     sm_timeout_start(sm_connection);
1859                     // generate random number first, if we need to show passkey
1860                     if (setup->sm_stk_generation_method == PK_INIT_INPUT){
1861                         sm_connection->sm_engine_state = SM_PH2_GET_RANDOM_TK;
1862                         break;
1863                     }
1864                     sm_connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
1865                     break;
1866                 case SM_INITIATOR_PH0_HAS_LTK:
1867                     // fetch data from device db - incl. authenticated/authorized/key size. Note all sm_connection_X require encryption enabled
1868                     le_device_db_encryption_get(sm_connection->sm_le_db_index, &setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1869                                                 &encryption_key_size, &authenticated, &authorized);
1870                     log_info("db index %u, key size %u, authenticated %u, authorized %u", sm_connection->sm_le_db_index, encryption_key_size, authenticated, authorized);
1871                     sm_connection->sm_actual_encryption_key_size = encryption_key_size;
1872                     sm_connection->sm_connection_authenticated = authenticated;
1873                     sm_connection->sm_connection_authorization_state = authorized ? AUTHORIZATION_GRANTED : AUTHORIZATION_UNKNOWN;
1874                     sm_connection->sm_engine_state = SM_INITIATOR_PH0_SEND_START_ENCRYPTION;
1875                     break;
1876                 case SM_RESPONDER_PH0_RECEIVED_LTK:
1877                     // re-establish previously used LTK using Rand and EDIV
1878                     memcpy(setup->sm_local_rand, sm_connection->sm_local_rand, 8);
1879                     setup->sm_local_ediv = sm_connection->sm_local_ediv;
1880                     // re-establish used key encryption size
1881                     // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
1882                     sm_connection->sm_actual_encryption_key_size = (setup->sm_local_rand[7] & 0x0f) + 1;
1883                     // no db for authenticated flag hack: flag is stored in bit 4 of LSB
1884                     sm_connection->sm_connection_authenticated = (setup->sm_local_rand[7] & 0x10) >> 4;
1885                     log_info("sm: received ltk request with key size %u, authenticated %u",
1886                             sm_connection->sm_actual_encryption_key_size, sm_connection->sm_connection_authenticated);
1887                     sm_connection->sm_engine_state = SM_RESPONDER_PH4_Y_GET_ENC;
1888                     break;
1889                 case SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST:
1890                     sm_init_setup(sm_connection);
1891                     sm_timeout_start(sm_connection);
1892                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_SEND_PAIRING_REQUEST;
1893                     break;
1894                 default:
1895                     done = 0;
1896                     break;
1897             }
1898             if (done){
1899                 sm_active_connection = sm_connection->sm_handle;
1900                 log_info("sm: connection 0x%04x locked setup context as %s", sm_active_connection, sm_connection->sm_role ? "responder" : "initiator");
1901             }
1902         }
1903 
1904         //
1905         // active connection handling
1906         //
1907 
1908         if (sm_active_connection == 0) return;
1909 
1910         // assert that we could send a SM PDU - not needed for all of the following
1911         if (!l2cap_can_send_fixed_channel_packet_now(sm_active_connection, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)) {
1912             l2cap_request_can_send_fix_channel_now_event(sm_active_connection, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
1913             return;
1914         }
1915 
1916         sm_connection_t * connection = sm_get_connection_for_handle(sm_active_connection);
1917         if (!connection) return;
1918 
1919         sm_key_t plaintext;
1920         int key_distribution_flags;
1921 
1922         log_info("sm_run: state %u", connection->sm_engine_state);
1923 
1924         // responding state
1925         switch (connection->sm_engine_state){
1926 
1927             // general
1928             case SM_GENERAL_SEND_PAIRING_FAILED: {
1929                 uint8_t buffer[2];
1930                 buffer[0] = SM_CODE_PAIRING_FAILED;
1931                 buffer[1] = setup->sm_pairing_failed_reason;
1932                 connection->sm_engine_state = connection->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
1933                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
1934                 sm_done_for_handle(connection->sm_handle);
1935                 break;
1936             }
1937 
1938 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1939             case SM_SC_W2_GET_RANDOM_A:
1940                 sm_random_start(connection);
1941                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_A;
1942                 break;
1943             case SM_SC_W2_GET_RANDOM_B:
1944                 sm_random_start(connection);
1945                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_B;
1946                 break;
1947             case SM_SC_W2_CMAC_FOR_CONFIRMATION:
1948                 if (!sm_cmac_ready()) break;
1949                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CONFIRMATION;
1950                 sm_sc_calculate_local_confirm(connection);
1951                 break;
1952             case SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION:
1953                 if (!sm_cmac_ready()) break;
1954                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION;
1955                 sm_sc_calculate_remote_confirm(connection);
1956                 break;
1957             case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
1958                 if (!sm_cmac_ready()) break;
1959                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK;
1960                 sm_sc_calculate_f6_for_dhkey_check(connection);
1961                 break;
1962             case SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
1963                 if (!sm_cmac_ready()) break;
1964                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
1965                 sm_sc_calculate_f6_to_verify_dhkey_check(connection);
1966                 break;
1967             case SM_SC_W2_CALCULATE_F5_SALT:
1968                 if (!sm_cmac_ready()) break;
1969                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_SALT;
1970                 f5_calculate_salt(connection);
1971                 break;
1972             case SM_SC_W2_CALCULATE_F5_MACKEY:
1973                 if (!sm_cmac_ready()) break;
1974                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_MACKEY;
1975                 f5_calculate_mackey(connection);
1976                 break;
1977             case SM_SC_W2_CALCULATE_F5_LTK:
1978                 if (!sm_cmac_ready()) break;
1979                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_LTK;
1980                 f5_calculate_ltk(connection);
1981                 break;
1982             case SM_SC_W2_CALCULATE_G2:
1983                 if (!sm_cmac_ready()) break;
1984                 connection->sm_engine_state = SM_SC_W4_CALCULATE_G2;
1985                 g2_calculate(connection);
1986                 break;
1987 
1988 #endif
1989             // initiator side
1990             case SM_INITIATOR_PH0_SEND_START_ENCRYPTION: {
1991                 sm_key_t peer_ltk_flipped;
1992                 reverse_128(setup->sm_peer_ltk, peer_ltk_flipped);
1993                 connection->sm_engine_state = SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED;
1994                 log_info("sm: hci_le_start_encryption ediv 0x%04x", setup->sm_peer_ediv);
1995                 uint32_t rand_high = big_endian_read_32(setup->sm_peer_rand, 0);
1996                 uint32_t rand_low  = big_endian_read_32(setup->sm_peer_rand, 4);
1997                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle,rand_low, rand_high, setup->sm_peer_ediv, peer_ltk_flipped);
1998                 return;
1999             }
2000 
2001             case SM_INITIATOR_PH1_SEND_PAIRING_REQUEST:
2002                 sm_pairing_packet_set_code(setup->sm_m_preq, SM_CODE_PAIRING_REQUEST);
2003                 connection->sm_engine_state = SM_INITIATOR_PH1_W4_PAIRING_RESPONSE;
2004                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_m_preq, sizeof(sm_pairing_packet_t));
2005                 sm_timeout_reset(connection);
2006                 break;
2007 
2008             // responder side
2009             case SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY:
2010                 connection->sm_engine_state = SM_RESPONDER_IDLE;
2011                 hci_send_cmd(&hci_le_long_term_key_negative_reply, connection->sm_handle);
2012                 return;
2013 
2014 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2015             case SM_SC_SEND_PUBLIC_KEY_COMMAND: {
2016                 uint8_t buffer[65];
2017                 buffer[0] = SM_CODE_PAIRING_PUBLIC_KEY;
2018                 //
2019 #ifdef USE_MBEDTLS_FOR_ECDH
2020                 uint8_t value[32];
2021                 mbedtls_mpi_write_binary(&le_keypair.Q.X, value, sizeof(value));
2022                 reverse_256(value, &buffer[1]);
2023                 mbedtls_mpi_write_binary(&le_keypair.Q.Y, value, sizeof(value));
2024                 reverse_256(value, &buffer[33]);
2025 #endif
2026 
2027                 // stk generation method
2028                 // passkey entry: notify app to show passkey or to request passkey
2029                 switch (setup->sm_stk_generation_method){
2030                     case JUST_WORKS:
2031                     case NK_BOTH_INPUT:
2032                         if (connection->sm_role){
2033                             // responder
2034                             sm_sc_start_calculating_local_confirm(connection);
2035                         } else {
2036                             // initiator
2037                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2038                         }
2039                         break;
2040                     case PK_INIT_INPUT:
2041                     case PK_RESP_INPUT:
2042                     case OK_BOTH_INPUT:
2043                         // use random TK for display
2044                         memcpy(setup->sm_ra, setup->sm_tk, 16);
2045                         memcpy(setup->sm_rb, setup->sm_tk, 16);
2046                         setup->sm_passkey_bit = 0;
2047 
2048                         if (connection->sm_role){
2049                             // responder
2050                             connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2051                         } else {
2052                             // initiator
2053                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2054                         }
2055                         sm_trigger_user_response(connection);
2056                         break;
2057                     case OOB:
2058                         // TODO: implement SC OOB
2059                         break;
2060                 }
2061 
2062                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2063                 sm_timeout_reset(connection);
2064                 break;
2065             }
2066             case SM_SC_SEND_CONFIRMATION: {
2067                 uint8_t buffer[17];
2068                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2069                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2070                 if (connection->sm_role){
2071                     connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2072                 } else {
2073                     connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2074                 }
2075                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2076                 sm_timeout_reset(connection);
2077                 break;
2078             }
2079             case SM_SC_SEND_PAIRING_RANDOM: {
2080                 uint8_t buffer[17];
2081                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2082                 reverse_128(setup->sm_local_nonce, &buffer[1]);
2083                 if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT && setup->sm_passkey_bit < 20){
2084                     if (connection->sm_role){
2085                         // responder
2086                         connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2087                     } else {
2088                         // initiator
2089                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2090                     }
2091                 } else {
2092                     if (connection->sm_role){
2093                         // responder
2094                         if (setup->sm_stk_generation_method == NK_BOTH_INPUT){
2095                             connection->sm_engine_state = SM_SC_W2_CALCULATE_G2;
2096                         } else {
2097                             sm_sc_prepare_dhkey_check(connection);
2098                         }
2099                     } else {
2100                         // initiator
2101                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2102                     }
2103                 }
2104                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2105                 sm_timeout_reset(connection);
2106                 break;
2107             }
2108             case SM_SC_SEND_DHKEY_CHECK_COMMAND: {
2109                 uint8_t buffer[17];
2110                 buffer[0] = SM_CODE_PAIRING_DHKEY_CHECK;
2111                 reverse_128(setup->sm_local_dhkey_check, &buffer[1]);
2112 
2113                 if (connection->sm_role){
2114                     connection->sm_engine_state = SM_SC_W4_LTK_REQUEST_SC;
2115                 } else {
2116                     connection->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
2117                 }
2118 
2119                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2120                 sm_timeout_reset(connection);
2121                 break;
2122             }
2123 
2124 #endif
2125             case SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE:
2126                 // echo initiator for now
2127                 sm_pairing_packet_set_code(setup->sm_s_pres,SM_CODE_PAIRING_RESPONSE);
2128                 key_distribution_flags = sm_key_distribution_flags_for_auth_req();
2129 
2130                 connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_CONFIRM;
2131 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2132                 if (setup->sm_use_secure_connections){
2133                     connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2134                     // skip LTK/EDIV for SC
2135                     key_distribution_flags &= ~SM_KEYDIST_ENC_KEY;
2136                 }
2137 #endif
2138                 sm_pairing_packet_set_initiator_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_initiator_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2139                 sm_pairing_packet_set_responder_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2140 
2141                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_s_pres, sizeof(sm_pairing_packet_t));
2142                 sm_timeout_reset(connection);
2143                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
2144                 if (setup->sm_stk_generation_method == JUST_WORKS){
2145                     sm_trigger_user_response(connection);
2146                 }
2147                 return;
2148 
2149             case SM_PH2_SEND_PAIRING_RANDOM: {
2150                 uint8_t buffer[17];
2151                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2152                 reverse_128(setup->sm_local_random, &buffer[1]);
2153                 if (connection->sm_role){
2154                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_LTK_REQUEST;
2155                 } else {
2156                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_RANDOM;
2157                 }
2158                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2159                 sm_timeout_reset(connection);
2160                 break;
2161             }
2162 
2163             case SM_PH2_GET_RANDOM_TK:
2164             case SM_PH2_C1_GET_RANDOM_A:
2165             case SM_PH2_C1_GET_RANDOM_B:
2166             case SM_PH3_GET_RANDOM:
2167             case SM_PH3_GET_DIV:
2168                 sm_next_responding_state(connection);
2169                 sm_random_start(connection);
2170                 return;
2171 
2172             case SM_PH2_C1_GET_ENC_B:
2173             case SM_PH2_C1_GET_ENC_D:
2174                 // already busy?
2175                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2176                 sm_next_responding_state(connection);
2177                 sm_aes128_start(setup->sm_tk, setup->sm_c1_t3_value, connection);
2178                 return;
2179 
2180             case SM_PH3_LTK_GET_ENC:
2181             case SM_RESPONDER_PH4_LTK_GET_ENC:
2182                 // already busy?
2183                 if (sm_aes128_state == SM_AES128_IDLE) {
2184                     sm_key_t d_prime;
2185                     sm_d1_d_prime(setup->sm_local_div, 0, d_prime);
2186                     sm_next_responding_state(connection);
2187                     sm_aes128_start(sm_persistent_er, d_prime, connection);
2188                     return;
2189                 }
2190                 break;
2191 
2192             case SM_PH3_CSRK_GET_ENC:
2193                 // already busy?
2194                 if (sm_aes128_state == SM_AES128_IDLE) {
2195                     sm_key_t d_prime;
2196                     sm_d1_d_prime(setup->sm_local_div, 1, d_prime);
2197                     sm_next_responding_state(connection);
2198                     sm_aes128_start(sm_persistent_er, d_prime, connection);
2199                     return;
2200                 }
2201                 break;
2202 
2203             case SM_PH2_C1_GET_ENC_C:
2204                 // already busy?
2205                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2206                 // calculate m_confirm using aes128 engine - step 1
2207                 sm_c1_t1(setup->sm_peer_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
2208                 sm_next_responding_state(connection);
2209                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2210                 break;
2211             case SM_PH2_C1_GET_ENC_A:
2212                 // already busy?
2213                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2214                 // calculate confirm using aes128 engine - step 1
2215                 sm_c1_t1(setup->sm_local_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
2216                 sm_next_responding_state(connection);
2217                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2218                 break;
2219             case SM_PH2_CALC_STK:
2220                 // already busy?
2221                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2222                 // calculate STK
2223                 if (connection->sm_role){
2224                     sm_s1_r_prime(setup->sm_local_random, setup->sm_peer_random, plaintext);
2225                 } else {
2226                     sm_s1_r_prime(setup->sm_peer_random, setup->sm_local_random, plaintext);
2227                 }
2228                 sm_next_responding_state(connection);
2229                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2230                 break;
2231             case SM_PH3_Y_GET_ENC:
2232                 // already busy?
2233                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2234                 // PH3B2 - calculate Y from      - enc
2235                 // Y = dm(DHK, Rand)
2236                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
2237                 sm_next_responding_state(connection);
2238                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
2239                 return;
2240             case SM_PH2_C1_SEND_PAIRING_CONFIRM: {
2241                 uint8_t buffer[17];
2242                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2243                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2244                 if (connection->sm_role){
2245                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_PAIRING_RANDOM;
2246                 } else {
2247                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_CONFIRM;
2248                 }
2249                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2250                 sm_timeout_reset(connection);
2251                 return;
2252             }
2253             case SM_RESPONDER_PH2_SEND_LTK_REPLY: {
2254                 sm_key_t stk_flipped;
2255                 reverse_128(setup->sm_ltk, stk_flipped);
2256                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2257                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, stk_flipped);
2258                 return;
2259             }
2260             case SM_INITIATOR_PH3_SEND_START_ENCRYPTION: {
2261                 sm_key_t stk_flipped;
2262                 reverse_128(setup->sm_ltk, stk_flipped);
2263                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2264                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle, 0, 0, 0, stk_flipped);
2265                 return;
2266             }
2267             case SM_RESPONDER_PH4_SEND_LTK: {
2268                 sm_key_t ltk_flipped;
2269                 reverse_128(setup->sm_ltk, ltk_flipped);
2270                 connection->sm_engine_state = SM_RESPONDER_IDLE;
2271                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, ltk_flipped);
2272                 return;
2273             }
2274             case SM_RESPONDER_PH4_Y_GET_ENC:
2275                 // already busy?
2276                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2277                 log_info("LTK Request: recalculating with ediv 0x%04x", setup->sm_local_ediv);
2278                 // Y = dm(DHK, Rand)
2279                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
2280                 sm_next_responding_state(connection);
2281                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
2282                 return;
2283 
2284             case SM_PH3_DISTRIBUTE_KEYS:
2285                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION){
2286                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
2287                     uint8_t buffer[17];
2288                     buffer[0] = SM_CODE_ENCRYPTION_INFORMATION;
2289                     reverse_128(setup->sm_ltk, &buffer[1]);
2290                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2291                     sm_timeout_reset(connection);
2292                     return;
2293                 }
2294                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_MASTER_IDENTIFICATION){
2295                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
2296                     uint8_t buffer[11];
2297                     buffer[0] = SM_CODE_MASTER_IDENTIFICATION;
2298                     little_endian_store_16(buffer, 1, setup->sm_local_ediv);
2299                     reverse_64(setup->sm_local_rand, &buffer[3]);
2300                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2301                     sm_timeout_reset(connection);
2302                     return;
2303                 }
2304                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
2305                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
2306                     uint8_t buffer[17];
2307                     buffer[0] = SM_CODE_IDENTITY_INFORMATION;
2308                     reverse_128(sm_persistent_irk, &buffer[1]);
2309                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2310                     sm_timeout_reset(connection);
2311                     return;
2312                 }
2313                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION){
2314                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
2315                     bd_addr_t local_address;
2316                     uint8_t buffer[8];
2317                     buffer[0] = SM_CODE_IDENTITY_ADDRESS_INFORMATION;
2318                     gap_advertisements_get_address(&buffer[1], local_address);
2319                     reverse_bd_addr(local_address, &buffer[2]);
2320                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2321                     sm_timeout_reset(connection);
2322                     return;
2323                 }
2324                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
2325                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
2326 
2327                     // hack to reproduce test runs
2328                     if (test_use_fixed_local_csrk){
2329                         memset(setup->sm_local_csrk, 0xcc, 16);
2330                     }
2331 
2332                     uint8_t buffer[17];
2333                     buffer[0] = SM_CODE_SIGNING_INFORMATION;
2334                     reverse_128(setup->sm_local_csrk, &buffer[1]);
2335                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2336                     sm_timeout_reset(connection);
2337                     return;
2338                 }
2339 
2340                 // keys are sent
2341                 if (connection->sm_role){
2342                     // slave -> receive master keys if any
2343                     if (sm_key_distribution_all_received(connection)){
2344                         sm_key_distribution_handle_all_received(connection);
2345                         connection->sm_engine_state = SM_RESPONDER_IDLE;
2346                         sm_done_for_handle(connection->sm_handle);
2347                     } else {
2348                         connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2349                     }
2350                 } else {
2351                     // master -> all done
2352                     connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2353                     sm_done_for_handle(connection->sm_handle);
2354                 }
2355                 break;
2356 
2357             default:
2358                 break;
2359         }
2360 
2361         // check again if active connection was released
2362         if (sm_active_connection) break;
2363     }
2364 }
2365 
2366 // note: aes engine is ready as we just got the aes result
2367 static void sm_handle_encryption_result(uint8_t * data){
2368 
2369     sm_aes128_state = SM_AES128_IDLE;
2370 
2371     if (sm_address_resolution_ah_calculation_active){
2372         sm_address_resolution_ah_calculation_active = 0;
2373         // compare calulated address against connecting device
2374         uint8_t hash[3];
2375         reverse_24(data, hash);
2376         if (memcmp(&sm_address_resolution_address[3], hash, 3) == 0){
2377             log_info("LE Device Lookup: matched resolvable private address");
2378             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
2379             return;
2380         }
2381         // no match, try next
2382         sm_address_resolution_test++;
2383         return;
2384     }
2385 
2386     switch (dkg_state){
2387         case DKG_W4_IRK:
2388             reverse_128(data, sm_persistent_irk);
2389             log_info_key("irk", sm_persistent_irk);
2390             dkg_next_state();
2391             return;
2392         case DKG_W4_DHK:
2393             reverse_128(data, sm_persistent_dhk);
2394             log_info_key("dhk", sm_persistent_dhk);
2395             dkg_next_state();
2396             // SM Init Finished
2397             return;
2398         default:
2399             break;
2400     }
2401 
2402     switch (rau_state){
2403         case RAU_W4_ENC:
2404             reverse_24(data, &sm_random_address[3]);
2405             rau_next_state();
2406             return;
2407         default:
2408             break;
2409     }
2410 
2411     switch (sm_cmac_state){
2412         case CMAC_W4_SUBKEYS:
2413         case CMAC_W4_MI:
2414         case CMAC_W4_MLAST:
2415             {
2416             sm_key_t t;
2417             reverse_128(data, t);
2418             sm_cmac_handle_encryption_result(t);
2419             }
2420             return;
2421         default:
2422             break;
2423     }
2424 
2425     // retrieve sm_connection provided to sm_aes128_start_encryption
2426     sm_connection_t * connection = (sm_connection_t*) sm_aes128_context;
2427     if (!connection) return;
2428     switch (connection->sm_engine_state){
2429         case SM_PH2_C1_W4_ENC_A:
2430         case SM_PH2_C1_W4_ENC_C:
2431             {
2432             sm_key_t t2;
2433             reverse_128(data, t2);
2434             sm_c1_t3(t2, setup->sm_m_address, setup->sm_s_address, setup->sm_c1_t3_value);
2435             }
2436             sm_next_responding_state(connection);
2437             return;
2438         case SM_PH2_C1_W4_ENC_B:
2439             reverse_128(data, setup->sm_local_confirm);
2440             log_info_key("c1!", setup->sm_local_confirm);
2441             connection->sm_engine_state = SM_PH2_C1_SEND_PAIRING_CONFIRM;
2442             return;
2443         case SM_PH2_C1_W4_ENC_D:
2444             {
2445             sm_key_t peer_confirm_test;
2446             reverse_128(data, peer_confirm_test);
2447             log_info_key("c1!", peer_confirm_test);
2448             if (memcmp(setup->sm_peer_confirm, peer_confirm_test, 16) != 0){
2449                 setup->sm_pairing_failed_reason = SM_REASON_CONFIRM_VALUE_FAILED;
2450                 connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
2451                 return;
2452             }
2453             if (connection->sm_role){
2454                 connection->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
2455             } else {
2456                 connection->sm_engine_state = SM_PH2_CALC_STK;
2457             }
2458             }
2459             return;
2460         case SM_PH2_W4_STK:
2461             reverse_128(data, setup->sm_ltk);
2462             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2463             log_info_key("stk", setup->sm_ltk);
2464             if (connection->sm_role){
2465                 connection->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2466             } else {
2467                 connection->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
2468             }
2469             return;
2470         case SM_PH3_Y_W4_ENC:{
2471             sm_key_t y128;
2472             reverse_128(data, y128);
2473             setup->sm_local_y = big_endian_read_16(y128, 14);
2474             log_info_hex16("y", setup->sm_local_y);
2475             // PH3B3 - calculate EDIV
2476             setup->sm_local_ediv = setup->sm_local_y ^ setup->sm_local_div;
2477             log_info_hex16("ediv", setup->sm_local_ediv);
2478             // PH3B4 - calculate LTK         - enc
2479             // LTK = d1(ER, DIV, 0))
2480             connection->sm_engine_state = SM_PH3_LTK_GET_ENC;
2481             return;
2482         }
2483         case SM_RESPONDER_PH4_Y_W4_ENC:{
2484             sm_key_t y128;
2485             reverse_128(data, y128);
2486             setup->sm_local_y = big_endian_read_16(y128, 14);
2487             log_info_hex16("y", setup->sm_local_y);
2488 
2489             // PH3B3 - calculate DIV
2490             setup->sm_local_div = setup->sm_local_y ^ setup->sm_local_ediv;
2491             log_info_hex16("ediv", setup->sm_local_ediv);
2492             // PH3B4 - calculate LTK         - enc
2493             // LTK = d1(ER, DIV, 0))
2494             connection->sm_engine_state = SM_RESPONDER_PH4_LTK_GET_ENC;
2495             return;
2496         }
2497         case SM_PH3_LTK_W4_ENC:
2498             reverse_128(data, setup->sm_ltk);
2499             log_info_key("ltk", setup->sm_ltk);
2500             // calc CSRK next
2501             connection->sm_engine_state = SM_PH3_CSRK_GET_ENC;
2502             return;
2503         case SM_PH3_CSRK_W4_ENC:
2504             reverse_128(data, setup->sm_local_csrk);
2505             log_info_key("csrk", setup->sm_local_csrk);
2506             if (setup->sm_key_distribution_send_set){
2507                 connection->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
2508             } else {
2509                 // no keys to send, just continue
2510                 if (connection->sm_role){
2511                     // slave -> receive master keys
2512                     connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2513                 } else {
2514                     // master -> all done
2515                     connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2516                     sm_done_for_handle(connection->sm_handle);
2517                 }
2518             }
2519             return;
2520         case SM_RESPONDER_PH4_LTK_W4_ENC:
2521             reverse_128(data, setup->sm_ltk);
2522             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2523             log_info_key("ltk", setup->sm_ltk);
2524             connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK;
2525             return;
2526         default:
2527             break;
2528     }
2529 }
2530 
2531 #ifdef USE_MBEDTLS_FOR_ECDH
2532 
2533 static void sm_log_ec_keypair(void){
2534     // print keypair
2535     char buffer[100];
2536     size_t len;
2537     mbedtls_mpi_write_string( &le_keypair.d, 16, buffer, sizeof(buffer), &len);
2538     log_info("d: %s", buffer);
2539     mbedtls_mpi_write_string( &le_keypair.Q.X, 16, buffer, sizeof(buffer), &len);
2540     log_info("X: %s", buffer);
2541     mbedtls_mpi_write_string( &le_keypair.Q.Y, 16, buffer, sizeof(buffer), &len);
2542     log_info("Y: %s", buffer);
2543 }
2544 
2545 static int sm_generate_f_rng(void * context, unsigned char * buffer, size_t size){
2546     int offset = setup->sm_passkey_bit;
2547     log_info("sm_generate_f_rng: size %u - offset %u", (int) size, offset);
2548     while (size) {
2549         if (offset < 32){
2550             *buffer++ = setup->sm_peer_qx[offset++];
2551         } else {
2552             *buffer++ = setup->sm_peer_qx[offset++ - 32];
2553         }
2554         size--;
2555     }
2556     setup->sm_passkey_bit = offset;
2557     return 0;
2558 }
2559 #endif
2560 
2561 // note: random generator is ready. this doesn NOT imply that aes engine is unused!
2562 static void sm_handle_random_result(uint8_t * data){
2563 
2564 #ifdef USE_MBEDTLS_FOR_ECDH
2565     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
2566         int num_bytes = setup->sm_passkey_bit;
2567         if (num_bytes < 32){
2568             memcpy(&setup->sm_peer_qx[num_bytes], data, 8);
2569         } else {
2570             memcpy(&setup->sm_peer_qx[num_bytes-32], data, 8);
2571         }
2572         num_bytes += 8;
2573         setup->sm_passkey_bit = num_bytes;
2574 
2575         if (num_bytes >= 64){
2576             // generate EC key
2577             setup->sm_passkey_bit = 0;
2578             mbedtls_ecp_gen_key(MBEDTLS_ECP_DP_SECP256R1, &le_keypair, &sm_generate_f_rng, NULL);
2579             sm_log_ec_keypair();
2580             ec_key_generation_state = EC_KEY_GENERATION_DONE;
2581         }
2582     }
2583 #endif
2584 
2585     switch (rau_state){
2586         case RAU_W4_RANDOM:
2587             // non-resolvable vs. resolvable
2588             switch (gap_random_adress_type){
2589                 case GAP_RANDOM_ADDRESS_RESOLVABLE:
2590                     // resolvable: use random as prand and calc address hash
2591                     // "The two most significant bits of prand shall be equal to ‘0’ and ‘1"
2592                     memcpy(sm_random_address, data, 3);
2593                     sm_random_address[0] &= 0x3f;
2594                     sm_random_address[0] |= 0x40;
2595                     rau_state = RAU_GET_ENC;
2596                     break;
2597                 case GAP_RANDOM_ADDRESS_NON_RESOLVABLE:
2598                 default:
2599                     // "The two most significant bits of the address shall be equal to ‘0’""
2600                     memcpy(sm_random_address, data, 6);
2601                     sm_random_address[0] &= 0x3f;
2602                     rau_state = RAU_SET_ADDRESS;
2603                     break;
2604             }
2605             return;
2606         default:
2607             break;
2608     }
2609 
2610     // retrieve sm_connection provided to sm_random_start
2611     sm_connection_t * connection = (sm_connection_t *) sm_random_context;
2612     if (!connection) return;
2613     switch (connection->sm_engine_state){
2614 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2615         case SM_SC_W4_GET_RANDOM_A:
2616             memcpy(&setup->sm_local_nonce[0], data, 8);
2617             connection->sm_engine_state = SM_SC_W2_GET_RANDOM_B;
2618             break;
2619         case SM_SC_W4_GET_RANDOM_B:
2620             memcpy(&setup->sm_local_nonce[8], data, 8);
2621             // initiator & jw/nc -> send pairing random
2622             if (connection->sm_role == 0 && sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
2623                 connection->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
2624                 break;
2625             } else {
2626                 connection->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
2627             }
2628             break;
2629 #endif
2630 
2631         case SM_PH2_W4_RANDOM_TK:
2632         {
2633             // map random to 0-999999 without speding much cycles on a modulus operation
2634             uint32_t tk = little_endian_read_32(data,0);
2635             tk = tk & 0xfffff;  // 1048575
2636             if (tk >= 999999){
2637                 tk = tk - 999999;
2638             }
2639             sm_reset_tk();
2640             big_endian_store_32(setup->sm_tk, 12, tk);
2641             if (connection->sm_role){
2642                 connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
2643             } else {
2644                 connection->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
2645                 sm_trigger_user_response(connection);
2646                 // response_idle == nothing <--> sm_trigger_user_response() did not require response
2647                 if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
2648                     connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
2649                 }
2650             }
2651             return;
2652         }
2653         case SM_PH2_C1_W4_RANDOM_A:
2654             memcpy(&setup->sm_local_random[0], data, 8); // random endinaness
2655             connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_B;
2656             return;
2657         case SM_PH2_C1_W4_RANDOM_B:
2658             memcpy(&setup->sm_local_random[8], data, 8); // random endinaness
2659             connection->sm_engine_state = SM_PH2_C1_GET_ENC_A;
2660             return;
2661         case SM_PH3_W4_RANDOM:
2662             reverse_64(data, setup->sm_local_rand);
2663             // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
2664             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xf0) + (connection->sm_actual_encryption_key_size - 1);
2665             // no db for authenticated flag hack: store flag in bit 4 of LSB
2666             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xef) + (connection->sm_connection_authenticated << 4);
2667             connection->sm_engine_state = SM_PH3_GET_DIV;
2668             return;
2669         case SM_PH3_W4_DIV:
2670             // use 16 bit from random value as div
2671             setup->sm_local_div = big_endian_read_16(data, 0);
2672             log_info_hex16("div", setup->sm_local_div);
2673             connection->sm_engine_state = SM_PH3_Y_GET_ENC;
2674             return;
2675         default:
2676             break;
2677     }
2678 }
2679 
2680 static void sm_event_packet_handler (uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
2681 
2682     sm_connection_t  * sm_conn;
2683     hci_con_handle_t con_handle;
2684 
2685     switch (packet_type) {
2686 
2687 		case HCI_EVENT_PACKET:
2688 			switch (hci_event_packet_get_type(packet)) {
2689 
2690                 case BTSTACK_EVENT_STATE:
2691 					// bt stack activated, get started
2692 					if (btstack_event_state_get_state(packet) == HCI_STATE_WORKING){
2693                         log_info("HCI Working!");
2694                         dkg_state = sm_persistent_irk_ready ? DKG_CALC_DHK : DKG_CALC_IRK;
2695                         rau_state = RAU_IDLE;
2696 #ifdef USE_MBEDTLS_FOR_ECDH
2697                         if (!test_use_fixed_ec_keypair){
2698                             setup->sm_passkey_bit = 0;
2699                             ec_key_generation_state = EC_KEY_GENERATION_ACTIVE;
2700                         }
2701 #endif
2702                         sm_run();
2703 					}
2704 					break;
2705 
2706                 case HCI_EVENT_LE_META:
2707                     switch (packet[2]) {
2708                         case HCI_SUBEVENT_LE_CONNECTION_COMPLETE:
2709 
2710                             log_info("sm: connected");
2711 
2712                             if (packet[3]) return; // connection failed
2713 
2714                             con_handle = little_endian_read_16(packet, 4);
2715                             sm_conn = sm_get_connection_for_handle(con_handle);
2716                             if (!sm_conn) break;
2717 
2718                             sm_conn->sm_handle = con_handle;
2719                             sm_conn->sm_role = packet[6];
2720                             sm_conn->sm_peer_addr_type = packet[7];
2721                             reverse_bd_addr(&packet[8],
2722                                             sm_conn->sm_peer_address);
2723 
2724                             log_info("New sm_conn, role %s", sm_conn->sm_role ? "slave" : "master");
2725 
2726                             // reset security properties
2727                             sm_conn->sm_connection_encrypted = 0;
2728                             sm_conn->sm_connection_authenticated = 0;
2729                             sm_conn->sm_connection_authorization_state = AUTHORIZATION_UNKNOWN;
2730                             sm_conn->sm_le_db_index = -1;
2731 
2732                             // prepare CSRK lookup (does not involve setup)
2733                             sm_conn->sm_irk_lookup_state = IRK_LOOKUP_W4_READY;
2734 
2735                             // just connected -> everything else happens in sm_run()
2736                             if (sm_conn->sm_role){
2737                                 // slave - state already could be SM_RESPONDER_SEND_SECURITY_REQUEST instead
2738                                 if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
2739                                     if (sm_slave_request_security) {
2740                                         // request security if requested by app
2741                                         sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
2742                                     } else {
2743                                         // otherwise, wait for pairing request
2744                                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
2745                                     }
2746                                 }
2747                                 break;
2748                             } else {
2749                                 // master
2750                                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2751                             }
2752                             break;
2753 
2754                         case HCI_SUBEVENT_LE_LONG_TERM_KEY_REQUEST:
2755                             con_handle = little_endian_read_16(packet, 3);
2756                             sm_conn = sm_get_connection_for_handle(con_handle);
2757                             if (!sm_conn) break;
2758 
2759                             log_info("LTK Request: state %u", sm_conn->sm_engine_state);
2760                             if (sm_conn->sm_engine_state == SM_RESPONDER_PH2_W4_LTK_REQUEST){
2761                                 sm_conn->sm_engine_state = SM_PH2_CALC_STK;
2762                                 break;
2763                             }
2764                             if (sm_conn->sm_engine_state == SM_SC_W4_LTK_REQUEST_SC){
2765                                 sm_conn->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2766                                 break;
2767                             }
2768 
2769                             // assume that we don't have a LTK for ediv == 0 and random == null
2770                             if (little_endian_read_16(packet, 13) == 0 && sm_is_null_random(&packet[5])){
2771                                 log_info("LTK Request: ediv & random are empty");
2772                                 sm_conn->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
2773                                 break;
2774                             }
2775 
2776                             // store rand and ediv
2777                             reverse_64(&packet[5], sm_conn->sm_local_rand);
2778                             sm_conn->sm_local_ediv   = little_endian_read_16(packet, 13);
2779                             sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK;
2780                             break;
2781 
2782                         default:
2783                             break;
2784                     }
2785                     break;
2786 
2787                 case HCI_EVENT_ENCRYPTION_CHANGE:
2788                     con_handle = little_endian_read_16(packet, 3);
2789                     sm_conn = sm_get_connection_for_handle(con_handle);
2790                     if (!sm_conn) break;
2791 
2792                     sm_conn->sm_connection_encrypted = packet[5];
2793                     log_info("Encryption state change: %u, key size %u", sm_conn->sm_connection_encrypted,
2794                         sm_conn->sm_actual_encryption_key_size);
2795                     log_info("event handler, state %u", sm_conn->sm_engine_state);
2796                     if (!sm_conn->sm_connection_encrypted) break;
2797                     // continue if part of initial pairing
2798                     switch (sm_conn->sm_engine_state){
2799                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
2800                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2801                             sm_done_for_handle(sm_conn->sm_handle);
2802                             break;
2803                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
2804                             if (sm_conn->sm_role){
2805                                 // slave
2806                                 sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
2807                             } else {
2808                                 // master
2809                                 if (sm_key_distribution_all_received(sm_conn)){
2810                                     // skip receiving keys as there are none
2811                                     sm_key_distribution_handle_all_received(sm_conn);
2812                                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
2813                                 } else {
2814                                     sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2815                                 }
2816                             }
2817                             break;
2818                         default:
2819                             break;
2820                     }
2821                     break;
2822 
2823                 case HCI_EVENT_ENCRYPTION_KEY_REFRESH_COMPLETE:
2824                     con_handle = little_endian_read_16(packet, 3);
2825                     sm_conn = sm_get_connection_for_handle(con_handle);
2826                     if (!sm_conn) break;
2827 
2828                     log_info("Encryption key refresh complete, key size %u", sm_conn->sm_actual_encryption_key_size);
2829                     log_info("event handler, state %u", sm_conn->sm_engine_state);
2830                     // continue if part of initial pairing
2831                     switch (sm_conn->sm_engine_state){
2832                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
2833                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2834                             sm_done_for_handle(sm_conn->sm_handle);
2835                             break;
2836                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
2837                             if (sm_conn->sm_role){
2838                                 // slave
2839                                 sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
2840                             } else {
2841                                 // master
2842                                 sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2843                             }
2844                             break;
2845                         default:
2846                             break;
2847                     }
2848                     break;
2849 
2850 
2851                 case HCI_EVENT_DISCONNECTION_COMPLETE:
2852                     con_handle = little_endian_read_16(packet, 3);
2853                     sm_done_for_handle(con_handle);
2854                     sm_conn = sm_get_connection_for_handle(con_handle);
2855                     if (!sm_conn) break;
2856 
2857                     // delete stored bonding on disconnect with authentication failure in ph0
2858                     if (sm_conn->sm_role == 0
2859                         && sm_conn->sm_engine_state == SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED
2860                         && packet[2] == ERROR_CODE_AUTHENTICATION_FAILURE){
2861                         le_device_db_remove(sm_conn->sm_le_db_index);
2862                     }
2863 
2864                     sm_conn->sm_engine_state = SM_GENERAL_IDLE;
2865                     sm_conn->sm_handle = 0;
2866                     break;
2867 
2868 				case HCI_EVENT_COMMAND_COMPLETE:
2869                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_encrypt)){
2870                         sm_handle_encryption_result(&packet[6]);
2871                         break;
2872                     }
2873                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_rand)){
2874                         sm_handle_random_result(&packet[6]);
2875                         break;
2876                     }
2877                     break;
2878                 default:
2879                     break;
2880 			}
2881             break;
2882         default:
2883             break;
2884 	}
2885 
2886     sm_run();
2887 }
2888 
2889 static inline int sm_calc_actual_encryption_key_size(int other){
2890     if (other < sm_min_encryption_key_size) return 0;
2891     if (other < sm_max_encryption_key_size) return other;
2892     return sm_max_encryption_key_size;
2893 }
2894 
2895 
2896 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method){
2897     switch (method){
2898         case JUST_WORKS:
2899         case NK_BOTH_INPUT:
2900             return 1;
2901         default:
2902             return 0;
2903     }
2904 }
2905 // responder
2906 
2907 static int sm_passkey_used(stk_generation_method_t method){
2908     switch (method){
2909         case PK_RESP_INPUT:
2910             return 1;
2911         default:
2912             return 0;
2913     }
2914 }
2915 
2916 /**
2917  * @return ok
2918  */
2919 static int sm_validate_stk_generation_method(void){
2920     // check if STK generation method is acceptable by client
2921     switch (setup->sm_stk_generation_method){
2922         case JUST_WORKS:
2923             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_JUST_WORKS) != 0;
2924         case PK_RESP_INPUT:
2925         case PK_INIT_INPUT:
2926         case OK_BOTH_INPUT:
2927             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_PASSKEY) != 0;
2928         case OOB:
2929             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_OOB) != 0;
2930         case NK_BOTH_INPUT:
2931             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON) != 0;
2932             return 1;
2933         default:
2934             return 0;
2935     }
2936 }
2937 
2938 static void sm_pdu_handler(uint8_t packet_type, hci_con_handle_t con_handle, uint8_t *packet, uint16_t size){
2939 
2940     if (packet_type == HCI_EVENT_PACKET && packet[0] == L2CAP_EVENT_CAN_SEND_NOW){
2941         sm_run();
2942     }
2943 
2944     if (packet_type != SM_DATA_PACKET) return;
2945 
2946     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
2947     if (!sm_conn) return;
2948 
2949     if (packet[0] == SM_CODE_PAIRING_FAILED){
2950         sm_conn->sm_engine_state = sm_conn->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
2951         return;
2952     }
2953 
2954     log_debug("sm_pdu_handler: state %u, pdu 0x%02x", sm_conn->sm_engine_state, packet[0]);
2955 
2956     int err;
2957 
2958     switch (sm_conn->sm_engine_state){
2959 
2960         // a sm timeout requries a new physical connection
2961         case SM_GENERAL_TIMEOUT:
2962             return;
2963 
2964         // Initiator
2965         case SM_INITIATOR_CONNECTED:
2966             if ((packet[0] != SM_CODE_SECURITY_REQUEST) || (sm_conn->sm_role)){
2967                 sm_pdu_received_in_wrong_state(sm_conn);
2968                 break;
2969             }
2970             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_FAILED){
2971                 sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
2972                 break;
2973             }
2974             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_SUCCEEDED){
2975                 uint16_t ediv;
2976                 le_device_db_encryption_get(sm_conn->sm_le_db_index, &ediv, NULL, NULL, NULL, NULL, NULL);
2977                 if (ediv){
2978                     log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
2979                     sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
2980                 } else {
2981                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
2982                 }
2983                 break;
2984             }
2985             // otherwise, store security request
2986             sm_conn->sm_security_request_received = 1;
2987             break;
2988 
2989         case SM_INITIATOR_PH1_W4_PAIRING_RESPONSE:
2990             if (packet[0] != SM_CODE_PAIRING_RESPONSE){
2991                 sm_pdu_received_in_wrong_state(sm_conn);
2992                 break;
2993             }
2994             // store pairing request
2995             memcpy(&setup->sm_s_pres, packet, sizeof(sm_pairing_packet_t));
2996             err = sm_stk_generation_init(sm_conn);
2997             if (err){
2998                 setup->sm_pairing_failed_reason = err;
2999                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3000                 break;
3001             }
3002 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3003             if (setup->sm_use_secure_connections){
3004                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
3005                 if (setup->sm_stk_generation_method == JUST_WORKS){
3006                     sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3007                     sm_trigger_user_response(sm_conn);
3008                     if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3009                         sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3010                     }
3011                 } else {
3012                     sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3013                 }
3014                 break;
3015             }
3016 #endif
3017             // generate random number first, if we need to show passkey
3018             if (setup->sm_stk_generation_method == PK_RESP_INPUT){
3019                 sm_conn->sm_engine_state = SM_PH2_GET_RANDOM_TK;
3020                 break;
3021             }
3022             sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3023             sm_trigger_user_response(sm_conn);
3024             // response_idle == nothing <--> sm_trigger_user_response() did not require response
3025             if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3026                 sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3027             }
3028             break;
3029 
3030         case SM_INITIATOR_PH2_W4_PAIRING_CONFIRM:
3031             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3032                 sm_pdu_received_in_wrong_state(sm_conn);
3033                 break;
3034             }
3035 
3036             // store s_confirm
3037             reverse_128(&packet[1], setup->sm_peer_confirm);
3038             sm_conn->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
3039             break;
3040 
3041         case SM_INITIATOR_PH2_W4_PAIRING_RANDOM:
3042             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3043                 sm_pdu_received_in_wrong_state(sm_conn);
3044                 break;;
3045             }
3046 
3047             // received random value
3048             reverse_128(&packet[1], setup->sm_peer_random);
3049             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3050             break;
3051 
3052         // Responder
3053         case SM_RESPONDER_IDLE:
3054         case SM_RESPONDER_SEND_SECURITY_REQUEST:
3055         case SM_RESPONDER_PH1_W4_PAIRING_REQUEST:
3056             if (packet[0] != SM_CODE_PAIRING_REQUEST){
3057                 sm_pdu_received_in_wrong_state(sm_conn);
3058                 break;;
3059             }
3060 
3061             // store pairing request
3062             memcpy(&sm_conn->sm_m_preq, packet, sizeof(sm_pairing_packet_t));
3063             sm_conn->sm_engine_state = SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED;
3064             break;
3065 
3066 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3067         case SM_SC_W4_PUBLIC_KEY_COMMAND:
3068             if (packet[0] != SM_CODE_PAIRING_PUBLIC_KEY){
3069                 sm_pdu_received_in_wrong_state(sm_conn);
3070                 break;
3071             }
3072 
3073             // store public key for DH Key calculation
3074             reverse_256(&packet[01], setup->sm_peer_qx);
3075             reverse_256(&packet[33], setup->sm_peer_qy);
3076 
3077 #ifdef USE_MBEDTLS_FOR_ECDH
3078             // validate public key
3079             mbedtls_ecp_group grp;
3080             mbedtls_ecp_group_init( &grp );
3081             mbedtls_ecp_group_load(&grp, MBEDTLS_ECP_DP_SECP256R1);
3082 
3083             mbedtls_ecp_point Q;
3084             mbedtls_ecp_point_init( &Q );
3085             mbedtls_mpi_read_binary(&Q.X, setup->sm_peer_qx, 32);
3086             mbedtls_mpi_read_binary(&Q.Y, setup->sm_peer_qy, 32);
3087             mbedtls_mpi_read_string(&Q.Z, 16, "1" );
3088             err = mbedtls_ecp_check_pubkey(&grp, &Q);
3089             if (err){
3090                 log_error("sm: peer public key invalid %x", err);
3091                 // uses "unspecified reason", there is no "public key invalid" error code
3092                 sm_pdu_received_in_wrong_state(sm_conn);
3093                 break;
3094             }
3095 #endif
3096             if (sm_conn->sm_role){
3097                 // responder
3098                 sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3099             } else {
3100                 // initiator
3101                 // stk generation method
3102                 // passkey entry: notify app to show passkey or to request passkey
3103                 switch (setup->sm_stk_generation_method){
3104                     case JUST_WORKS:
3105                     case NK_BOTH_INPUT:
3106                         sm_conn->sm_engine_state = SM_SC_W4_CONFIRMATION;
3107                         break;
3108                     case PK_RESP_INPUT:
3109                         sm_sc_start_calculating_local_confirm(sm_conn);
3110                         break;
3111                     case PK_INIT_INPUT:
3112                     case OK_BOTH_INPUT:
3113                         if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3114                             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3115                             break;
3116                         }
3117                         sm_sc_start_calculating_local_confirm(sm_conn);
3118                         break;
3119                     case OOB:
3120                         // TODO: implement SC OOB
3121                         break;
3122                 }
3123             }
3124             break;
3125 
3126         case SM_SC_W4_CONFIRMATION:
3127             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3128                 sm_pdu_received_in_wrong_state(sm_conn);
3129                 break;
3130             }
3131             // received confirm value
3132             reverse_128(&packet[1], setup->sm_peer_confirm);
3133 
3134             if (sm_conn->sm_role){
3135                 // responder
3136                 if (sm_passkey_used(setup->sm_stk_generation_method)){
3137                     if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3138                         // still waiting for passkey
3139                         sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3140                         break;
3141                     }
3142                 }
3143                 sm_sc_start_calculating_local_confirm(sm_conn);
3144             } else {
3145                 // initiator
3146                 if (sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
3147                     sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
3148                 } else {
3149                     sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
3150                 }
3151             }
3152             break;
3153 
3154         case SM_SC_W4_PAIRING_RANDOM:
3155             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3156                 sm_pdu_received_in_wrong_state(sm_conn);
3157                 break;
3158             }
3159 
3160             // received random value
3161             reverse_128(&packet[1], setup->sm_peer_nonce);
3162 
3163             // validate confirm value if Cb = f4(Pkb, Pka, Nb, z)
3164             // only check for JUST WORK/NC in initiator role AND passkey entry
3165             int passkey_entry = sm_passkey_used(setup->sm_stk_generation_method);
3166             if (sm_conn->sm_role || passkey_entry) {
3167                  sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION;
3168             }
3169 
3170             sm_sc_state_after_receiving_random(sm_conn);
3171             break;
3172 
3173         case SM_SC_W2_CALCULATE_G2:
3174         case SM_SC_W4_CALCULATE_G2:
3175         case SM_SC_W2_CALCULATE_F5_SALT:
3176         case SM_SC_W4_CALCULATE_F5_SALT:
3177         case SM_SC_W2_CALCULATE_F5_MACKEY:
3178         case SM_SC_W4_CALCULATE_F5_MACKEY:
3179         case SM_SC_W2_CALCULATE_F5_LTK:
3180         case SM_SC_W4_CALCULATE_F5_LTK:
3181         case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
3182         case SM_SC_W4_DHKEY_CHECK_COMMAND:
3183         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
3184             if (packet[0] != SM_CODE_PAIRING_DHKEY_CHECK){
3185                 sm_pdu_received_in_wrong_state(sm_conn);
3186                 break;
3187             }
3188             // store DHKey Check
3189             setup->sm_state_vars |= SM_STATE_VAR_DHKEY_COMMAND_RECEIVED;
3190             reverse_128(&packet[01], setup->sm_peer_dhkey_check);
3191 
3192             // have we been only waiting for dhkey check command?
3193             if (sm_conn->sm_engine_state == SM_SC_W4_DHKEY_CHECK_COMMAND){
3194                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
3195             }
3196             break;
3197 #endif
3198 
3199         case SM_RESPONDER_PH1_W4_PAIRING_CONFIRM:
3200             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3201                 sm_pdu_received_in_wrong_state(sm_conn);
3202                 break;
3203             }
3204 
3205             // received confirm value
3206             reverse_128(&packet[1], setup->sm_peer_confirm);
3207 
3208             // notify client to hide shown passkey
3209             if (setup->sm_stk_generation_method == PK_INIT_INPUT){
3210                 sm_notify_client_base(SM_EVENT_PASSKEY_DISPLAY_CANCEL, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
3211             }
3212 
3213             // handle user cancel pairing?
3214             if (setup->sm_user_response == SM_USER_RESPONSE_DECLINE){
3215                 setup->sm_pairing_failed_reason = SM_REASON_PASSKEYT_ENTRY_FAILED;
3216                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3217                 break;
3218             }
3219 
3220             // wait for user action?
3221             if (setup->sm_user_response == SM_USER_RESPONSE_PENDING){
3222                 sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3223                 break;
3224             }
3225 
3226             // calculate and send local_confirm
3227             sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3228             break;
3229 
3230         case SM_RESPONDER_PH2_W4_PAIRING_RANDOM:
3231             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3232                 sm_pdu_received_in_wrong_state(sm_conn);
3233                 break;;
3234             }
3235 
3236             // received random value
3237             reverse_128(&packet[1], setup->sm_peer_random);
3238             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3239             break;
3240 
3241         case SM_PH3_RECEIVE_KEYS:
3242             switch(packet[0]){
3243                 case SM_CODE_ENCRYPTION_INFORMATION:
3244                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
3245                     reverse_128(&packet[1], setup->sm_peer_ltk);
3246                     break;
3247 
3248                 case SM_CODE_MASTER_IDENTIFICATION:
3249                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
3250                     setup->sm_peer_ediv = little_endian_read_16(packet, 1);
3251                     reverse_64(&packet[3], setup->sm_peer_rand);
3252                     break;
3253 
3254                 case SM_CODE_IDENTITY_INFORMATION:
3255                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
3256                     reverse_128(&packet[1], setup->sm_peer_irk);
3257                     break;
3258 
3259                 case SM_CODE_IDENTITY_ADDRESS_INFORMATION:
3260                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
3261                     setup->sm_peer_addr_type = packet[1];
3262                     reverse_bd_addr(&packet[2], setup->sm_peer_address);
3263                     break;
3264 
3265                 case SM_CODE_SIGNING_INFORMATION:
3266                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
3267                     reverse_128(&packet[1], setup->sm_peer_csrk);
3268                     break;
3269                 default:
3270                     // Unexpected PDU
3271                     log_info("Unexpected PDU %u in SM_PH3_RECEIVE_KEYS", packet[0]);
3272                     break;
3273             }
3274             // done with key distribution?
3275             if (sm_key_distribution_all_received(sm_conn)){
3276 
3277                 sm_key_distribution_handle_all_received(sm_conn);
3278 
3279                 if (sm_conn->sm_role){
3280                     sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
3281                     sm_done_for_handle(sm_conn->sm_handle);
3282                 } else {
3283                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3284 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3285                     if (setup->sm_use_secure_connections){
3286                         sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
3287                     }
3288 #endif
3289                 }
3290             }
3291             break;
3292         default:
3293             // Unexpected PDU
3294             log_info("Unexpected PDU %u in state %u", packet[0], sm_conn->sm_engine_state);
3295             break;
3296     }
3297 
3298     // try to send preparared packet
3299     sm_run();
3300 }
3301 
3302 // Security Manager Client API
3303 void sm_register_oob_data_callback( int (*get_oob_data_callback)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data)){
3304     sm_get_oob_data = get_oob_data_callback;
3305 }
3306 
3307 void sm_add_event_handler(btstack_packet_callback_registration_t * callback_handler){
3308     btstack_linked_list_add_tail(&sm_event_handlers, (btstack_linked_item_t*) callback_handler);
3309 }
3310 
3311 void sm_set_accepted_stk_generation_methods(uint8_t accepted_stk_generation_methods){
3312     sm_accepted_stk_generation_methods = accepted_stk_generation_methods;
3313 }
3314 
3315 void sm_set_encryption_key_size_range(uint8_t min_size, uint8_t max_size){
3316 	sm_min_encryption_key_size = min_size;
3317 	sm_max_encryption_key_size = max_size;
3318 }
3319 
3320 void sm_set_authentication_requirements(uint8_t auth_req){
3321     sm_auth_req = auth_req;
3322 }
3323 
3324 void sm_set_io_capabilities(io_capability_t io_capability){
3325     sm_io_capabilities = io_capability;
3326 }
3327 
3328 void sm_set_request_security(int enable){
3329     sm_slave_request_security = enable;
3330 }
3331 
3332 void sm_set_er(sm_key_t er){
3333     memcpy(sm_persistent_er, er, 16);
3334 }
3335 
3336 void sm_set_ir(sm_key_t ir){
3337     memcpy(sm_persistent_ir, ir, 16);
3338 }
3339 
3340 // Testing support only
3341 void sm_test_set_irk(sm_key_t irk){
3342     memcpy(sm_persistent_irk, irk, 16);
3343     sm_persistent_irk_ready = 1;
3344 }
3345 
3346 void sm_test_use_fixed_local_csrk(void){
3347     test_use_fixed_local_csrk = 1;
3348 }
3349 
3350 void sm_init(void){
3351     // set some (BTstack default) ER and IR
3352     int i;
3353     sm_key_t er;
3354     sm_key_t ir;
3355     for (i=0;i<16;i++){
3356         er[i] = 0x30 + i;
3357         ir[i] = 0x90 + i;
3358     }
3359     sm_set_er(er);
3360     sm_set_ir(ir);
3361     // defaults
3362     sm_accepted_stk_generation_methods = SM_STK_GENERATION_METHOD_JUST_WORKS
3363                                        | SM_STK_GENERATION_METHOD_OOB
3364                                        | SM_STK_GENERATION_METHOD_PASSKEY
3365                                        | SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON;
3366 
3367     sm_max_encryption_key_size = 16;
3368     sm_min_encryption_key_size = 7;
3369 
3370     sm_cmac_state  = CMAC_IDLE;
3371     dkg_state = DKG_W4_WORKING;
3372     rau_state = RAU_W4_WORKING;
3373     sm_aes128_state = SM_AES128_IDLE;
3374     sm_address_resolution_test = -1;    // no private address to resolve yet
3375     sm_address_resolution_ah_calculation_active = 0;
3376     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
3377     sm_address_resolution_general_queue = NULL;
3378 
3379     gap_random_adress_update_period = 15 * 60 * 1000L;
3380 
3381     sm_active_connection = 0;
3382 
3383     test_use_fixed_local_csrk = 0;
3384 
3385     // register for HCI Events from HCI
3386     hci_event_callback_registration.callback = &sm_event_packet_handler;
3387     hci_add_event_handler(&hci_event_callback_registration);
3388 
3389     // and L2CAP PDUs + L2CAP_EVENT_CAN_SEND_NOW
3390     l2cap_register_fixed_channel(sm_pdu_handler, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
3391 
3392 #ifdef USE_MBEDTLS_FOR_ECDH
3393     ec_key_generation_state = EC_KEY_GENERATION_IDLE;
3394 #endif
3395 }
3396 
3397 void sm_test_use_fixed_ec_keypair(void){
3398     test_use_fixed_ec_keypair = 1;
3399 #ifdef USE_MBEDTLS_FOR_ECDH
3400     // use test keypair from spec
3401     mbedtls_ecp_keypair_init(&le_keypair);
3402     mbedtls_ecp_group_load(&le_keypair.grp, MBEDTLS_ECP_DP_SECP256R1);
3403     mbedtls_mpi_read_string( &le_keypair.d,   16, "3f49f6d4a3c55f3874c9b3e3d2103f504aff607beb40b7995899b8a6cd3c1abd");
3404     mbedtls_mpi_read_string( &le_keypair.Q.X, 16, "20b003d2f297be2c5e2c83a7e9f9a5b9eff49111acf4fddbcc0301480e359de6");
3405     mbedtls_mpi_read_string( &le_keypair.Q.Y, 16, "dc809c49652aeb6d63329abf5a52155c766345c28fed3024741c8ed01589d28b");
3406     mbedtls_mpi_read_string( &le_keypair.Q.Z, 16, "1");
3407 #endif
3408 }
3409 
3410 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle){
3411     hci_connection_t * hci_con = hci_connection_for_handle(con_handle);
3412     if (!hci_con) return NULL;
3413     return &hci_con->sm_connection;
3414 }
3415 
3416 // @returns 0 if not encrypted, 7-16 otherwise
3417 int sm_encryption_key_size(hci_con_handle_t con_handle){
3418     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3419     if (!sm_conn) return 0;     // wrong connection
3420     if (!sm_conn->sm_connection_encrypted) return 0;
3421     return sm_conn->sm_actual_encryption_key_size;
3422 }
3423 
3424 int sm_authenticated(hci_con_handle_t con_handle){
3425     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3426     if (!sm_conn) return 0;     // wrong connection
3427     if (!sm_conn->sm_connection_encrypted) return 0; // unencrypted connection cannot be authenticated
3428     return sm_conn->sm_connection_authenticated;
3429 }
3430 
3431 authorization_state_t sm_authorization_state(hci_con_handle_t con_handle){
3432     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3433     if (!sm_conn) return AUTHORIZATION_UNKNOWN;     // wrong connection
3434     if (!sm_conn->sm_connection_encrypted)               return AUTHORIZATION_UNKNOWN; // unencrypted connection cannot be authorized
3435     if (!sm_conn->sm_connection_authenticated)           return AUTHORIZATION_UNKNOWN; // unauthenticatd connection cannot be authorized
3436     return sm_conn->sm_connection_authorization_state;
3437 }
3438 
3439 static void sm_send_security_request_for_connection(sm_connection_t * sm_conn){
3440     switch (sm_conn->sm_engine_state){
3441         case SM_GENERAL_IDLE:
3442         case SM_RESPONDER_IDLE:
3443             sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
3444             sm_run();
3445             break;
3446         default:
3447             break;
3448     }
3449 }
3450 
3451 /**
3452  * @brief Trigger Security Request
3453  */
3454 void sm_send_security_request(hci_con_handle_t con_handle){
3455     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3456     if (!sm_conn) return;
3457     sm_send_security_request_for_connection(sm_conn);
3458 }
3459 
3460 // request pairing
3461 void sm_request_pairing(hci_con_handle_t con_handle){
3462     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3463     if (!sm_conn) return;     // wrong connection
3464 
3465     log_info("sm_request_pairing in role %u, state %u", sm_conn->sm_role, sm_conn->sm_engine_state);
3466     if (sm_conn->sm_role){
3467         sm_send_security_request_for_connection(sm_conn);
3468     } else {
3469         // used as a trigger to start central/master/initiator security procedures
3470         uint16_t ediv;
3471         if (sm_conn->sm_engine_state == SM_INITIATOR_CONNECTED){
3472             switch (sm_conn->sm_irk_lookup_state){
3473                 case IRK_LOOKUP_FAILED:
3474                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3475                     break;
3476                 case IRK_LOOKUP_SUCCEEDED:
3477                         le_device_db_encryption_get(sm_conn->sm_le_db_index, &ediv, NULL, NULL, NULL, NULL, NULL);
3478                         if (ediv){
3479                             log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3480                             sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3481                         } else {
3482                             sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3483                         }
3484                         break;
3485                 default:
3486                     sm_conn->sm_bonding_requested = 1;
3487                     break;
3488             }
3489         } else if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
3490             sm_conn->sm_bonding_requested = 1;
3491         }
3492     }
3493     sm_run();
3494 }
3495 
3496 // called by client app on authorization request
3497 void sm_authorization_decline(hci_con_handle_t con_handle){
3498     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3499     if (!sm_conn) return;     // wrong connection
3500     sm_conn->sm_connection_authorization_state = AUTHORIZATION_DECLINED;
3501     sm_notify_client_authorization(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 0);
3502 }
3503 
3504 void sm_authorization_grant(hci_con_handle_t con_handle){
3505     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3506     if (!sm_conn) return;     // wrong connection
3507     sm_conn->sm_connection_authorization_state = AUTHORIZATION_GRANTED;
3508     sm_notify_client_authorization(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 1);
3509 }
3510 
3511 // GAP Bonding API
3512 
3513 void sm_bonding_decline(hci_con_handle_t con_handle){
3514     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3515     if (!sm_conn) return;     // wrong connection
3516     setup->sm_user_response = SM_USER_RESPONSE_DECLINE;
3517 
3518     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3519         switch (setup->sm_stk_generation_method){
3520             case PK_RESP_INPUT:
3521             case PK_INIT_INPUT:
3522             case OK_BOTH_INPUT:
3523                 sm_pairing_error(sm_conn, SM_GENERAL_SEND_PAIRING_FAILED);
3524                 break;
3525             case NK_BOTH_INPUT:
3526                 sm_pairing_error(sm_conn, SM_REASON_NUMERIC_COMPARISON_FAILED);
3527                 break;
3528             case JUST_WORKS:
3529             case OOB:
3530                 sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
3531                 break;
3532         }
3533     }
3534     sm_run();
3535 }
3536 
3537 void sm_just_works_confirm(hci_con_handle_t con_handle){
3538     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3539     if (!sm_conn) return;     // wrong connection
3540     setup->sm_user_response = SM_USER_RESPONSE_CONFIRM;
3541     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3542         sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3543 
3544 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3545         if (setup->sm_use_secure_connections){
3546             sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3547         }
3548 #endif
3549     }
3550 
3551 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3552     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
3553         sm_sc_prepare_dhkey_check(sm_conn);
3554     }
3555 #endif
3556 
3557     sm_run();
3558 }
3559 
3560 void sm_numeric_comparison_confirm(hci_con_handle_t con_handle){
3561     // for now, it's the same
3562     sm_just_works_confirm(con_handle);
3563 }
3564 
3565 void sm_passkey_input(hci_con_handle_t con_handle, uint32_t passkey){
3566     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3567     if (!sm_conn) return;     // wrong connection
3568     sm_reset_tk();
3569     big_endian_store_32(setup->sm_tk, 12, passkey);
3570     setup->sm_user_response = SM_USER_RESPONSE_PASSKEY;
3571     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3572         sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3573     }
3574 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3575     memcpy(setup->sm_ra, setup->sm_tk, 16);
3576     memcpy(setup->sm_rb, setup->sm_tk, 16);
3577     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
3578         sm_sc_start_calculating_local_confirm(sm_conn);
3579     }
3580 #endif
3581     sm_run();
3582 }
3583 
3584 /**
3585  * @brief Identify device in LE Device DB
3586  * @param handle
3587  * @returns index from le_device_db or -1 if not found/identified
3588  */
3589 int sm_le_device_index(hci_con_handle_t con_handle ){
3590     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3591     if (!sm_conn) return -1;
3592     return sm_conn->sm_le_db_index;
3593 }
3594 
3595 // GAP LE API
3596 void gap_random_address_set_mode(gap_random_address_type_t random_address_type){
3597     gap_random_address_update_stop();
3598     gap_random_adress_type = random_address_type;
3599     if (random_address_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return;
3600     gap_random_address_update_start();
3601     gap_random_address_trigger();
3602 }
3603 
3604 gap_random_address_type_t gap_random_address_get_mode(void){
3605     return gap_random_adress_type;
3606 }
3607 
3608 void gap_random_address_set_update_period(int period_ms){
3609     gap_random_adress_update_period = period_ms;
3610     if (gap_random_adress_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return;
3611     gap_random_address_update_stop();
3612     gap_random_address_update_start();
3613 }
3614 
3615 void gap_random_address_set(bd_addr_t addr){
3616     gap_random_address_set_mode(GAP_RANDOM_ADDRESS_TYPE_OFF);
3617     memcpy(sm_random_address, addr, 6);
3618     rau_state = RAU_SET_ADDRESS;
3619     sm_run();
3620 }
3621 
3622 /*
3623  * @brief Set Advertisement Paramters
3624  * @param adv_int_min
3625  * @param adv_int_max
3626  * @param adv_type
3627  * @param direct_address_type
3628  * @param direct_address
3629  * @param channel_map
3630  * @param filter_policy
3631  *
3632  * @note own_address_type is used from gap_random_address_set_mode
3633  */
3634 void gap_advertisements_set_params(uint16_t adv_int_min, uint16_t adv_int_max, uint8_t adv_type,
3635     uint8_t direct_address_typ, bd_addr_t direct_address, uint8_t channel_map, uint8_t filter_policy){
3636     hci_le_advertisements_set_params(adv_int_min, adv_int_max, adv_type, gap_random_adress_type,
3637         direct_address_typ, direct_address, channel_map, filter_policy);
3638 }
3639 
3640