xref: /btstack/src/ble/sm.c (revision 3764b5516a1738f5828dcd5ecbc39dac835ad048)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #include <stdio.h>
39 #include <string.h>
40 #include <inttypes.h>
41 
42 #include "ble/le_device_db.h"
43 #include "ble/core.h"
44 #include "ble/sm.h"
45 #include "btstack_debug.h"
46 #include "btstack_event.h"
47 #include "btstack_linked_list.h"
48 #include "btstack_memory.h"
49 #include "gap.h"
50 #include "hci.h"
51 #include "l2cap.h"
52 
53 #ifdef ENABLE_LE_SECURE_CONNECTIONS
54 // TODO: remove software AES
55 #include "rijndael.h"
56 #endif
57 
58 #if defined(ENABLE_LE_SECURE_CONNECTIONS) && !defined(HAVE_HCI_CONTROLLER_DHKEY_SUPPORT)
59 #define USE_MBEDTLS_FOR_ECDH
60 #endif
61 
62 #ifdef ENABLE_LE_SECURE_CONNECTIONS
63 #ifdef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
64 #error "Support for DHKEY Support in HCI Controller not implemented yet. Please use software implementation"
65 #else
66 #define USE_MBEDTLS_FOR_ECDH
67 #endif
68 #endif
69 
70 
71 // Software ECDH implementation provided by mbedtls
72 #ifdef USE_MBEDTLS_FOR_ECDH
73 #if !defined(MBEDTLS_CONFIG_FILE)
74 #include "mbedtls/config.h"
75 #else
76 #include MBEDTLS_CONFIG_FILE
77 #endif
78 #if defined(MBEDTLS_PLATFORM_C)
79 #include "mbedtls/platform.h"
80 #else
81 #include <stdio.h>
82 #define mbedtls_printf     printf
83 #endif
84 #include "mbedtls/ecp.h"
85 #endif
86 
87 //
88 // SM internal types and globals
89 //
90 
91 typedef enum {
92     DKG_W4_WORKING,
93     DKG_CALC_IRK,
94     DKG_W4_IRK,
95     DKG_CALC_DHK,
96     DKG_W4_DHK,
97     DKG_READY
98 } derived_key_generation_t;
99 
100 typedef enum {
101     RAU_W4_WORKING,
102     RAU_IDLE,
103     RAU_GET_RANDOM,
104     RAU_W4_RANDOM,
105     RAU_GET_ENC,
106     RAU_W4_ENC,
107     RAU_SET_ADDRESS,
108 } random_address_update_t;
109 
110 typedef enum {
111     CMAC_IDLE,
112     CMAC_CALC_SUBKEYS,
113     CMAC_W4_SUBKEYS,
114     CMAC_CALC_MI,
115     CMAC_W4_MI,
116     CMAC_CALC_MLAST,
117     CMAC_W4_MLAST
118 } cmac_state_t;
119 
120 typedef enum {
121     JUST_WORKS,
122     PK_RESP_INPUT,  // Initiator displays PK, responder inputs PK
123     PK_INIT_INPUT,  // Responder displays PK, initiator inputs PK
124     OK_BOTH_INPUT,  // Only input on both, both input PK
125     NK_BOTH_INPUT,  // Only numerical compparison (yes/no) on on both sides
126     OOB             // OOB available on both sides
127 } stk_generation_method_t;
128 
129 typedef enum {
130     SM_USER_RESPONSE_IDLE,
131     SM_USER_RESPONSE_PENDING,
132     SM_USER_RESPONSE_CONFIRM,
133     SM_USER_RESPONSE_PASSKEY,
134     SM_USER_RESPONSE_DECLINE
135 } sm_user_response_t;
136 
137 typedef enum {
138     SM_AES128_IDLE,
139     SM_AES128_ACTIVE
140 } sm_aes128_state_t;
141 
142 typedef enum {
143     ADDRESS_RESOLUTION_IDLE,
144     ADDRESS_RESOLUTION_GENERAL,
145     ADDRESS_RESOLUTION_FOR_CONNECTION,
146 } address_resolution_mode_t;
147 
148 typedef enum {
149     ADDRESS_RESOLUTION_SUCEEDED,
150     ADDRESS_RESOLUTION_FAILED,
151 } address_resolution_event_t;
152 
153 typedef enum {
154     EC_KEY_GENERATION_IDLE,
155     EC_KEY_GENERATION_ACTIVE,
156     EC_KEY_GENERATION_DONE,
157 } ec_key_generation_state_t;
158 
159 typedef enum {
160     SM_STATE_VAR_DHKEY_COMMAND_RECEIVED = 1 << 0
161 } sm_state_var_t;
162 
163 //
164 // GLOBAL DATA
165 //
166 
167 static uint8_t test_use_fixed_local_csrk;
168 static uint8_t test_use_fixed_ec_keypair;
169 
170 // configuration
171 static uint8_t sm_accepted_stk_generation_methods;
172 static uint8_t sm_max_encryption_key_size;
173 static uint8_t sm_min_encryption_key_size;
174 static uint8_t sm_auth_req = 0;
175 static uint8_t sm_io_capabilities = IO_CAPABILITY_NO_INPUT_NO_OUTPUT;
176 static uint8_t sm_slave_request_security;
177 
178 // Security Manager Master Keys, please use sm_set_er(er) and sm_set_ir(ir) with your own 128 bit random values
179 static sm_key_t sm_persistent_er;
180 static sm_key_t sm_persistent_ir;
181 
182 // derived from sm_persistent_ir
183 static sm_key_t sm_persistent_dhk;
184 static sm_key_t sm_persistent_irk;
185 static uint8_t  sm_persistent_irk_ready = 0;    // used for testing
186 static derived_key_generation_t dkg_state;
187 
188 // derived from sm_persistent_er
189 // ..
190 
191 // random address update
192 static random_address_update_t rau_state;
193 static bd_addr_t sm_random_address;
194 
195 // CMAC Calculation: General
196 static cmac_state_t sm_cmac_state;
197 static uint16_t     sm_cmac_message_len;
198 static sm_key_t     sm_cmac_k;
199 static sm_key_t     sm_cmac_x;
200 static sm_key_t     sm_cmac_m_last;
201 static uint8_t      sm_cmac_block_current;
202 static uint8_t      sm_cmac_block_count;
203 static uint8_t      (*sm_cmac_get_byte)(uint16_t offset);
204 static void         (*sm_cmac_done_handler)(uint8_t * hash);
205 
206 // CMAC for ATT Signed Writes
207 static uint8_t      sm_cmac_header[3];
208 static const uint8_t * sm_cmac_message;
209 static uint8_t      sm_cmac_sign_counter[4];
210 
211 // CMAC for Secure Connection functions
212 #ifdef ENABLE_LE_SECURE_CONNECTIONS
213 static sm_connection_t * sm_cmac_connection;
214 static uint8_t           sm_cmac_sc_buffer[80];
215 #endif
216 
217 // resolvable private address lookup / CSRK calculation
218 static int       sm_address_resolution_test;
219 static int       sm_address_resolution_ah_calculation_active;
220 static uint8_t   sm_address_resolution_addr_type;
221 static bd_addr_t sm_address_resolution_address;
222 static void *    sm_address_resolution_context;
223 static address_resolution_mode_t sm_address_resolution_mode;
224 static btstack_linked_list_t sm_address_resolution_general_queue;
225 
226 // aes128 crypto engine. store current sm_connection_t in sm_aes128_context
227 static sm_aes128_state_t  sm_aes128_state;
228 static void *             sm_aes128_context;
229 
230 // random engine. store context (ususally sm_connection_t)
231 static void * sm_random_context;
232 
233 // to receive hci events
234 static btstack_packet_callback_registration_t hci_event_callback_registration;
235 
236 /* to dispatch sm event */
237 static btstack_linked_list_t sm_event_handlers;
238 
239 // Software ECDH implementation provided by mbedtls
240 #ifdef USE_MBEDTLS_FOR_ECDH
241 static mbedtls_ecp_keypair le_keypair;
242 static ec_key_generation_state_t ec_key_generation_state;
243 #endif
244 
245 //
246 // Volume 3, Part H, Chapter 24
247 // "Security shall be initiated by the Security Manager in the device in the master role.
248 // The device in the slave role shall be the responding device."
249 // -> master := initiator, slave := responder
250 //
251 
252 // data needed for security setup
253 typedef struct sm_setup_context {
254 
255     btstack_timer_source_t sm_timeout;
256 
257     // used in all phases
258     uint8_t   sm_pairing_failed_reason;
259 
260     // user response, (Phase 1 and/or 2)
261     uint8_t   sm_user_response;
262 
263     // defines which keys will be send after connection is encrypted - calculated during Phase 1, used Phase 3
264     int       sm_key_distribution_send_set;
265     int       sm_key_distribution_received_set;
266 
267     // Phase 2 (Pairing over SMP)
268     stk_generation_method_t sm_stk_generation_method;
269     sm_key_t  sm_tk;
270     uint8_t   sm_use_secure_connections;
271 
272     sm_key_t  sm_c1_t3_value;   // c1 calculation
273     sm_pairing_packet_t sm_m_preq; // pairing request - needed only for c1
274     sm_pairing_packet_t sm_s_pres; // pairing response - needed only for c1
275     sm_key_t  sm_local_random;
276     sm_key_t  sm_local_confirm;
277     sm_key_t  sm_peer_random;
278     sm_key_t  sm_peer_confirm;
279     uint8_t   sm_m_addr_type;   // address and type can be removed
280     uint8_t   sm_s_addr_type;   //  ''
281     bd_addr_t sm_m_address;     //  ''
282     bd_addr_t sm_s_address;     //  ''
283     sm_key_t  sm_ltk;
284 
285 #ifdef ENABLE_LE_SECURE_CONNECTIONS
286     uint8_t   sm_peer_qx[32];   // also stores random for EC key generation during init
287     uint8_t   sm_peer_qy[32];   //  ''
288     sm_key_t  sm_peer_nonce;    // might be combined with sm_peer_random
289     sm_key_t  sm_local_nonce;   // might be combined with sm_local_random
290     sm_key_t  sm_peer_dhkey_check;
291     sm_key_t  sm_local_dhkey_check;
292     sm_key_t  sm_ra;
293     sm_key_t  sm_rb;
294     sm_key_t  sm_t;             // used for f5
295     sm_key_t  sm_mackey;
296     uint8_t   sm_passkey_bit;   // also stores number of generated random bytes for EC key generation
297     uint8_t   sm_state_vars;
298 #endif
299 
300     // Phase 3
301 
302     // key distribution, we generate
303     uint16_t  sm_local_y;
304     uint16_t  sm_local_div;
305     uint16_t  sm_local_ediv;
306     uint8_t   sm_local_rand[8];
307     sm_key_t  sm_local_ltk;
308     sm_key_t  sm_local_csrk;
309     sm_key_t  sm_local_irk;
310     // sm_local_address/addr_type not needed
311 
312     // key distribution, received from peer
313     uint16_t  sm_peer_y;
314     uint16_t  sm_peer_div;
315     uint16_t  sm_peer_ediv;
316     uint8_t   sm_peer_rand[8];
317     sm_key_t  sm_peer_ltk;
318     sm_key_t  sm_peer_irk;
319     sm_key_t  sm_peer_csrk;
320     uint8_t   sm_peer_addr_type;
321     bd_addr_t sm_peer_address;
322 
323 } sm_setup_context_t;
324 
325 //
326 static sm_setup_context_t the_setup;
327 static sm_setup_context_t * setup = &the_setup;
328 
329 // active connection - the one for which the_setup is used for
330 static uint16_t sm_active_connection = 0;
331 
332 // @returns 1 if oob data is available
333 // stores oob data in provided 16 byte buffer if not null
334 static int (*sm_get_oob_data)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data) = NULL;
335 
336 // used to notify applicationss that user interaction is neccessary, see sm_notify_t below
337 static btstack_packet_handler_t sm_client_packet_handler = NULL;
338 
339 // horizontal: initiator capabilities
340 // vertial:    responder capabilities
341 static const stk_generation_method_t stk_generation_method [5] [5] = {
342     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
343     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
344     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
345     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
346     { PK_RESP_INPUT,   PK_RESP_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
347 };
348 
349 // uses numeric comparison if one side has DisplayYesNo and KeyboardDisplay combinations
350 #ifdef ENABLE_LE_SECURE_CONNECTIONS
351 static const stk_generation_method_t stk_generation_method_with_secure_connection[5][5] = {
352     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
353     { JUST_WORKS,      NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
354     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
355     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
356     { PK_RESP_INPUT,   NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
357 };
358 #endif
359 
360 static void sm_run(void);
361 static void sm_done_for_handle(hci_con_handle_t con_handle);
362 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle);
363 static inline int sm_calc_actual_encryption_key_size(int other);
364 static int sm_validate_stk_generation_method(void);
365 static void sm_shift_left_by_one_bit_inplace(int len, uint8_t * data);
366 
367 static void log_info_hex16(const char * name, uint16_t value){
368     log_info("%-6s 0x%04x", name, value);
369 }
370 
371 // @returns 1 if all bytes are 0
372 static int sm_is_null(uint8_t * data, int size){
373     int i;
374     for (i=0; i < size ; i++){
375         if (data[i]) return 0;
376     }
377     return 1;
378 }
379 
380 static int sm_is_null_random(uint8_t random[8]){
381     return sm_is_null(random, 8);
382 }
383 
384 static int sm_is_null_key(uint8_t * key){
385     return sm_is_null(key, 16);
386 }
387 
388 // Key utils
389 static void sm_reset_tk(void){
390     int i;
391     for (i=0;i<16;i++){
392         setup->sm_tk[i] = 0;
393     }
394 }
395 
396 // "For example, if a 128-bit encryption key is 0x123456789ABCDEF0123456789ABCDEF0
397 // and it is reduced to 7 octets (56 bits), then the resulting key is 0x0000000000000000003456789ABCDEF0.""
398 static void sm_truncate_key(sm_key_t key, int max_encryption_size){
399     int i;
400     for (i = max_encryption_size ; i < 16 ; i++){
401         key[15-i] = 0;
402     }
403 }
404 
405 // SMP Timeout implementation
406 
407 // Upon transmission of the Pairing Request command or reception of the Pairing Request command,
408 // the Security Manager Timer shall be reset and started.
409 //
410 // The Security Manager Timer shall be reset when an L2CAP SMP command is queued for transmission.
411 //
412 // If the Security Manager Timer reaches 30 seconds, the procedure shall be considered to have failed,
413 // and the local higher layer shall be notified. No further SMP commands shall be sent over the L2CAP
414 // Security Manager Channel. A new SM procedure shall only be performed when a new physical link has been
415 // established.
416 
417 static void sm_timeout_handler(btstack_timer_source_t * timer){
418     log_info("SM timeout");
419     sm_connection_t * sm_conn = (sm_connection_t*) btstack_run_loop_get_timer_context(timer);
420     sm_conn->sm_engine_state = SM_GENERAL_TIMEOUT;
421     sm_done_for_handle(sm_conn->sm_handle);
422 
423     // trigger handling of next ready connection
424     sm_run();
425 }
426 static void sm_timeout_start(sm_connection_t * sm_conn){
427     btstack_run_loop_remove_timer(&setup->sm_timeout);
428     btstack_run_loop_set_timer_context(&setup->sm_timeout, sm_conn);
429     btstack_run_loop_set_timer_handler(&setup->sm_timeout, sm_timeout_handler);
430     btstack_run_loop_set_timer(&setup->sm_timeout, 30000); // 30 seconds sm timeout
431     btstack_run_loop_add_timer(&setup->sm_timeout);
432 }
433 static void sm_timeout_stop(void){
434     btstack_run_loop_remove_timer(&setup->sm_timeout);
435 }
436 static void sm_timeout_reset(sm_connection_t * sm_conn){
437     sm_timeout_stop();
438     sm_timeout_start(sm_conn);
439 }
440 
441 // end of sm timeout
442 
443 // GAP Random Address updates
444 static gap_random_address_type_t gap_random_adress_type;
445 static btstack_timer_source_t gap_random_address_update_timer;
446 static uint32_t gap_random_adress_update_period;
447 
448 static void gap_random_address_trigger(void){
449     if (rau_state != RAU_IDLE) return;
450     log_info("gap_random_address_trigger");
451     rau_state = RAU_GET_RANDOM;
452     sm_run();
453 }
454 
455 static void gap_random_address_update_handler(btstack_timer_source_t * timer){
456     log_info("GAP Random Address Update due");
457     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
458     btstack_run_loop_add_timer(&gap_random_address_update_timer);
459     gap_random_address_trigger();
460 }
461 
462 static void gap_random_address_update_start(void){
463     btstack_run_loop_set_timer_handler(&gap_random_address_update_timer, gap_random_address_update_handler);
464     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
465     btstack_run_loop_add_timer(&gap_random_address_update_timer);
466 }
467 
468 static void gap_random_address_update_stop(void){
469     btstack_run_loop_remove_timer(&gap_random_address_update_timer);
470 }
471 
472 
473 static void sm_random_start(void * context){
474     sm_random_context = context;
475     hci_send_cmd(&hci_le_rand);
476 }
477 
478 // pre: sm_aes128_state != SM_AES128_ACTIVE, hci_can_send_command == 1
479 // context is made availabe to aes128 result handler by this
480 static void sm_aes128_start(sm_key_t key, sm_key_t plaintext, void * context){
481     sm_aes128_state = SM_AES128_ACTIVE;
482     sm_key_t key_flipped, plaintext_flipped;
483     reverse_128(key, key_flipped);
484     reverse_128(plaintext, plaintext_flipped);
485     sm_aes128_context = context;
486     hci_send_cmd(&hci_le_encrypt, key_flipped, plaintext_flipped);
487 }
488 
489 // ah(k,r) helper
490 // r = padding || r
491 // r - 24 bit value
492 static void sm_ah_r_prime(uint8_t r[3], sm_key_t r_prime){
493     // r'= padding || r
494     memset(r_prime, 0, 16);
495     memcpy(&r_prime[13], r, 3);
496 }
497 
498 // d1 helper
499 // d' = padding || r || d
500 // d,r - 16 bit values
501 static void sm_d1_d_prime(uint16_t d, uint16_t r, sm_key_t d1_prime){
502     // d'= padding || r || d
503     memset(d1_prime, 0, 16);
504     big_endian_store_16(d1_prime, 12, r);
505     big_endian_store_16(d1_prime, 14, d);
506 }
507 
508 // dm helper
509 // r’ = padding || r
510 // r - 64 bit value
511 static void sm_dm_r_prime(uint8_t r[8], sm_key_t r_prime){
512     memset(r_prime, 0, 16);
513     memcpy(&r_prime[8], r, 8);
514 }
515 
516 // calculate arguments for first AES128 operation in C1 function
517 static void sm_c1_t1(sm_key_t r, uint8_t preq[7], uint8_t pres[7], uint8_t iat, uint8_t rat, sm_key_t t1){
518 
519     // p1 = pres || preq || rat’ || iat’
520     // "The octet of iat’ becomes the least significant octet of p1 and the most signifi-
521     // cant octet of pres becomes the most significant octet of p1.
522     // For example, if the 8-bit iat’ is 0x01, the 8-bit rat’ is 0x00, the 56-bit preq
523     // is 0x07071000000101 and the 56 bit pres is 0x05000800000302 then
524     // p1 is 0x05000800000302070710000001010001."
525 
526     sm_key_t p1;
527     reverse_56(pres, &p1[0]);
528     reverse_56(preq, &p1[7]);
529     p1[14] = rat;
530     p1[15] = iat;
531     log_info_key("p1", p1);
532     log_info_key("r", r);
533 
534     // t1 = r xor p1
535     int i;
536     for (i=0;i<16;i++){
537         t1[i] = r[i] ^ p1[i];
538     }
539     log_info_key("t1", t1);
540 }
541 
542 // calculate arguments for second AES128 operation in C1 function
543 static void sm_c1_t3(sm_key_t t2, bd_addr_t ia, bd_addr_t ra, sm_key_t t3){
544      // p2 = padding || ia || ra
545     // "The least significant octet of ra becomes the least significant octet of p2 and
546     // the most significant octet of padding becomes the most significant octet of p2.
547     // For example, if 48-bit ia is 0xA1A2A3A4A5A6 and the 48-bit ra is
548     // 0xB1B2B3B4B5B6 then p2 is 0x00000000A1A2A3A4A5A6B1B2B3B4B5B6.
549 
550     sm_key_t p2;
551     memset(p2, 0, 16);
552     memcpy(&p2[4],  ia, 6);
553     memcpy(&p2[10], ra, 6);
554     log_info_key("p2", p2);
555 
556     // c1 = e(k, t2_xor_p2)
557     int i;
558     for (i=0;i<16;i++){
559         t3[i] = t2[i] ^ p2[i];
560     }
561     log_info_key("t3", t3);
562 }
563 
564 static void sm_s1_r_prime(sm_key_t r1, sm_key_t r2, sm_key_t r_prime){
565     log_info_key("r1", r1);
566     log_info_key("r2", r2);
567     memcpy(&r_prime[8], &r2[8], 8);
568     memcpy(&r_prime[0], &r1[8], 8);
569 }
570 
571 #ifdef ENABLE_LE_SECURE_CONNECTIONS
572 // Software implementations of crypto toolbox for LE Secure Connection
573 // TODO: replace with code to use AES Engine of HCI Controller
574 typedef uint8_t sm_key24_t[3];
575 typedef uint8_t sm_key56_t[7];
576 typedef uint8_t sm_key256_t[32];
577 
578 #if 0
579 static void aes128_calc_cyphertext(const uint8_t key[16], const uint8_t plaintext[16], uint8_t cyphertext[16]){
580     uint32_t rk[RKLENGTH(KEYBITS)];
581     int nrounds = rijndaelSetupEncrypt(rk, &key[0], KEYBITS);
582     rijndaelEncrypt(rk, nrounds, plaintext, cyphertext);
583 }
584 
585 static void calc_subkeys(sm_key_t k0, sm_key_t k1, sm_key_t k2){
586     memcpy(k1, k0, 16);
587     sm_shift_left_by_one_bit_inplace(16, k1);
588     if (k0[0] & 0x80){
589         k1[15] ^= 0x87;
590     }
591     memcpy(k2, k1, 16);
592     sm_shift_left_by_one_bit_inplace(16, k2);
593     if (k1[0] & 0x80){
594         k2[15] ^= 0x87;
595     }
596 }
597 
598 static void aes_cmac(sm_key_t aes_cmac, const sm_key_t key, const uint8_t * data, int cmac_message_len){
599     sm_key_t k0, k1, k2, zero;
600     memset(zero, 0, 16);
601 
602     aes128_calc_cyphertext(key, zero, k0);
603     calc_subkeys(k0, k1, k2);
604 
605     int cmac_block_count = (cmac_message_len + 15) / 16;
606 
607     // step 3: ..
608     if (cmac_block_count==0){
609         cmac_block_count = 1;
610     }
611 
612     // step 4: set m_last
613     sm_key_t cmac_m_last;
614     int sm_cmac_last_block_complete = cmac_message_len != 0 && (cmac_message_len & 0x0f) == 0;
615     int i;
616     if (sm_cmac_last_block_complete){
617         for (i=0;i<16;i++){
618             cmac_m_last[i] = data[cmac_message_len - 16 + i] ^ k1[i];
619         }
620     } else {
621         int valid_octets_in_last_block = cmac_message_len & 0x0f;
622         for (i=0;i<16;i++){
623             if (i < valid_octets_in_last_block){
624                 cmac_m_last[i] = data[(cmac_message_len & 0xfff0) + i] ^ k2[i];
625                 continue;
626             }
627             if (i == valid_octets_in_last_block){
628                 cmac_m_last[i] = 0x80 ^ k2[i];
629                 continue;
630             }
631             cmac_m_last[i] = k2[i];
632         }
633     }
634 
635     // printf("sm_cmac_start: len %u, block count %u\n", cmac_message_len, cmac_block_count);
636     // LOG_KEY(cmac_m_last);
637 
638     // Step 5
639     sm_key_t cmac_x;
640     memset(cmac_x, 0, 16);
641 
642     // Step 6
643     sm_key_t sm_cmac_y;
644     for (int block = 0 ; block < cmac_block_count-1 ; block++){
645         for (i=0;i<16;i++){
646             sm_cmac_y[i] = cmac_x[i] ^ data[block * 16 + i];
647         }
648         aes128_calc_cyphertext(key, sm_cmac_y, cmac_x);
649     }
650     for (i=0;i<16;i++){
651         sm_cmac_y[i] = cmac_x[i] ^ cmac_m_last[i];
652     }
653 
654     // Step 7
655     aes128_calc_cyphertext(key, sm_cmac_y, aes_cmac);
656 }
657 #endif
658 
659 #if 0
660 //
661 // Link Key Conversion Function h6
662 //
663 // h6(W, keyID) = AES-CMACW(keyID)
664 // - W is 128 bits
665 // - keyID is 32 bits
666 static void h6(sm_key_t res, const sm_key_t w, const uint32_t key_id){
667     uint8_t key_id_buffer[4];
668     big_endian_store_32(key_id_buffer, 0, key_id);
669     aes_cmac(res, w, key_id_buffer, 4);
670 }
671 #endif
672 #endif
673 
674 static void sm_setup_event_base(uint8_t * event, int event_size, uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
675     event[0] = type;
676     event[1] = event_size - 2;
677     little_endian_store_16(event, 2, con_handle);
678     event[4] = addr_type;
679     reverse_bd_addr(address, &event[5]);
680 }
681 
682 static void sm_dispatch_event(uint8_t packet_type, uint16_t channel, uint8_t * packet, uint16_t size){
683     if (sm_client_packet_handler) {
684         sm_client_packet_handler(HCI_EVENT_PACKET, 0, packet, size);
685     }
686     // dispatch to all event handlers
687     btstack_linked_list_iterator_t it;
688     btstack_linked_list_iterator_init(&it, &sm_event_handlers);
689     while (btstack_linked_list_iterator_has_next(&it)){
690         btstack_packet_callback_registration_t * entry = (btstack_packet_callback_registration_t*) btstack_linked_list_iterator_next(&it);
691         entry->callback(packet_type, 0, packet, size);
692     }
693 }
694 
695 static void sm_notify_client_base(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
696     uint8_t event[11];
697     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
698     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
699 }
700 
701 static void sm_notify_client_passkey(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint32_t passkey){
702     uint8_t event[15];
703     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
704     little_endian_store_32(event, 11, passkey);
705     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
706 }
707 
708 static void sm_notify_client_index(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint16_t index){
709     uint8_t event[13];
710     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
711     little_endian_store_16(event, 11, index);
712     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
713 }
714 
715 static void sm_notify_client_authorization(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint8_t result){
716 
717     uint8_t event[18];
718     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
719     event[11] = result;
720     sm_dispatch_event(HCI_EVENT_PACKET, 0, (uint8_t*) &event, sizeof(event));
721 }
722 
723 // decide on stk generation based on
724 // - pairing request
725 // - io capabilities
726 // - OOB data availability
727 static void sm_setup_tk(void){
728 
729     // default: just works
730     setup->sm_stk_generation_method = JUST_WORKS;
731 
732 #ifdef ENABLE_LE_SECURE_CONNECTIONS
733     setup->sm_use_secure_connections = ( sm_pairing_packet_get_auth_req(setup->sm_m_preq)
734                                        & sm_pairing_packet_get_auth_req(setup->sm_s_pres)
735                                        & SM_AUTHREQ_SECURE_CONNECTION ) != 0;
736     memset(setup->sm_ra, 0, 16);
737     memset(setup->sm_rb, 0, 16);
738 #else
739     setup->sm_use_secure_connections = 0;
740 #endif
741 
742     // If both devices have not set the MITM option in the Authentication Requirements
743     // Flags, then the IO capabilities shall be ignored and the Just Works association
744     // model shall be used.
745     if (((sm_pairing_packet_get_auth_req(setup->sm_m_preq) & SM_AUTHREQ_MITM_PROTECTION) == 0)
746     &&  ((sm_pairing_packet_get_auth_req(setup->sm_s_pres) & SM_AUTHREQ_MITM_PROTECTION) == 0)){
747         log_info("SM: MITM not required by both -> JUST WORKS");
748         return;
749     }
750 
751     // TODO: with LE SC, OOB is used to transfer data OOB during pairing, single device with OOB is sufficient
752 
753     // If both devices have out of band authentication data, then the Authentication
754     // Requirements Flags shall be ignored when selecting the pairing method and the
755     // Out of Band pairing method shall be used.
756     if (sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq)
757     &&  sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres)){
758         log_info("SM: have OOB data");
759         log_info_key("OOB", setup->sm_tk);
760         setup->sm_stk_generation_method = OOB;
761         return;
762     }
763 
764     // Reset TK as it has been setup in sm_init_setup
765     sm_reset_tk();
766 
767     // Also use just works if unknown io capabilites
768     if ((sm_pairing_packet_get_io_capability(setup->sm_m_preq) > IO_CAPABILITY_KEYBOARD_DISPLAY) || (sm_pairing_packet_get_io_capability(setup->sm_s_pres) > IO_CAPABILITY_KEYBOARD_DISPLAY)){
769         return;
770     }
771 
772     // Otherwise the IO capabilities of the devices shall be used to determine the
773     // pairing method as defined in Table 2.4.
774     // see http://stackoverflow.com/a/1052837/393697 for how to specify pointer to 2-dimensional array
775     const stk_generation_method_t (*generation_method)[5] = stk_generation_method;
776 
777 #ifdef ENABLE_LE_SECURE_CONNECTIONS
778     // table not define by default
779     if (setup->sm_use_secure_connections){
780         generation_method = stk_generation_method_with_secure_connection;
781     }
782 #endif
783     setup->sm_stk_generation_method = generation_method[sm_pairing_packet_get_io_capability(setup->sm_s_pres)][sm_pairing_packet_get_io_capability(setup->sm_m_preq)];
784 
785     log_info("sm_setup_tk: master io cap: %u, slave io cap: %u -> method %u",
786         sm_pairing_packet_get_io_capability(setup->sm_m_preq), sm_pairing_packet_get_io_capability(setup->sm_s_pres), setup->sm_stk_generation_method);
787 }
788 
789 static int sm_key_distribution_flags_for_set(uint8_t key_set){
790     int flags = 0;
791     if (key_set & SM_KEYDIST_ENC_KEY){
792         flags |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
793         flags |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
794     }
795     if (key_set & SM_KEYDIST_ID_KEY){
796         flags |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
797         flags |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
798     }
799     if (key_set & SM_KEYDIST_SIGN){
800         flags |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
801     }
802     return flags;
803 }
804 
805 static void sm_setup_key_distribution(uint8_t key_set){
806     setup->sm_key_distribution_received_set = 0;
807     setup->sm_key_distribution_send_set = sm_key_distribution_flags_for_set(key_set);
808 }
809 
810 // CSRK Key Lookup
811 
812 
813 static int sm_address_resolution_idle(void){
814     return sm_address_resolution_mode == ADDRESS_RESOLUTION_IDLE;
815 }
816 
817 static void sm_address_resolution_start_lookup(uint8_t addr_type, hci_con_handle_t con_handle, bd_addr_t addr, address_resolution_mode_t mode, void * context){
818     memcpy(sm_address_resolution_address, addr, 6);
819     sm_address_resolution_addr_type = addr_type;
820     sm_address_resolution_test = 0;
821     sm_address_resolution_mode = mode;
822     sm_address_resolution_context = context;
823     sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_STARTED, con_handle, addr_type, addr);
824 }
825 
826 int sm_address_resolution_lookup(uint8_t address_type, bd_addr_t address){
827     // check if already in list
828     btstack_linked_list_iterator_t it;
829     sm_lookup_entry_t * entry;
830     btstack_linked_list_iterator_init(&it, &sm_address_resolution_general_queue);
831     while(btstack_linked_list_iterator_has_next(&it)){
832         entry = (sm_lookup_entry_t *) btstack_linked_list_iterator_next(&it);
833         if (entry->address_type != address_type) continue;
834         if (memcmp(entry->address, address, 6))  continue;
835         // already in list
836         return BTSTACK_BUSY;
837     }
838     entry = btstack_memory_sm_lookup_entry_get();
839     if (!entry) return BTSTACK_MEMORY_ALLOC_FAILED;
840     entry->address_type = (bd_addr_type_t) address_type;
841     memcpy(entry->address, address, 6);
842     btstack_linked_list_add(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
843     sm_run();
844     return 0;
845 }
846 
847 // CMAC Implementation using AES128 engine
848 static void sm_shift_left_by_one_bit_inplace(int len, uint8_t * data){
849     int i;
850     int carry = 0;
851     for (i=len-1; i >= 0 ; i--){
852         int new_carry = data[i] >> 7;
853         data[i] = data[i] << 1 | carry;
854         carry = new_carry;
855     }
856 }
857 
858 // while x_state++ for an enum is possible in C, it isn't in C++. we use this helpers to avoid compile errors for now
859 static inline void sm_next_responding_state(sm_connection_t * sm_conn){
860     sm_conn->sm_engine_state = (security_manager_state_t) (((int)sm_conn->sm_engine_state) + 1);
861 }
862 static inline void dkg_next_state(void){
863     dkg_state = (derived_key_generation_t) (((int)dkg_state) + 1);
864 }
865 static inline void rau_next_state(void){
866     rau_state = (random_address_update_t) (((int)rau_state) + 1);
867 }
868 
869 // CMAC calculation using AES Engine
870 
871 static inline void sm_cmac_next_state(void){
872     sm_cmac_state = (cmac_state_t) (((int)sm_cmac_state) + 1);
873 }
874 
875 static int sm_cmac_last_block_complete(void){
876     if (sm_cmac_message_len == 0) return 0;
877     return (sm_cmac_message_len & 0x0f) == 0;
878 }
879 
880 static inline uint8_t sm_cmac_message_get_byte(uint16_t offset){
881     if (offset >= sm_cmac_message_len) {
882         log_error("sm_cmac_message_get_byte. out of bounds, access %u, len %u", offset, sm_cmac_message_len);
883         return 0;
884     }
885 
886     offset = sm_cmac_message_len - 1 - offset;
887 
888     // sm_cmac_header[3] | message[] | sm_cmac_sign_counter[4]
889     if (offset < 3){
890         return sm_cmac_header[offset];
891     }
892     int actual_message_len_incl_header = sm_cmac_message_len - 4;
893     if (offset <  actual_message_len_incl_header){
894         return sm_cmac_message[offset - 3];
895     }
896     return sm_cmac_sign_counter[offset - actual_message_len_incl_header];
897 }
898 
899 // generic cmac calculation
900 void sm_cmac_general_start(const sm_key_t key, uint16_t message_len, uint8_t (*get_byte_callback)(uint16_t offset), void (*done_callback)(uint8_t hash[8])){
901     // Generalized CMAC
902     memcpy(sm_cmac_k, key, 16);
903     memset(sm_cmac_x, 0, 16);
904     sm_cmac_block_current = 0;
905     sm_cmac_message_len  = message_len;
906     sm_cmac_done_handler = done_callback;
907     sm_cmac_get_byte     = get_byte_callback;
908 
909     // step 2: n := ceil(len/const_Bsize);
910     sm_cmac_block_count = (sm_cmac_message_len + 15) / 16;
911 
912     // step 3: ..
913     if (sm_cmac_block_count==0){
914         sm_cmac_block_count = 1;
915     }
916     log_info("sm_cmac_connection %p", sm_cmac_connection);
917     log_info("sm_cmac_general_start: len %u, block count %u", sm_cmac_message_len, sm_cmac_block_count);
918 
919     // first, we need to compute l for k1, k2, and m_last
920     sm_cmac_state = CMAC_CALC_SUBKEYS;
921 
922     // let's go
923     sm_run();
924 }
925 
926 // cmac for ATT Message signing
927 void sm_cmac_start(const sm_key_t k, uint8_t opcode, hci_con_handle_t con_handle, uint16_t message_len, const uint8_t * message, uint32_t sign_counter, void (*done_handler)(uint8_t * hash)){
928     // ATT Message Signing
929     sm_cmac_header[0] = opcode;
930     little_endian_store_16(sm_cmac_header, 1, con_handle);
931     little_endian_store_32(sm_cmac_sign_counter, 0, sign_counter);
932     uint16_t total_message_len = 3 + message_len + 4;  // incl. virtually prepended att opcode, handle and appended sign_counter in LE
933     sm_cmac_message = message;
934     sm_cmac_general_start(k, total_message_len, &sm_cmac_message_get_byte, done_handler);
935 }
936 
937 int sm_cmac_ready(void){
938     return sm_cmac_state == CMAC_IDLE;
939 }
940 
941 static void sm_cmac_handle_aes_engine_ready(void){
942     switch (sm_cmac_state){
943         case CMAC_CALC_SUBKEYS: {
944             sm_key_t const_zero;
945             memset(const_zero, 0, 16);
946             sm_cmac_next_state();
947             sm_aes128_start(sm_cmac_k, const_zero, NULL);
948             break;
949         }
950         case CMAC_CALC_MI: {
951             int j;
952             sm_key_t y;
953             for (j=0;j<16;j++){
954                 y[j] = sm_cmac_x[j] ^ sm_cmac_get_byte(sm_cmac_block_current*16 + j);
955             }
956             sm_cmac_block_current++;
957             sm_cmac_next_state();
958             sm_aes128_start(sm_cmac_k, y, NULL);
959             break;
960         }
961         case CMAC_CALC_MLAST: {
962             int i;
963             sm_key_t y;
964             for (i=0;i<16;i++){
965                 y[i] = sm_cmac_x[i] ^ sm_cmac_m_last[i];
966             }
967             log_info_key("Y", y);
968             sm_cmac_block_current++;
969             sm_cmac_next_state();
970             sm_aes128_start(sm_cmac_k, y, NULL);
971             break;
972         }
973         default:
974             log_info("sm_cmac_handle_aes_engine_ready called in state %u", sm_cmac_state);
975             break;
976     }
977 }
978 
979 static void sm_cmac_handle_encryption_result(sm_key_t data){
980     switch (sm_cmac_state){
981         case CMAC_W4_SUBKEYS: {
982             sm_key_t k1;
983             memcpy(k1, data, 16);
984             sm_shift_left_by_one_bit_inplace(16, k1);
985             if (data[0] & 0x80){
986                 k1[15] ^= 0x87;
987             }
988             sm_key_t k2;
989             memcpy(k2, k1, 16);
990             sm_shift_left_by_one_bit_inplace(16, k2);
991             if (k1[0] & 0x80){
992                 k2[15] ^= 0x87;
993             }
994 
995             log_info_key("k", sm_cmac_k);
996             log_info_key("k1", k1);
997             log_info_key("k2", k2);
998 
999             // step 4: set m_last
1000             int i;
1001             if (sm_cmac_last_block_complete()){
1002                 for (i=0;i<16;i++){
1003                     sm_cmac_m_last[i] = sm_cmac_get_byte(sm_cmac_message_len - 16 + i) ^ k1[i];
1004                 }
1005             } else {
1006                 int valid_octets_in_last_block = sm_cmac_message_len & 0x0f;
1007                 for (i=0;i<16;i++){
1008                     if (i < valid_octets_in_last_block){
1009                         sm_cmac_m_last[i] = sm_cmac_get_byte((sm_cmac_message_len & 0xfff0) + i) ^ k2[i];
1010                         continue;
1011                     }
1012                     if (i == valid_octets_in_last_block){
1013                         sm_cmac_m_last[i] = 0x80 ^ k2[i];
1014                         continue;
1015                     }
1016                     sm_cmac_m_last[i] = k2[i];
1017                 }
1018             }
1019 
1020             // next
1021             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
1022             break;
1023         }
1024         case CMAC_W4_MI:
1025             memcpy(sm_cmac_x, data, 16);
1026             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
1027             break;
1028         case CMAC_W4_MLAST:
1029             // done
1030             log_info("Setting CMAC Engine to IDLE");
1031             sm_cmac_state = CMAC_IDLE;
1032             log_info_key("CMAC", data);
1033             sm_cmac_done_handler(data);
1034             break;
1035         default:
1036             log_info("sm_cmac_handle_encryption_result called in state %u", sm_cmac_state);
1037             break;
1038     }
1039 }
1040 
1041 static void sm_trigger_user_response(sm_connection_t * sm_conn){
1042     // notify client for: JUST WORKS confirm, Numeric comparison confirm, PASSKEY display or input
1043     setup->sm_user_response = SM_USER_RESPONSE_IDLE;
1044     switch (setup->sm_stk_generation_method){
1045         case PK_RESP_INPUT:
1046             if (sm_conn->sm_role){
1047                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1048                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1049             } else {
1050                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1051             }
1052             break;
1053         case PK_INIT_INPUT:
1054             if (sm_conn->sm_role){
1055                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1056             } else {
1057                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1058                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1059             }
1060             break;
1061         case OK_BOTH_INPUT:
1062             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1063             sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1064             break;
1065         case NK_BOTH_INPUT:
1066             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1067             sm_notify_client_passkey(SM_EVENT_NUMERIC_COMPARISON_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1068             break;
1069         case JUST_WORKS:
1070             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1071             sm_notify_client_base(SM_EVENT_JUST_WORKS_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1072             break;
1073         case OOB:
1074             // client already provided OOB data, let's skip notification.
1075             break;
1076     }
1077 }
1078 
1079 static int sm_key_distribution_all_received(sm_connection_t * sm_conn){
1080     int recv_flags;
1081     if (sm_conn->sm_role){
1082         // slave / responder
1083         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres));
1084     } else {
1085         // master / initiator
1086         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
1087     }
1088     log_debug("sm_key_distribution_all_received: received 0x%02x, expecting 0x%02x", setup->sm_key_distribution_received_set, recv_flags);
1089     return recv_flags == setup->sm_key_distribution_received_set;
1090 }
1091 
1092 static void sm_done_for_handle(hci_con_handle_t con_handle){
1093     if (sm_active_connection == con_handle){
1094         sm_timeout_stop();
1095         sm_active_connection = 0;
1096         log_info("sm: connection 0x%x released setup context", con_handle);
1097     }
1098 }
1099 
1100 static int sm_key_distribution_flags_for_auth_req(void){
1101     int flags = SM_KEYDIST_ID_KEY | SM_KEYDIST_SIGN;
1102     if (sm_auth_req & SM_AUTHREQ_BONDING){
1103         // encryption information only if bonding requested
1104         flags |= SM_KEYDIST_ENC_KEY;
1105     }
1106     return flags;
1107 }
1108 
1109 static void sm_init_setup(sm_connection_t * sm_conn){
1110 
1111     // fill in sm setup
1112     setup->sm_state_vars = 0;
1113     sm_reset_tk();
1114     setup->sm_peer_addr_type = sm_conn->sm_peer_addr_type;
1115     memcpy(setup->sm_peer_address, sm_conn->sm_peer_address, 6);
1116 
1117     // query client for OOB data
1118     int have_oob_data = 0;
1119     if (sm_get_oob_data) {
1120         have_oob_data = (*sm_get_oob_data)(sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, setup->sm_tk);
1121     }
1122 
1123     sm_pairing_packet_t * local_packet;
1124     if (sm_conn->sm_role){
1125         // slave
1126         local_packet = &setup->sm_s_pres;
1127         gap_advertisements_get_address(&setup->sm_s_addr_type, setup->sm_s_address);
1128         setup->sm_m_addr_type = sm_conn->sm_peer_addr_type;
1129         memcpy(setup->sm_m_address, sm_conn->sm_peer_address, 6);
1130     } else {
1131         // master
1132         local_packet = &setup->sm_m_preq;
1133         gap_advertisements_get_address(&setup->sm_m_addr_type, setup->sm_m_address);
1134         setup->sm_s_addr_type = sm_conn->sm_peer_addr_type;
1135         memcpy(setup->sm_s_address, sm_conn->sm_peer_address, 6);
1136 
1137         int key_distribution_flags = sm_key_distribution_flags_for_auth_req();
1138         sm_pairing_packet_set_initiator_key_distribution(setup->sm_m_preq, key_distribution_flags);
1139         sm_pairing_packet_set_responder_key_distribution(setup->sm_m_preq, key_distribution_flags);
1140     }
1141 
1142     sm_pairing_packet_set_io_capability(*local_packet, sm_io_capabilities);
1143     sm_pairing_packet_set_oob_data_flag(*local_packet, have_oob_data);
1144     sm_pairing_packet_set_auth_req(*local_packet, sm_auth_req);
1145     sm_pairing_packet_set_max_encryption_key_size(*local_packet, sm_max_encryption_key_size);
1146 }
1147 
1148 static int sm_stk_generation_init(sm_connection_t * sm_conn){
1149 
1150     sm_pairing_packet_t * remote_packet;
1151     int                   remote_key_request;
1152     if (sm_conn->sm_role){
1153         // slave / responder
1154         remote_packet      = &setup->sm_m_preq;
1155         remote_key_request = sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq);
1156     } else {
1157         // master / initiator
1158         remote_packet      = &setup->sm_s_pres;
1159         remote_key_request = sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres);
1160     }
1161 
1162     // check key size
1163     sm_conn->sm_actual_encryption_key_size = sm_calc_actual_encryption_key_size(sm_pairing_packet_get_max_encryption_key_size(*remote_packet));
1164     if (sm_conn->sm_actual_encryption_key_size == 0) return SM_REASON_ENCRYPTION_KEY_SIZE;
1165 
1166     // decide on STK generation method
1167     sm_setup_tk();
1168     log_info("SMP: generation method %u", setup->sm_stk_generation_method);
1169 
1170     // check if STK generation method is acceptable by client
1171     if (!sm_validate_stk_generation_method()) return SM_REASON_AUTHENTHICATION_REQUIREMENTS;
1172 
1173     // identical to responder
1174     sm_setup_key_distribution(remote_key_request);
1175 
1176     // JUST WORKS doens't provide authentication
1177     sm_conn->sm_connection_authenticated = setup->sm_stk_generation_method == JUST_WORKS ? 0 : 1;
1178 
1179     return 0;
1180 }
1181 
1182 static void sm_address_resolution_handle_event(address_resolution_event_t event){
1183 
1184     // cache and reset context
1185     int matched_device_id = sm_address_resolution_test;
1186     address_resolution_mode_t mode = sm_address_resolution_mode;
1187     void * context = sm_address_resolution_context;
1188 
1189     // reset context
1190     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
1191     sm_address_resolution_context = NULL;
1192     sm_address_resolution_test = -1;
1193     hci_con_handle_t con_handle = 0;
1194 
1195     sm_connection_t * sm_connection;
1196     uint16_t ediv;
1197     switch (mode){
1198         case ADDRESS_RESOLUTION_GENERAL:
1199             break;
1200         case ADDRESS_RESOLUTION_FOR_CONNECTION:
1201             sm_connection = (sm_connection_t *) context;
1202             con_handle = sm_connection->sm_handle;
1203             switch (event){
1204                 case ADDRESS_RESOLUTION_SUCEEDED:
1205                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_SUCCEEDED;
1206                     sm_connection->sm_le_db_index = matched_device_id;
1207                     log_info("ADDRESS_RESOLUTION_SUCEEDED, index %d", sm_connection->sm_le_db_index);
1208                     if (sm_connection->sm_role) break;
1209                     if (!sm_connection->sm_bonding_requested && !sm_connection->sm_security_request_received) break;
1210                     sm_connection->sm_security_request_received = 0;
1211                     sm_connection->sm_bonding_requested = 0;
1212                     le_device_db_encryption_get(sm_connection->sm_le_db_index, &ediv, NULL, NULL, NULL, NULL, NULL);
1213                     if (ediv){
1214                         sm_connection->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
1215                     } else {
1216                         sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1217                     }
1218                     break;
1219                 case ADDRESS_RESOLUTION_FAILED:
1220                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_FAILED;
1221                     if (sm_connection->sm_role) break;
1222                     if (!sm_connection->sm_bonding_requested && !sm_connection->sm_security_request_received) break;
1223                     sm_connection->sm_security_request_received = 0;
1224                     sm_connection->sm_bonding_requested = 0;
1225                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1226                     break;
1227             }
1228             break;
1229         default:
1230             break;
1231     }
1232 
1233     switch (event){
1234         case ADDRESS_RESOLUTION_SUCEEDED:
1235             sm_notify_client_index(SM_EVENT_IDENTITY_RESOLVING_SUCCEEDED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address, matched_device_id);
1236             break;
1237         case ADDRESS_RESOLUTION_FAILED:
1238             sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_FAILED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address);
1239             break;
1240     }
1241 }
1242 
1243 static void sm_key_distribution_handle_all_received(sm_connection_t * sm_conn){
1244 
1245     int le_db_index = -1;
1246 
1247     // lookup device based on IRK
1248     if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
1249         int i;
1250         for (i=0; i < le_device_db_count(); i++){
1251             sm_key_t irk;
1252             bd_addr_t address;
1253             int address_type;
1254             le_device_db_info(i, &address_type, address, irk);
1255             if (memcmp(irk, setup->sm_peer_irk, 16) == 0){
1256                 log_info("sm: device found for IRK, updating");
1257                 le_db_index = i;
1258                 break;
1259             }
1260         }
1261     }
1262 
1263     // if not found, lookup via public address if possible
1264     log_info("sm peer addr type %u, peer addres %s", setup->sm_peer_addr_type, bd_addr_to_str(setup->sm_peer_address));
1265     if (le_db_index < 0 && setup->sm_peer_addr_type == BD_ADDR_TYPE_LE_PUBLIC){
1266         int i;
1267         for (i=0; i < le_device_db_count(); i++){
1268             bd_addr_t address;
1269             int address_type;
1270             le_device_db_info(i, &address_type, address, NULL);
1271             log_info("device %u, sm peer addr type %u, peer addres %s", i, address_type, bd_addr_to_str(address));
1272             if (address_type == BD_ADDR_TYPE_LE_PUBLIC && memcmp(address, setup->sm_peer_address, 6) == 0){
1273                 log_info("sm: device found for public address, updating");
1274                 le_db_index = i;
1275                 break;
1276             }
1277         }
1278     }
1279 
1280     // if not found, add to db
1281     if (le_db_index < 0) {
1282         le_db_index = le_device_db_add(setup->sm_peer_addr_type, setup->sm_peer_address, setup->sm_peer_irk);
1283     }
1284 
1285     if (le_db_index >= 0){
1286         le_device_db_local_counter_set(le_db_index, 0);
1287 
1288         // store local CSRK
1289         if (setup->sm_key_distribution_send_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1290             log_info("sm: store local CSRK");
1291             le_device_db_local_csrk_set(le_db_index, setup->sm_local_csrk);
1292             le_device_db_local_counter_set(le_db_index, 0);
1293         }
1294 
1295         // store remote CSRK
1296         if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1297             log_info("sm: store remote CSRK");
1298             le_device_db_remote_csrk_set(le_db_index, setup->sm_peer_csrk);
1299             le_device_db_remote_counter_set(le_db_index, 0);
1300         }
1301 
1302         // store encryption information
1303         if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION
1304             && setup->sm_key_distribution_received_set &  SM_KEYDIST_FLAG_MASTER_IDENTIFICATION){
1305             log_info("sm: set encryption information (key size %u, authenticatd %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
1306             le_device_db_encryption_set(le_db_index, setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1307                 sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
1308         }
1309     }
1310 
1311     // keep le_db_index
1312     sm_conn->sm_le_db_index = le_db_index;
1313 }
1314 
1315 static void sm_pairing_error(sm_connection_t * sm_conn, uint8_t reason){
1316     setup->sm_pairing_failed_reason = reason;
1317     sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1318 }
1319 
1320 static inline void sm_pdu_received_in_wrong_state(sm_connection_t * sm_conn){
1321     sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
1322 }
1323 
1324 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1325 
1326 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn);
1327 static int sm_passkey_used(stk_generation_method_t method);
1328 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method);
1329 
1330 static void sm_sc_start_calculating_local_confirm(sm_connection_t * sm_conn){
1331     if (sm_passkey_used(setup->sm_stk_generation_method)){
1332         sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
1333     } else {
1334         sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
1335     }
1336 }
1337 
1338 static void sm_sc_state_after_receiving_random(sm_connection_t * sm_conn){
1339     if (sm_conn->sm_role){
1340         // Responder
1341         sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
1342     } else {
1343         // Initiator role
1344         switch (setup->sm_stk_generation_method){
1345             case JUST_WORKS:
1346                 sm_sc_prepare_dhkey_check(sm_conn);
1347                 break;
1348 
1349             case NK_BOTH_INPUT:
1350                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_G2;
1351                 break;
1352             case PK_INIT_INPUT:
1353             case PK_RESP_INPUT:
1354             case OK_BOTH_INPUT:
1355                 if (setup->sm_passkey_bit < 20) {
1356                     sm_sc_start_calculating_local_confirm(sm_conn);
1357                 } else {
1358                     sm_sc_prepare_dhkey_check(sm_conn);
1359                 }
1360                 break;
1361             case OOB:
1362                 // TODO: implement SC OOB
1363                 break;
1364         }
1365     }
1366 }
1367 
1368 static uint8_t sm_sc_cmac_get_byte(uint16_t offset){
1369     return sm_cmac_sc_buffer[offset];
1370 }
1371 
1372 static void sm_sc_cmac_done(uint8_t * hash){
1373     log_info("sm_sc_cmac_done: ");
1374     log_info_hexdump(hash, 16);
1375 
1376     sm_connection_t * sm_conn = sm_cmac_connection;
1377     sm_cmac_connection = NULL;
1378 
1379     switch (sm_conn->sm_engine_state){
1380         case SM_SC_W4_CMAC_FOR_CONFIRMATION:
1381             memcpy(setup->sm_local_confirm, hash, 16);
1382             sm_conn->sm_engine_state = SM_SC_SEND_CONFIRMATION;
1383             break;
1384         case SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION:
1385             // check
1386             if (0 != memcmp(hash, setup->sm_peer_confirm, 16)){
1387                 sm_pairing_error(sm_conn, SM_REASON_CONFIRM_VALUE_FAILED);
1388                 break;
1389             }
1390             sm_sc_state_after_receiving_random(sm_conn);
1391             break;
1392         case SM_SC_W4_CALCULATE_G2: {
1393             uint32_t vab = big_endian_read_32(hash, 12) % 1000000;
1394             big_endian_store_32(setup->sm_tk, 12, vab);
1395             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
1396             sm_trigger_user_response(sm_conn);
1397             break;
1398         }
1399         case SM_SC_W4_CALCULATE_F5_SALT:
1400             memcpy(setup->sm_t, hash, 16);
1401             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_MACKEY;
1402             break;
1403         case SM_SC_W4_CALCULATE_F5_MACKEY:
1404             memcpy(setup->sm_mackey, hash, 16);
1405             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_LTK;
1406             break;
1407         case SM_SC_W4_CALCULATE_F5_LTK:
1408             memcpy(setup->sm_ltk, hash, 16);
1409             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK;
1410             break;
1411         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
1412             memcpy(setup->sm_local_dhkey_check, hash, 16);
1413             if (sm_conn->sm_role){
1414                 // responder
1415                 if (setup->sm_state_vars & SM_STATE_VAR_DHKEY_COMMAND_RECEIVED){
1416                     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
1417                 } else {
1418                     sm_conn->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
1419                 }
1420             } else {
1421                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1422             }
1423             break;
1424         case SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
1425             if (0 != memcmp(hash, setup->sm_peer_dhkey_check, 16) ){
1426                 sm_pairing_error(sm_conn, SM_REASON_DHKEY_CHECK_FAILED);
1427                 break;
1428             }
1429             if (sm_conn->sm_role){
1430                 // responder
1431                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1432             } else {
1433                 // initiator
1434                 sm_conn->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
1435             }
1436             break;
1437         default:
1438             log_error("sm_sc_cmac_done in state %u", sm_conn->sm_engine_state);
1439             break;
1440     }
1441     sm_run();
1442 }
1443 
1444 static void f4_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, uint8_t z){
1445     const uint16_t message_len = 65;
1446     sm_cmac_connection = sm_conn;
1447     memcpy(sm_cmac_sc_buffer, u, 32);
1448     memcpy(sm_cmac_sc_buffer+32, v, 32);
1449     sm_cmac_sc_buffer[64] = z;
1450     log_info("f4 key");
1451     log_info_hexdump(x, 16);
1452     log_info("f4 message");
1453     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1454     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1455 }
1456 
1457 static const sm_key_t f5_salt = { 0x6C ,0x88, 0x83, 0x91, 0xAA, 0xF5, 0xA5, 0x38, 0x60, 0x37, 0x0B, 0xDB, 0x5A, 0x60, 0x83, 0xBE};
1458 static const uint8_t f5_key_id[] = { 0x62, 0x74, 0x6c, 0x65 };
1459 static const uint8_t f5_length[] = { 0x01, 0x00};
1460 
1461 static void sm_sc_calculate_dhkey(sm_key256_t dhkey){
1462 #ifdef USE_MBEDTLS_FOR_ECDH
1463     // da * Pb
1464     mbedtls_ecp_group grp;
1465     mbedtls_ecp_group_init( &grp );
1466     mbedtls_ecp_group_load(&grp, MBEDTLS_ECP_DP_SECP256R1);
1467     mbedtls_ecp_point Q;
1468     mbedtls_ecp_point_init( &Q );
1469     mbedtls_mpi_read_binary(&Q.X, setup->sm_peer_qx, 32);
1470     mbedtls_mpi_read_binary(&Q.Y, setup->sm_peer_qy, 32);
1471     mbedtls_mpi_read_string(&Q.Z, 16, "1" );
1472     mbedtls_ecp_point DH;
1473     mbedtls_ecp_point_init( &DH );
1474     mbedtls_ecp_mul(&grp, &DH, &le_keypair.d, &Q, NULL, NULL);
1475     mbedtls_mpi_write_binary(&DH.X, dhkey, 32);
1476 #endif
1477     log_info("dhkey");
1478     log_info_hexdump(dhkey, 32);
1479 }
1480 
1481 static void f5_calculate_salt(sm_connection_t * sm_conn){
1482     // calculate DHKEY
1483     sm_key256_t dhkey;
1484     sm_sc_calculate_dhkey(dhkey);
1485 
1486     // calculate salt for f5
1487     const uint16_t message_len = 32;
1488     sm_cmac_connection = sm_conn;
1489     memcpy(sm_cmac_sc_buffer, dhkey, message_len);
1490     sm_cmac_general_start(f5_salt, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1491 }
1492 
1493 static inline void f5_mackkey(sm_connection_t * sm_conn, sm_key_t t, const sm_key_t n1, const sm_key_t n2, const sm_key56_t a1, const sm_key56_t a2){
1494     const uint16_t message_len = 53;
1495     sm_cmac_connection = sm_conn;
1496 
1497     // f5(W, N1, N2, A1, A2) = AES-CMACT (Counter = 0 || keyID || N1 || N2|| A1|| A2 || Length = 256) -- this is the MacKey
1498     sm_cmac_sc_buffer[0] = 0;
1499     memcpy(sm_cmac_sc_buffer+01, f5_key_id, 4);
1500     memcpy(sm_cmac_sc_buffer+05, n1, 16);
1501     memcpy(sm_cmac_sc_buffer+21, n2, 16);
1502     memcpy(sm_cmac_sc_buffer+37, a1, 7);
1503     memcpy(sm_cmac_sc_buffer+44, a2, 7);
1504     memcpy(sm_cmac_sc_buffer+51, f5_length, 2);
1505     log_info("f5 key");
1506     log_info_hexdump(t, 16);
1507     log_info("f5 message for MacKey");
1508     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1509     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1510 }
1511 
1512 static void f5_calculate_mackey(sm_connection_t * sm_conn){
1513     sm_key56_t bd_addr_master, bd_addr_slave;
1514     bd_addr_master[0] =  setup->sm_m_addr_type;
1515     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1516     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1517     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1518     if (sm_conn->sm_role){
1519         // responder
1520         f5_mackkey(sm_conn, setup->sm_t, setup->sm_peer_nonce, setup->sm_local_nonce, bd_addr_master, bd_addr_slave);
1521     } else {
1522         // initiator
1523         f5_mackkey(sm_conn, setup->sm_t, setup->sm_local_nonce, setup->sm_peer_nonce, bd_addr_master, bd_addr_slave);
1524     }
1525 }
1526 
1527 // note: must be called right after f5_mackey, as sm_cmac_buffer[1..52] will be reused
1528 static inline void f5_ltk(sm_connection_t * sm_conn, sm_key_t t){
1529     const uint16_t message_len = 53;
1530     sm_cmac_connection = sm_conn;
1531     sm_cmac_sc_buffer[0] = 1;
1532     // 1..52 setup before
1533     log_info("f5 key");
1534     log_info_hexdump(t, 16);
1535     log_info("f5 message for LTK");
1536     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1537     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1538 }
1539 
1540 static void f5_calculate_ltk(sm_connection_t * sm_conn){
1541     f5_ltk(sm_conn, setup->sm_t);
1542 }
1543 
1544 static void f6_engine(sm_connection_t * sm_conn, const sm_key_t w, const sm_key_t n1, const sm_key_t n2, const sm_key_t r, const sm_key24_t io_cap, const sm_key56_t a1, const sm_key56_t a2){
1545     const uint16_t message_len = 65;
1546     sm_cmac_connection = sm_conn;
1547     memcpy(sm_cmac_sc_buffer, n1, 16);
1548     memcpy(sm_cmac_sc_buffer+16, n2, 16);
1549     memcpy(sm_cmac_sc_buffer+32, r, 16);
1550     memcpy(sm_cmac_sc_buffer+48, io_cap, 3);
1551     memcpy(sm_cmac_sc_buffer+51, a1, 7);
1552     memcpy(sm_cmac_sc_buffer+58, a2, 7);
1553     log_info("f6 key");
1554     log_info_hexdump(w, 16);
1555     log_info("f6 message");
1556     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1557     sm_cmac_general_start(w, 65, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1558 }
1559 
1560 // g2(U, V, X, Y) = AES-CMACX(U || V || Y) mod 2^32
1561 // - U is 256 bits
1562 // - V is 256 bits
1563 // - X is 128 bits
1564 // - Y is 128 bits
1565 static void g2_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, const sm_key_t y){
1566     const uint16_t message_len = 80;
1567     sm_cmac_connection = sm_conn;
1568     memcpy(sm_cmac_sc_buffer, u, 32);
1569     memcpy(sm_cmac_sc_buffer+32, v, 32);
1570     memcpy(sm_cmac_sc_buffer+64, y, 16);
1571     log_info("g2 key");
1572     log_info_hexdump(x, 16);
1573     log_info("g2 message");
1574     log_info_hexdump(sm_cmac_sc_buffer, sizeof(sm_cmac_sc_buffer));
1575     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1576 }
1577 
1578 static void g2_calculate(sm_connection_t * sm_conn) {
1579     // calc Va if numeric comparison
1580     uint8_t value[32];
1581     mbedtls_mpi_write_binary(&le_keypair.Q.X, value, sizeof(value));
1582     if (sm_conn->sm_role){
1583         // responder
1584         g2_engine(sm_conn, setup->sm_peer_qx, value, setup->sm_peer_nonce, setup->sm_local_nonce);;
1585     } else {
1586         // initiator
1587         g2_engine(sm_conn, value, setup->sm_peer_qx, setup->sm_local_nonce, setup->sm_peer_nonce);
1588     }
1589 }
1590 
1591 static void sm_sc_calculate_local_confirm(sm_connection_t * sm_conn){
1592     uint8_t z = 0;
1593     if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT){
1594         // some form of passkey
1595         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1596         z = 0x80 | ((pk >> setup->sm_passkey_bit) & 1);
1597         setup->sm_passkey_bit++;
1598     }
1599 #ifdef USE_MBEDTLS_FOR_ECDH
1600     uint8_t local_qx[32];
1601     mbedtls_mpi_write_binary(&le_keypair.Q.X, local_qx, sizeof(local_qx));
1602 #endif
1603     f4_engine(sm_conn, local_qx, setup->sm_peer_qx, setup->sm_local_nonce, z);
1604 }
1605 
1606 static void sm_sc_calculate_remote_confirm(sm_connection_t * sm_conn){
1607     uint8_t z = 0;
1608     if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT){
1609         // some form of passkey
1610         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1611         // sm_passkey_bit was increased before sending confirm value
1612         z = 0x80 | ((pk >> (setup->sm_passkey_bit-1)) & 1);
1613     }
1614 #ifdef USE_MBEDTLS_FOR_ECDH
1615     uint8_t local_qx[32];
1616     mbedtls_mpi_write_binary(&le_keypair.Q.X, local_qx, sizeof(local_qx));
1617 #endif
1618     f4_engine(sm_conn, setup->sm_peer_qx, local_qx, setup->sm_peer_nonce, z);
1619 }
1620 
1621 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn){
1622     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_SALT;
1623 }
1624 
1625 static void sm_sc_calculate_f6_for_dhkey_check(sm_connection_t * sm_conn){
1626     // calculate DHKCheck
1627     sm_key56_t bd_addr_master, bd_addr_slave;
1628     bd_addr_master[0] =  setup->sm_m_addr_type;
1629     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1630     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1631     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1632     uint8_t iocap_a[3];
1633     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1634     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1635     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1636     uint8_t iocap_b[3];
1637     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1638     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1639     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1640     if (sm_conn->sm_role){
1641         // responder
1642         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1643     } else {
1644         // initiator
1645         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1646     }
1647 }
1648 
1649 static void sm_sc_calculate_f6_to_verify_dhkey_check(sm_connection_t * sm_conn){
1650     // validate E = f6()
1651     sm_key56_t bd_addr_master, bd_addr_slave;
1652     bd_addr_master[0] =  setup->sm_m_addr_type;
1653     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1654     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1655     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1656 
1657     uint8_t iocap_a[3];
1658     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1659     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1660     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1661     uint8_t iocap_b[3];
1662     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1663     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1664     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1665     if (sm_conn->sm_role){
1666         // responder
1667         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1668     } else {
1669         // initiator
1670         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1671     }
1672 }
1673 #endif
1674 
1675 static void sm_load_security_info(sm_connection_t * sm_connection){
1676     int encryption_key_size;
1677     int authenticated;
1678     int authorized;
1679 
1680     // fetch data from device db - incl. authenticated/authorized/key size. Note all sm_connection_X require encryption enabled
1681     le_device_db_encryption_get(sm_connection->sm_le_db_index, &setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1682                                 &encryption_key_size, &authenticated, &authorized);
1683     log_info("db index %u, key size %u, authenticated %u, authorized %u", sm_connection->sm_le_db_index, encryption_key_size, authenticated, authorized);
1684     sm_connection->sm_actual_encryption_key_size = encryption_key_size;
1685     sm_connection->sm_connection_authenticated = authenticated;
1686     sm_connection->sm_connection_authorization_state = authorized ? AUTHORIZATION_GRANTED : AUTHORIZATION_UNKNOWN;
1687 }
1688 
1689 static void sm_run(void){
1690 
1691     btstack_linked_list_iterator_t it;
1692 
1693     // assert that we can send at least commands
1694     if (!hci_can_send_command_packet_now()) return;
1695 
1696     //
1697     // non-connection related behaviour
1698     //
1699 
1700     // distributed key generation
1701     switch (dkg_state){
1702         case DKG_CALC_IRK:
1703             // already busy?
1704             if (sm_aes128_state == SM_AES128_IDLE) {
1705                 // IRK = d1(IR, 1, 0)
1706                 sm_key_t d1_prime;
1707                 sm_d1_d_prime(1, 0, d1_prime);  // plaintext
1708                 dkg_next_state();
1709                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
1710                 return;
1711             }
1712             break;
1713         case DKG_CALC_DHK:
1714             // already busy?
1715             if (sm_aes128_state == SM_AES128_IDLE) {
1716                 // DHK = d1(IR, 3, 0)
1717                 sm_key_t d1_prime;
1718                 sm_d1_d_prime(3, 0, d1_prime);  // plaintext
1719                 dkg_next_state();
1720                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
1721                 return;
1722             }
1723             break;
1724         default:
1725             break;
1726     }
1727 
1728 #ifdef USE_MBEDTLS_FOR_ECDH
1729     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
1730         sm_random_start(NULL);
1731         return;
1732     }
1733 #endif
1734 
1735     // random address updates
1736     switch (rau_state){
1737         case RAU_GET_RANDOM:
1738             rau_next_state();
1739             sm_random_start(NULL);
1740             return;
1741         case RAU_GET_ENC:
1742             // already busy?
1743             if (sm_aes128_state == SM_AES128_IDLE) {
1744                 sm_key_t r_prime;
1745                 sm_ah_r_prime(sm_random_address, r_prime);
1746                 rau_next_state();
1747                 sm_aes128_start(sm_persistent_irk, r_prime, NULL);
1748                 return;
1749             }
1750             break;
1751         case RAU_SET_ADDRESS:
1752             log_info("New random address: %s", bd_addr_to_str(sm_random_address));
1753             rau_state = RAU_IDLE;
1754             hci_send_cmd(&hci_le_set_random_address, sm_random_address);
1755             return;
1756         default:
1757             break;
1758     }
1759 
1760     // CMAC
1761     switch (sm_cmac_state){
1762         case CMAC_CALC_SUBKEYS:
1763         case CMAC_CALC_MI:
1764         case CMAC_CALC_MLAST:
1765             // already busy?
1766             if (sm_aes128_state == SM_AES128_ACTIVE) break;
1767             sm_cmac_handle_aes_engine_ready();
1768             return;
1769         default:
1770             break;
1771     }
1772 
1773     // CSRK Lookup
1774     // -- if csrk lookup ready, find connection that require csrk lookup
1775     if (sm_address_resolution_idle()){
1776         hci_connections_get_iterator(&it);
1777         while(btstack_linked_list_iterator_has_next(&it)){
1778             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1779             sm_connection_t  * sm_connection  = &hci_connection->sm_connection;
1780             if (sm_connection->sm_irk_lookup_state == IRK_LOOKUP_W4_READY){
1781                 // and start lookup
1782                 sm_address_resolution_start_lookup(sm_connection->sm_peer_addr_type, sm_connection->sm_handle, sm_connection->sm_peer_address, ADDRESS_RESOLUTION_FOR_CONNECTION, sm_connection);
1783                 sm_connection->sm_irk_lookup_state = IRK_LOOKUP_STARTED;
1784                 break;
1785             }
1786         }
1787     }
1788 
1789     // -- if csrk lookup ready, resolved addresses for received addresses
1790     if (sm_address_resolution_idle()) {
1791         if (!btstack_linked_list_empty(&sm_address_resolution_general_queue)){
1792             sm_lookup_entry_t * entry = (sm_lookup_entry_t *) sm_address_resolution_general_queue;
1793             btstack_linked_list_remove(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
1794             sm_address_resolution_start_lookup(entry->address_type, 0, entry->address, ADDRESS_RESOLUTION_GENERAL, NULL);
1795             btstack_memory_sm_lookup_entry_free(entry);
1796         }
1797     }
1798 
1799     // -- Continue with CSRK device lookup by public or resolvable private address
1800     if (!sm_address_resolution_idle()){
1801         log_info("LE Device Lookup: device %u/%u", sm_address_resolution_test, le_device_db_count());
1802         while (sm_address_resolution_test < le_device_db_count()){
1803             int addr_type;
1804             bd_addr_t addr;
1805             sm_key_t irk;
1806             le_device_db_info(sm_address_resolution_test, &addr_type, addr, irk);
1807             log_info("device type %u, addr: %s", addr_type, bd_addr_to_str(addr));
1808 
1809             if (sm_address_resolution_addr_type == addr_type && memcmp(addr, sm_address_resolution_address, 6) == 0){
1810                 log_info("LE Device Lookup: found CSRK by { addr_type, address} ");
1811                 sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
1812                 break;
1813             }
1814 
1815             if (sm_address_resolution_addr_type == 0){
1816                 sm_address_resolution_test++;
1817                 continue;
1818             }
1819 
1820             if (sm_aes128_state == SM_AES128_ACTIVE) break;
1821 
1822             log_info("LE Device Lookup: calculate AH");
1823             log_info_key("IRK", irk);
1824 
1825             sm_key_t r_prime;
1826             sm_ah_r_prime(sm_address_resolution_address, r_prime);
1827             sm_address_resolution_ah_calculation_active = 1;
1828             sm_aes128_start(irk, r_prime, sm_address_resolution_context);   // keep context
1829             return;
1830         }
1831 
1832         if (sm_address_resolution_test >= le_device_db_count()){
1833             log_info("LE Device Lookup: not found");
1834             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_FAILED);
1835         }
1836     }
1837 
1838 
1839     //
1840     // active connection handling
1841     // -- use loop to handle next connection if lock on setup context is released
1842 
1843     while (1) {
1844 
1845         // Find connections that requires setup context and make active if no other is locked
1846         hci_connections_get_iterator(&it);
1847         while(!sm_active_connection && btstack_linked_list_iterator_has_next(&it)){
1848             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1849             sm_connection_t  * sm_connection = &hci_connection->sm_connection;
1850             // - if no connection locked and we're ready/waiting for setup context, fetch it and start
1851             int done = 1;
1852             int err;
1853             switch (sm_connection->sm_engine_state) {
1854                 case SM_RESPONDER_SEND_SECURITY_REQUEST:
1855                     // send packet if possible,
1856                     if (l2cap_can_send_fixed_channel_packet_now(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)){
1857                         const uint8_t buffer[2] = { SM_CODE_SECURITY_REQUEST, SM_AUTHREQ_BONDING};
1858                         sm_connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_REQUEST;
1859                         l2cap_send_connectionless(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
1860                     } else {
1861                         l2cap_request_can_send_fix_channel_now_event(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
1862                     }
1863                     // don't lock sxetup context yet
1864                     done = 0;
1865                     break;
1866                 case SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED:
1867                     sm_init_setup(sm_connection);
1868                     // recover pairing request
1869                     memcpy(&setup->sm_m_preq, &sm_connection->sm_m_preq, sizeof(sm_pairing_packet_t));
1870                     err = sm_stk_generation_init(sm_connection);
1871                     if (err){
1872                         setup->sm_pairing_failed_reason = err;
1873                         sm_connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1874                         break;
1875                     }
1876                     sm_timeout_start(sm_connection);
1877                     // generate random number first, if we need to show passkey
1878                     if (setup->sm_stk_generation_method == PK_INIT_INPUT){
1879                         sm_connection->sm_engine_state = SM_PH2_GET_RANDOM_TK;
1880                         break;
1881                     }
1882                     sm_connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
1883                     break;
1884                 case SM_INITIATOR_PH0_HAS_LTK:
1885                     sm_load_security_info(sm_connection);
1886                     sm_connection->sm_engine_state = SM_INITIATOR_PH0_SEND_START_ENCRYPTION;
1887                     break;
1888                 case SM_RESPONDER_PH0_RECEIVED_LTK:
1889                     switch (sm_connection->sm_irk_lookup_state){
1890                         case IRK_LOOKUP_SUCCEEDED:{
1891                                 sm_load_security_info(sm_connection);
1892                                 sm_connection->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
1893                                 break;
1894                             }
1895                         case IRK_LOOKUP_FAILED:
1896                             // assume that we don't have a LTK for ediv == 0 and random == null
1897                             if (sm_connection->sm_local_ediv == 0 && sm_is_null_random(sm_connection->sm_local_rand)){
1898                                 log_info("LTK Request: ediv & random are empty");
1899                                 sm_connection->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
1900                                 // TODO: no need to lock context yet -> done = 0;
1901                                 break;
1902                             }
1903                             // re-establish previously used LTK using Rand and EDIV
1904                             memcpy(setup->sm_local_rand, sm_connection->sm_local_rand, 8);
1905                             setup->sm_local_ediv = sm_connection->sm_local_ediv;
1906                             // re-establish used key encryption size
1907                             // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
1908                             sm_connection->sm_actual_encryption_key_size = (setup->sm_local_rand[7] & 0x0f) + 1;
1909                             // no db for authenticated flag hack: flag is stored in bit 4 of LSB
1910                             sm_connection->sm_connection_authenticated = (setup->sm_local_rand[7] & 0x10) >> 4;
1911                             log_info("sm: received ltk request with key size %u, authenticated %u",
1912                                     sm_connection->sm_actual_encryption_key_size, sm_connection->sm_connection_authenticated);
1913                             sm_connection->sm_engine_state = SM_RESPONDER_PH4_Y_GET_ENC;
1914                             break;
1915                         default:
1916                             // just wait until IRK lookup is completed
1917                             // don't lock sxetup context yet
1918                             done = 0;
1919                             break;
1920                     }
1921                     break;
1922                 case SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST:
1923                     sm_init_setup(sm_connection);
1924                     sm_timeout_start(sm_connection);
1925                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_SEND_PAIRING_REQUEST;
1926                     break;
1927                 default:
1928                     done = 0;
1929                     break;
1930             }
1931             if (done){
1932                 sm_active_connection = sm_connection->sm_handle;
1933                 log_info("sm: connection 0x%04x locked setup context as %s", sm_active_connection, sm_connection->sm_role ? "responder" : "initiator");
1934             }
1935         }
1936 
1937         //
1938         // active connection handling
1939         //
1940 
1941         if (sm_active_connection == 0) return;
1942 
1943         // assert that we could send a SM PDU - not needed for all of the following
1944         if (!l2cap_can_send_fixed_channel_packet_now(sm_active_connection, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)) {
1945             l2cap_request_can_send_fix_channel_now_event(sm_active_connection, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
1946             return;
1947         }
1948 
1949         sm_connection_t * connection = sm_get_connection_for_handle(sm_active_connection);
1950         if (!connection) return;
1951 
1952         sm_key_t plaintext;
1953         int key_distribution_flags;
1954 
1955         log_info("sm_run: state %u", connection->sm_engine_state);
1956 
1957         // responding state
1958         switch (connection->sm_engine_state){
1959 
1960             // general
1961             case SM_GENERAL_SEND_PAIRING_FAILED: {
1962                 uint8_t buffer[2];
1963                 buffer[0] = SM_CODE_PAIRING_FAILED;
1964                 buffer[1] = setup->sm_pairing_failed_reason;
1965                 connection->sm_engine_state = connection->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
1966                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
1967                 sm_done_for_handle(connection->sm_handle);
1968                 break;
1969             }
1970 
1971 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1972             case SM_SC_W2_GET_RANDOM_A:
1973                 sm_random_start(connection);
1974                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_A;
1975                 break;
1976             case SM_SC_W2_GET_RANDOM_B:
1977                 sm_random_start(connection);
1978                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_B;
1979                 break;
1980             case SM_SC_W2_CMAC_FOR_CONFIRMATION:
1981                 if (!sm_cmac_ready()) break;
1982                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CONFIRMATION;
1983                 sm_sc_calculate_local_confirm(connection);
1984                 break;
1985             case SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION:
1986                 if (!sm_cmac_ready()) break;
1987                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION;
1988                 sm_sc_calculate_remote_confirm(connection);
1989                 break;
1990             case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
1991                 if (!sm_cmac_ready()) break;
1992                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK;
1993                 sm_sc_calculate_f6_for_dhkey_check(connection);
1994                 break;
1995             case SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
1996                 if (!sm_cmac_ready()) break;
1997                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
1998                 sm_sc_calculate_f6_to_verify_dhkey_check(connection);
1999                 break;
2000             case SM_SC_W2_CALCULATE_F5_SALT:
2001                 if (!sm_cmac_ready()) break;
2002                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_SALT;
2003                 f5_calculate_salt(connection);
2004                 break;
2005             case SM_SC_W2_CALCULATE_F5_MACKEY:
2006                 if (!sm_cmac_ready()) break;
2007                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_MACKEY;
2008                 f5_calculate_mackey(connection);
2009                 break;
2010             case SM_SC_W2_CALCULATE_F5_LTK:
2011                 if (!sm_cmac_ready()) break;
2012                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_LTK;
2013                 f5_calculate_ltk(connection);
2014                 break;
2015             case SM_SC_W2_CALCULATE_G2:
2016                 if (!sm_cmac_ready()) break;
2017                 connection->sm_engine_state = SM_SC_W4_CALCULATE_G2;
2018                 g2_calculate(connection);
2019                 break;
2020 
2021 #endif
2022             // initiator side
2023             case SM_INITIATOR_PH0_SEND_START_ENCRYPTION: {
2024                 sm_key_t peer_ltk_flipped;
2025                 reverse_128(setup->sm_peer_ltk, peer_ltk_flipped);
2026                 connection->sm_engine_state = SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED;
2027                 log_info("sm: hci_le_start_encryption ediv 0x%04x", setup->sm_peer_ediv);
2028                 uint32_t rand_high = big_endian_read_32(setup->sm_peer_rand, 0);
2029                 uint32_t rand_low  = big_endian_read_32(setup->sm_peer_rand, 4);
2030                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle,rand_low, rand_high, setup->sm_peer_ediv, peer_ltk_flipped);
2031                 return;
2032             }
2033 
2034             case SM_INITIATOR_PH1_SEND_PAIRING_REQUEST:
2035                 sm_pairing_packet_set_code(setup->sm_m_preq, SM_CODE_PAIRING_REQUEST);
2036                 connection->sm_engine_state = SM_INITIATOR_PH1_W4_PAIRING_RESPONSE;
2037                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_m_preq, sizeof(sm_pairing_packet_t));
2038                 sm_timeout_reset(connection);
2039                 break;
2040 
2041             // responder side
2042             case SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY:
2043                 connection->sm_engine_state = SM_RESPONDER_IDLE;
2044                 hci_send_cmd(&hci_le_long_term_key_negative_reply, connection->sm_handle);
2045                 sm_done_for_handle(connection->sm_handle);
2046                 return;
2047 
2048 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2049             case SM_SC_SEND_PUBLIC_KEY_COMMAND: {
2050                 uint8_t buffer[65];
2051                 buffer[0] = SM_CODE_PAIRING_PUBLIC_KEY;
2052                 //
2053 #ifdef USE_MBEDTLS_FOR_ECDH
2054                 uint8_t value[32];
2055                 mbedtls_mpi_write_binary(&le_keypair.Q.X, value, sizeof(value));
2056                 reverse_256(value, &buffer[1]);
2057                 mbedtls_mpi_write_binary(&le_keypair.Q.Y, value, sizeof(value));
2058                 reverse_256(value, &buffer[33]);
2059 #endif
2060 
2061                 // stk generation method
2062                 // passkey entry: notify app to show passkey or to request passkey
2063                 switch (setup->sm_stk_generation_method){
2064                     case JUST_WORKS:
2065                     case NK_BOTH_INPUT:
2066                         if (connection->sm_role){
2067                             // responder
2068                             sm_sc_start_calculating_local_confirm(connection);
2069                         } else {
2070                             // initiator
2071                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2072                         }
2073                         break;
2074                     case PK_INIT_INPUT:
2075                     case PK_RESP_INPUT:
2076                     case OK_BOTH_INPUT:
2077                         // use random TK for display
2078                         memcpy(setup->sm_ra, setup->sm_tk, 16);
2079                         memcpy(setup->sm_rb, setup->sm_tk, 16);
2080                         setup->sm_passkey_bit = 0;
2081 
2082                         if (connection->sm_role){
2083                             // responder
2084                             connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2085                         } else {
2086                             // initiator
2087                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2088                         }
2089                         sm_trigger_user_response(connection);
2090                         break;
2091                     case OOB:
2092                         // TODO: implement SC OOB
2093                         break;
2094                 }
2095 
2096                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2097                 sm_timeout_reset(connection);
2098                 break;
2099             }
2100             case SM_SC_SEND_CONFIRMATION: {
2101                 uint8_t buffer[17];
2102                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2103                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2104                 if (connection->sm_role){
2105                     connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2106                 } else {
2107                     connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2108                 }
2109                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2110                 sm_timeout_reset(connection);
2111                 break;
2112             }
2113             case SM_SC_SEND_PAIRING_RANDOM: {
2114                 uint8_t buffer[17];
2115                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2116                 reverse_128(setup->sm_local_nonce, &buffer[1]);
2117                 if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT && setup->sm_passkey_bit < 20){
2118                     if (connection->sm_role){
2119                         // responder
2120                         connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2121                     } else {
2122                         // initiator
2123                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2124                     }
2125                 } else {
2126                     if (connection->sm_role){
2127                         // responder
2128                         if (setup->sm_stk_generation_method == NK_BOTH_INPUT){
2129                             connection->sm_engine_state = SM_SC_W2_CALCULATE_G2;
2130                         } else {
2131                             sm_sc_prepare_dhkey_check(connection);
2132                         }
2133                     } else {
2134                         // initiator
2135                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2136                     }
2137                 }
2138                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2139                 sm_timeout_reset(connection);
2140                 break;
2141             }
2142             case SM_SC_SEND_DHKEY_CHECK_COMMAND: {
2143                 uint8_t buffer[17];
2144                 buffer[0] = SM_CODE_PAIRING_DHKEY_CHECK;
2145                 reverse_128(setup->sm_local_dhkey_check, &buffer[1]);
2146 
2147                 if (connection->sm_role){
2148                     connection->sm_engine_state = SM_SC_W4_LTK_REQUEST_SC;
2149                 } else {
2150                     connection->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
2151                 }
2152 
2153                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2154                 sm_timeout_reset(connection);
2155                 break;
2156             }
2157 
2158 #endif
2159             case SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE:
2160                 // echo initiator for now
2161                 sm_pairing_packet_set_code(setup->sm_s_pres,SM_CODE_PAIRING_RESPONSE);
2162                 key_distribution_flags = sm_key_distribution_flags_for_auth_req();
2163 
2164                 connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_CONFIRM;
2165 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2166                 if (setup->sm_use_secure_connections){
2167                     connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2168                     // skip LTK/EDIV for SC
2169                     log_info("sm: dropping encryption information flag");
2170                     key_distribution_flags &= ~SM_KEYDIST_ENC_KEY;
2171                 }
2172 #endif
2173                 sm_pairing_packet_set_initiator_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_initiator_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2174                 sm_pairing_packet_set_responder_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2175                 // update key distribution after ENC was dropped
2176                 sm_setup_key_distribution(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
2177 
2178                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_s_pres, sizeof(sm_pairing_packet_t));
2179                 sm_timeout_reset(connection);
2180                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
2181                 if (setup->sm_stk_generation_method == JUST_WORKS){
2182                     sm_trigger_user_response(connection);
2183                 }
2184                 return;
2185 
2186             case SM_PH2_SEND_PAIRING_RANDOM: {
2187                 uint8_t buffer[17];
2188                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2189                 reverse_128(setup->sm_local_random, &buffer[1]);
2190                 if (connection->sm_role){
2191                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_LTK_REQUEST;
2192                 } else {
2193                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_RANDOM;
2194                 }
2195                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2196                 sm_timeout_reset(connection);
2197                 break;
2198             }
2199 
2200             case SM_PH2_GET_RANDOM_TK:
2201             case SM_PH2_C1_GET_RANDOM_A:
2202             case SM_PH2_C1_GET_RANDOM_B:
2203             case SM_PH3_GET_RANDOM:
2204             case SM_PH3_GET_DIV:
2205                 sm_next_responding_state(connection);
2206                 sm_random_start(connection);
2207                 return;
2208 
2209             case SM_PH2_C1_GET_ENC_B:
2210             case SM_PH2_C1_GET_ENC_D:
2211                 // already busy?
2212                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2213                 sm_next_responding_state(connection);
2214                 sm_aes128_start(setup->sm_tk, setup->sm_c1_t3_value, connection);
2215                 return;
2216 
2217             case SM_PH3_LTK_GET_ENC:
2218             case SM_RESPONDER_PH4_LTK_GET_ENC:
2219                 // already busy?
2220                 if (sm_aes128_state == SM_AES128_IDLE) {
2221                     sm_key_t d_prime;
2222                     sm_d1_d_prime(setup->sm_local_div, 0, d_prime);
2223                     sm_next_responding_state(connection);
2224                     sm_aes128_start(sm_persistent_er, d_prime, connection);
2225                     return;
2226                 }
2227                 break;
2228 
2229             case SM_PH3_CSRK_GET_ENC:
2230                 // already busy?
2231                 if (sm_aes128_state == SM_AES128_IDLE) {
2232                     sm_key_t d_prime;
2233                     sm_d1_d_prime(setup->sm_local_div, 1, d_prime);
2234                     sm_next_responding_state(connection);
2235                     sm_aes128_start(sm_persistent_er, d_prime, connection);
2236                     return;
2237                 }
2238                 break;
2239 
2240             case SM_PH2_C1_GET_ENC_C:
2241                 // already busy?
2242                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2243                 // calculate m_confirm using aes128 engine - step 1
2244                 sm_c1_t1(setup->sm_peer_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
2245                 sm_next_responding_state(connection);
2246                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2247                 break;
2248             case SM_PH2_C1_GET_ENC_A:
2249                 // already busy?
2250                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2251                 // calculate confirm using aes128 engine - step 1
2252                 sm_c1_t1(setup->sm_local_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
2253                 sm_next_responding_state(connection);
2254                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2255                 break;
2256             case SM_PH2_CALC_STK:
2257                 // already busy?
2258                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2259                 // calculate STK
2260                 if (connection->sm_role){
2261                     sm_s1_r_prime(setup->sm_local_random, setup->sm_peer_random, plaintext);
2262                 } else {
2263                     sm_s1_r_prime(setup->sm_peer_random, setup->sm_local_random, plaintext);
2264                 }
2265                 sm_next_responding_state(connection);
2266                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2267                 break;
2268             case SM_PH3_Y_GET_ENC:
2269                 // already busy?
2270                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2271                 // PH3B2 - calculate Y from      - enc
2272                 // Y = dm(DHK, Rand)
2273                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
2274                 sm_next_responding_state(connection);
2275                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
2276                 return;
2277             case SM_PH2_C1_SEND_PAIRING_CONFIRM: {
2278                 uint8_t buffer[17];
2279                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2280                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2281                 if (connection->sm_role){
2282                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_PAIRING_RANDOM;
2283                 } else {
2284                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_CONFIRM;
2285                 }
2286                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2287                 sm_timeout_reset(connection);
2288                 return;
2289             }
2290             case SM_RESPONDER_PH2_SEND_LTK_REPLY: {
2291                 sm_key_t stk_flipped;
2292                 reverse_128(setup->sm_ltk, stk_flipped);
2293                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2294                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, stk_flipped);
2295                 return;
2296             }
2297             case SM_INITIATOR_PH3_SEND_START_ENCRYPTION: {
2298                 sm_key_t stk_flipped;
2299                 reverse_128(setup->sm_ltk, stk_flipped);
2300                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2301                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle, 0, 0, 0, stk_flipped);
2302                 return;
2303             }
2304             case SM_RESPONDER_PH4_SEND_LTK: {
2305                 sm_key_t ltk_flipped;
2306                 reverse_128(setup->sm_ltk, ltk_flipped);
2307                 connection->sm_engine_state = SM_RESPONDER_IDLE;
2308                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, ltk_flipped);
2309                 return;
2310             }
2311             case SM_RESPONDER_PH4_Y_GET_ENC:
2312                 // already busy?
2313                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2314                 log_info("LTK Request: recalculating with ediv 0x%04x", setup->sm_local_ediv);
2315                 // Y = dm(DHK, Rand)
2316                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
2317                 sm_next_responding_state(connection);
2318                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
2319                 return;
2320 
2321             case SM_PH3_DISTRIBUTE_KEYS:
2322                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION){
2323                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
2324                     uint8_t buffer[17];
2325                     buffer[0] = SM_CODE_ENCRYPTION_INFORMATION;
2326                     reverse_128(setup->sm_ltk, &buffer[1]);
2327                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2328                     sm_timeout_reset(connection);
2329                     return;
2330                 }
2331                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_MASTER_IDENTIFICATION){
2332                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
2333                     uint8_t buffer[11];
2334                     buffer[0] = SM_CODE_MASTER_IDENTIFICATION;
2335                     little_endian_store_16(buffer, 1, setup->sm_local_ediv);
2336                     reverse_64(setup->sm_local_rand, &buffer[3]);
2337                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2338                     sm_timeout_reset(connection);
2339                     return;
2340                 }
2341                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
2342                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
2343                     uint8_t buffer[17];
2344                     buffer[0] = SM_CODE_IDENTITY_INFORMATION;
2345                     reverse_128(sm_persistent_irk, &buffer[1]);
2346                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2347                     sm_timeout_reset(connection);
2348                     return;
2349                 }
2350                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION){
2351                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
2352                     bd_addr_t local_address;
2353                     uint8_t buffer[8];
2354                     buffer[0] = SM_CODE_IDENTITY_ADDRESS_INFORMATION;
2355                     gap_advertisements_get_address(&buffer[1], local_address);
2356                     reverse_bd_addr(local_address, &buffer[2]);
2357                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2358                     sm_timeout_reset(connection);
2359                     return;
2360                 }
2361                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
2362                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
2363 
2364                     // hack to reproduce test runs
2365                     if (test_use_fixed_local_csrk){
2366                         memset(setup->sm_local_csrk, 0xcc, 16);
2367                     }
2368 
2369                     uint8_t buffer[17];
2370                     buffer[0] = SM_CODE_SIGNING_INFORMATION;
2371                     reverse_128(setup->sm_local_csrk, &buffer[1]);
2372                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2373                     sm_timeout_reset(connection);
2374                     return;
2375                 }
2376 
2377                 // keys are sent
2378                 if (connection->sm_role){
2379                     // slave -> receive master keys if any
2380                     if (sm_key_distribution_all_received(connection)){
2381                         sm_key_distribution_handle_all_received(connection);
2382                         connection->sm_engine_state = SM_RESPONDER_IDLE;
2383                         sm_done_for_handle(connection->sm_handle);
2384                     } else {
2385                         connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2386                     }
2387                 } else {
2388                     // master -> all done
2389                     connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2390                     sm_done_for_handle(connection->sm_handle);
2391                 }
2392                 break;
2393 
2394             default:
2395                 break;
2396         }
2397 
2398         // check again if active connection was released
2399         if (sm_active_connection) break;
2400     }
2401 }
2402 
2403 // note: aes engine is ready as we just got the aes result
2404 static void sm_handle_encryption_result(uint8_t * data){
2405 
2406     sm_aes128_state = SM_AES128_IDLE;
2407 
2408     if (sm_address_resolution_ah_calculation_active){
2409         sm_address_resolution_ah_calculation_active = 0;
2410         // compare calulated address against connecting device
2411         uint8_t hash[3];
2412         reverse_24(data, hash);
2413         if (memcmp(&sm_address_resolution_address[3], hash, 3) == 0){
2414             log_info("LE Device Lookup: matched resolvable private address");
2415             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
2416             return;
2417         }
2418         // no match, try next
2419         sm_address_resolution_test++;
2420         return;
2421     }
2422 
2423     switch (dkg_state){
2424         case DKG_W4_IRK:
2425             reverse_128(data, sm_persistent_irk);
2426             log_info_key("irk", sm_persistent_irk);
2427             dkg_next_state();
2428             return;
2429         case DKG_W4_DHK:
2430             reverse_128(data, sm_persistent_dhk);
2431             log_info_key("dhk", sm_persistent_dhk);
2432             dkg_next_state();
2433             // SM Init Finished
2434             return;
2435         default:
2436             break;
2437     }
2438 
2439     switch (rau_state){
2440         case RAU_W4_ENC:
2441             reverse_24(data, &sm_random_address[3]);
2442             rau_next_state();
2443             return;
2444         default:
2445             break;
2446     }
2447 
2448     switch (sm_cmac_state){
2449         case CMAC_W4_SUBKEYS:
2450         case CMAC_W4_MI:
2451         case CMAC_W4_MLAST:
2452             {
2453             sm_key_t t;
2454             reverse_128(data, t);
2455             sm_cmac_handle_encryption_result(t);
2456             }
2457             return;
2458         default:
2459             break;
2460     }
2461 
2462     // retrieve sm_connection provided to sm_aes128_start_encryption
2463     sm_connection_t * connection = (sm_connection_t*) sm_aes128_context;
2464     if (!connection) return;
2465     switch (connection->sm_engine_state){
2466         case SM_PH2_C1_W4_ENC_A:
2467         case SM_PH2_C1_W4_ENC_C:
2468             {
2469             sm_key_t t2;
2470             reverse_128(data, t2);
2471             sm_c1_t3(t2, setup->sm_m_address, setup->sm_s_address, setup->sm_c1_t3_value);
2472             }
2473             sm_next_responding_state(connection);
2474             return;
2475         case SM_PH2_C1_W4_ENC_B:
2476             reverse_128(data, setup->sm_local_confirm);
2477             log_info_key("c1!", setup->sm_local_confirm);
2478             connection->sm_engine_state = SM_PH2_C1_SEND_PAIRING_CONFIRM;
2479             return;
2480         case SM_PH2_C1_W4_ENC_D:
2481             {
2482             sm_key_t peer_confirm_test;
2483             reverse_128(data, peer_confirm_test);
2484             log_info_key("c1!", peer_confirm_test);
2485             if (memcmp(setup->sm_peer_confirm, peer_confirm_test, 16) != 0){
2486                 setup->sm_pairing_failed_reason = SM_REASON_CONFIRM_VALUE_FAILED;
2487                 connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
2488                 return;
2489             }
2490             if (connection->sm_role){
2491                 connection->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
2492             } else {
2493                 connection->sm_engine_state = SM_PH2_CALC_STK;
2494             }
2495             }
2496             return;
2497         case SM_PH2_W4_STK:
2498             reverse_128(data, setup->sm_ltk);
2499             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2500             log_info_key("stk", setup->sm_ltk);
2501             if (connection->sm_role){
2502                 connection->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2503             } else {
2504                 connection->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
2505             }
2506             return;
2507         case SM_PH3_Y_W4_ENC:{
2508             sm_key_t y128;
2509             reverse_128(data, y128);
2510             setup->sm_local_y = big_endian_read_16(y128, 14);
2511             log_info_hex16("y", setup->sm_local_y);
2512             // PH3B3 - calculate EDIV
2513             setup->sm_local_ediv = setup->sm_local_y ^ setup->sm_local_div;
2514             log_info_hex16("ediv", setup->sm_local_ediv);
2515             // PH3B4 - calculate LTK         - enc
2516             // LTK = d1(ER, DIV, 0))
2517             connection->sm_engine_state = SM_PH3_LTK_GET_ENC;
2518             return;
2519         }
2520         case SM_RESPONDER_PH4_Y_W4_ENC:{
2521             sm_key_t y128;
2522             reverse_128(data, y128);
2523             setup->sm_local_y = big_endian_read_16(y128, 14);
2524             log_info_hex16("y", setup->sm_local_y);
2525 
2526             // PH3B3 - calculate DIV
2527             setup->sm_local_div = setup->sm_local_y ^ setup->sm_local_ediv;
2528             log_info_hex16("ediv", setup->sm_local_ediv);
2529             // PH3B4 - calculate LTK         - enc
2530             // LTK = d1(ER, DIV, 0))
2531             connection->sm_engine_state = SM_RESPONDER_PH4_LTK_GET_ENC;
2532             return;
2533         }
2534         case SM_PH3_LTK_W4_ENC:
2535             reverse_128(data, setup->sm_ltk);
2536             log_info_key("ltk", setup->sm_ltk);
2537             // calc CSRK next
2538             connection->sm_engine_state = SM_PH3_CSRK_GET_ENC;
2539             return;
2540         case SM_PH3_CSRK_W4_ENC:
2541             reverse_128(data, setup->sm_local_csrk);
2542             log_info_key("csrk", setup->sm_local_csrk);
2543             if (setup->sm_key_distribution_send_set){
2544                 connection->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
2545             } else {
2546                 // no keys to send, just continue
2547                 if (connection->sm_role){
2548                     // slave -> receive master keys
2549                     connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2550                 } else {
2551                     // master -> all done
2552                     connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2553                     sm_done_for_handle(connection->sm_handle);
2554                 }
2555             }
2556             return;
2557         case SM_RESPONDER_PH4_LTK_W4_ENC:
2558             reverse_128(data, setup->sm_ltk);
2559             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2560             log_info_key("ltk", setup->sm_ltk);
2561             connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK;
2562             return;
2563         default:
2564             break;
2565     }
2566 }
2567 
2568 #ifdef USE_MBEDTLS_FOR_ECDH
2569 
2570 static void sm_log_ec_keypair(void){
2571     // print keypair
2572     char buffer[100];
2573     size_t len;
2574     mbedtls_mpi_write_string( &le_keypair.d, 16, buffer, sizeof(buffer), &len);
2575     log_info("d: %s", buffer);
2576     mbedtls_mpi_write_string( &le_keypair.Q.X, 16, buffer, sizeof(buffer), &len);
2577     log_info("X: %s", buffer);
2578     mbedtls_mpi_write_string( &le_keypair.Q.Y, 16, buffer, sizeof(buffer), &len);
2579     log_info("Y: %s", buffer);
2580 }
2581 
2582 static int sm_generate_f_rng(void * context, unsigned char * buffer, size_t size){
2583     int offset = setup->sm_passkey_bit;
2584     log_info("sm_generate_f_rng: size %u - offset %u", (int) size, offset);
2585     while (size) {
2586         if (offset < 32){
2587             *buffer++ = setup->sm_peer_qx[offset++];
2588         } else {
2589             *buffer++ = setup->sm_peer_qx[offset++ - 32];
2590         }
2591         size--;
2592     }
2593     setup->sm_passkey_bit = offset;
2594     return 0;
2595 }
2596 #endif
2597 
2598 // note: random generator is ready. this doesn NOT imply that aes engine is unused!
2599 static void sm_handle_random_result(uint8_t * data){
2600 
2601 #ifdef USE_MBEDTLS_FOR_ECDH
2602     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
2603         int num_bytes = setup->sm_passkey_bit;
2604         if (num_bytes < 32){
2605             memcpy(&setup->sm_peer_qx[num_bytes], data, 8);
2606         } else {
2607             memcpy(&setup->sm_peer_qx[num_bytes-32], data, 8);
2608         }
2609         num_bytes += 8;
2610         setup->sm_passkey_bit = num_bytes;
2611 
2612         if (num_bytes >= 64){
2613             // generate EC key
2614             setup->sm_passkey_bit = 0;
2615             mbedtls_ecp_gen_key(MBEDTLS_ECP_DP_SECP256R1, &le_keypair, &sm_generate_f_rng, NULL);
2616             sm_log_ec_keypair();
2617             ec_key_generation_state = EC_KEY_GENERATION_DONE;
2618         }
2619     }
2620 #endif
2621 
2622     switch (rau_state){
2623         case RAU_W4_RANDOM:
2624             // non-resolvable vs. resolvable
2625             switch (gap_random_adress_type){
2626                 case GAP_RANDOM_ADDRESS_RESOLVABLE:
2627                     // resolvable: use random as prand and calc address hash
2628                     // "The two most significant bits of prand shall be equal to ‘0’ and ‘1"
2629                     memcpy(sm_random_address, data, 3);
2630                     sm_random_address[0] &= 0x3f;
2631                     sm_random_address[0] |= 0x40;
2632                     rau_state = RAU_GET_ENC;
2633                     break;
2634                 case GAP_RANDOM_ADDRESS_NON_RESOLVABLE:
2635                 default:
2636                     // "The two most significant bits of the address shall be equal to ‘0’""
2637                     memcpy(sm_random_address, data, 6);
2638                     sm_random_address[0] &= 0x3f;
2639                     rau_state = RAU_SET_ADDRESS;
2640                     break;
2641             }
2642             return;
2643         default:
2644             break;
2645     }
2646 
2647     // retrieve sm_connection provided to sm_random_start
2648     sm_connection_t * connection = (sm_connection_t *) sm_random_context;
2649     if (!connection) return;
2650     switch (connection->sm_engine_state){
2651 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2652         case SM_SC_W4_GET_RANDOM_A:
2653             memcpy(&setup->sm_local_nonce[0], data, 8);
2654             connection->sm_engine_state = SM_SC_W2_GET_RANDOM_B;
2655             break;
2656         case SM_SC_W4_GET_RANDOM_B:
2657             memcpy(&setup->sm_local_nonce[8], data, 8);
2658             // initiator & jw/nc -> send pairing random
2659             if (connection->sm_role == 0 && sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
2660                 connection->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
2661                 break;
2662             } else {
2663                 connection->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
2664             }
2665             break;
2666 #endif
2667 
2668         case SM_PH2_W4_RANDOM_TK:
2669         {
2670             // map random to 0-999999 without speding much cycles on a modulus operation
2671             uint32_t tk = little_endian_read_32(data,0);
2672             tk = tk & 0xfffff;  // 1048575
2673             if (tk >= 999999){
2674                 tk = tk - 999999;
2675             }
2676             sm_reset_tk();
2677             big_endian_store_32(setup->sm_tk, 12, tk);
2678             if (connection->sm_role){
2679                 connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
2680             } else {
2681                 connection->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
2682                 sm_trigger_user_response(connection);
2683                 // response_idle == nothing <--> sm_trigger_user_response() did not require response
2684                 if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
2685                     connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
2686                 }
2687             }
2688             return;
2689         }
2690         case SM_PH2_C1_W4_RANDOM_A:
2691             memcpy(&setup->sm_local_random[0], data, 8); // random endinaness
2692             connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_B;
2693             return;
2694         case SM_PH2_C1_W4_RANDOM_B:
2695             memcpy(&setup->sm_local_random[8], data, 8); // random endinaness
2696             connection->sm_engine_state = SM_PH2_C1_GET_ENC_A;
2697             return;
2698         case SM_PH3_W4_RANDOM:
2699             reverse_64(data, setup->sm_local_rand);
2700             // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
2701             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xf0) + (connection->sm_actual_encryption_key_size - 1);
2702             // no db for authenticated flag hack: store flag in bit 4 of LSB
2703             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xef) + (connection->sm_connection_authenticated << 4);
2704             connection->sm_engine_state = SM_PH3_GET_DIV;
2705             return;
2706         case SM_PH3_W4_DIV:
2707             // use 16 bit from random value as div
2708             setup->sm_local_div = big_endian_read_16(data, 0);
2709             log_info_hex16("div", setup->sm_local_div);
2710             connection->sm_engine_state = SM_PH3_Y_GET_ENC;
2711             return;
2712         default:
2713             break;
2714     }
2715 }
2716 
2717 static void sm_event_packet_handler (uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
2718 
2719     sm_connection_t  * sm_conn;
2720     hci_con_handle_t con_handle;
2721 
2722     switch (packet_type) {
2723 
2724 		case HCI_EVENT_PACKET:
2725 			switch (hci_event_packet_get_type(packet)) {
2726 
2727                 case BTSTACK_EVENT_STATE:
2728 					// bt stack activated, get started
2729 					if (btstack_event_state_get_state(packet) == HCI_STATE_WORKING){
2730                         log_info("HCI Working!");
2731                         dkg_state = sm_persistent_irk_ready ? DKG_CALC_DHK : DKG_CALC_IRK;
2732                         rau_state = RAU_IDLE;
2733 #ifdef USE_MBEDTLS_FOR_ECDH
2734                         if (!test_use_fixed_ec_keypair){
2735                             setup->sm_passkey_bit = 0;
2736                             ec_key_generation_state = EC_KEY_GENERATION_ACTIVE;
2737                         }
2738 #endif
2739                         sm_run();
2740 					}
2741 					break;
2742 
2743                 case HCI_EVENT_LE_META:
2744                     switch (packet[2]) {
2745                         case HCI_SUBEVENT_LE_CONNECTION_COMPLETE:
2746 
2747                             log_info("sm: connected");
2748 
2749                             if (packet[3]) return; // connection failed
2750 
2751                             con_handle = little_endian_read_16(packet, 4);
2752                             sm_conn = sm_get_connection_for_handle(con_handle);
2753                             if (!sm_conn) break;
2754 
2755                             sm_conn->sm_handle = con_handle;
2756                             sm_conn->sm_role = packet[6];
2757                             sm_conn->sm_peer_addr_type = packet[7];
2758                             reverse_bd_addr(&packet[8],
2759                                             sm_conn->sm_peer_address);
2760 
2761                             log_info("New sm_conn, role %s", sm_conn->sm_role ? "slave" : "master");
2762 
2763                             // reset security properties
2764                             sm_conn->sm_connection_encrypted = 0;
2765                             sm_conn->sm_connection_authenticated = 0;
2766                             sm_conn->sm_connection_authorization_state = AUTHORIZATION_UNKNOWN;
2767                             sm_conn->sm_le_db_index = -1;
2768 
2769                             // prepare CSRK lookup (does not involve setup)
2770                             sm_conn->sm_irk_lookup_state = IRK_LOOKUP_W4_READY;
2771 
2772                             // just connected -> everything else happens in sm_run()
2773                             if (sm_conn->sm_role){
2774                                 // slave - state already could be SM_RESPONDER_SEND_SECURITY_REQUEST instead
2775                                 if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
2776                                     if (sm_slave_request_security) {
2777                                         // request security if requested by app
2778                                         sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
2779                                     } else {
2780                                         // otherwise, wait for pairing request
2781                                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
2782                                     }
2783                                 }
2784                                 break;
2785                             } else {
2786                                 // master
2787                                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2788                             }
2789                             break;
2790 
2791                         case HCI_SUBEVENT_LE_LONG_TERM_KEY_REQUEST:
2792                             con_handle = little_endian_read_16(packet, 3);
2793                             sm_conn = sm_get_connection_for_handle(con_handle);
2794                             if (!sm_conn) break;
2795 
2796                             log_info("LTK Request: state %u", sm_conn->sm_engine_state);
2797                             if (sm_conn->sm_engine_state == SM_RESPONDER_PH2_W4_LTK_REQUEST){
2798                                 sm_conn->sm_engine_state = SM_PH2_CALC_STK;
2799                                 break;
2800                             }
2801                             if (sm_conn->sm_engine_state == SM_SC_W4_LTK_REQUEST_SC){
2802                                 sm_conn->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2803                                 break;
2804                             }
2805 
2806                             // store rand and ediv
2807                             reverse_64(&packet[5], sm_conn->sm_local_rand);
2808                             sm_conn->sm_local_ediv   = little_endian_read_16(packet, 13);
2809                             sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK;
2810                             break;
2811 
2812                         default:
2813                             break;
2814                     }
2815                     break;
2816 
2817                 case HCI_EVENT_ENCRYPTION_CHANGE:
2818                     con_handle = little_endian_read_16(packet, 3);
2819                     sm_conn = sm_get_connection_for_handle(con_handle);
2820                     if (!sm_conn) break;
2821 
2822                     sm_conn->sm_connection_encrypted = packet[5];
2823                     log_info("Encryption state change: %u, key size %u", sm_conn->sm_connection_encrypted,
2824                         sm_conn->sm_actual_encryption_key_size);
2825                     log_info("event handler, state %u", sm_conn->sm_engine_state);
2826                     if (!sm_conn->sm_connection_encrypted) break;
2827                     // continue if part of initial pairing
2828                     switch (sm_conn->sm_engine_state){
2829                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
2830                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2831                             sm_done_for_handle(sm_conn->sm_handle);
2832                             break;
2833                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
2834                             if (sm_conn->sm_role){
2835                                 // slave
2836                                 if (setup->sm_use_secure_connections){
2837                                     sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
2838                                 } else {
2839                                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
2840                                 }
2841                             } else {
2842                                 // master
2843                                 if (sm_key_distribution_all_received(sm_conn)){
2844                                     // skip receiving keys as there are none
2845                                     sm_key_distribution_handle_all_received(sm_conn);
2846                                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
2847                                 } else {
2848                                     sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2849                                 }
2850                             }
2851                             break;
2852                         default:
2853                             break;
2854                     }
2855                     break;
2856 
2857                 case HCI_EVENT_ENCRYPTION_KEY_REFRESH_COMPLETE:
2858                     con_handle = little_endian_read_16(packet, 3);
2859                     sm_conn = sm_get_connection_for_handle(con_handle);
2860                     if (!sm_conn) break;
2861 
2862                     log_info("Encryption key refresh complete, key size %u", sm_conn->sm_actual_encryption_key_size);
2863                     log_info("event handler, state %u", sm_conn->sm_engine_state);
2864                     // continue if part of initial pairing
2865                     switch (sm_conn->sm_engine_state){
2866                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
2867                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2868                             sm_done_for_handle(sm_conn->sm_handle);
2869                             break;
2870                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
2871                             if (sm_conn->sm_role){
2872                                 // slave
2873                                 sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
2874                             } else {
2875                                 // master
2876                                 sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2877                             }
2878                             break;
2879                         default:
2880                             break;
2881                     }
2882                     break;
2883 
2884 
2885                 case HCI_EVENT_DISCONNECTION_COMPLETE:
2886                     con_handle = little_endian_read_16(packet, 3);
2887                     sm_done_for_handle(con_handle);
2888                     sm_conn = sm_get_connection_for_handle(con_handle);
2889                     if (!sm_conn) break;
2890 
2891                     // delete stored bonding on disconnect with authentication failure in ph0
2892                     if (sm_conn->sm_role == 0
2893                         && sm_conn->sm_engine_state == SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED
2894                         && packet[2] == ERROR_CODE_AUTHENTICATION_FAILURE){
2895                         le_device_db_remove(sm_conn->sm_le_db_index);
2896                     }
2897 
2898                     sm_conn->sm_engine_state = SM_GENERAL_IDLE;
2899                     sm_conn->sm_handle = 0;
2900                     break;
2901 
2902 				case HCI_EVENT_COMMAND_COMPLETE:
2903                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_encrypt)){
2904                         sm_handle_encryption_result(&packet[6]);
2905                         break;
2906                     }
2907                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_rand)){
2908                         sm_handle_random_result(&packet[6]);
2909                         break;
2910                     }
2911                     break;
2912                 default:
2913                     break;
2914 			}
2915             break;
2916         default:
2917             break;
2918 	}
2919 
2920     sm_run();
2921 }
2922 
2923 static inline int sm_calc_actual_encryption_key_size(int other){
2924     if (other < sm_min_encryption_key_size) return 0;
2925     if (other < sm_max_encryption_key_size) return other;
2926     return sm_max_encryption_key_size;
2927 }
2928 
2929 
2930 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method){
2931     switch (method){
2932         case JUST_WORKS:
2933         case NK_BOTH_INPUT:
2934             return 1;
2935         default:
2936             return 0;
2937     }
2938 }
2939 // responder
2940 
2941 static int sm_passkey_used(stk_generation_method_t method){
2942     switch (method){
2943         case PK_RESP_INPUT:
2944             return 1;
2945         default:
2946             return 0;
2947     }
2948 }
2949 
2950 /**
2951  * @return ok
2952  */
2953 static int sm_validate_stk_generation_method(void){
2954     // check if STK generation method is acceptable by client
2955     switch (setup->sm_stk_generation_method){
2956         case JUST_WORKS:
2957             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_JUST_WORKS) != 0;
2958         case PK_RESP_INPUT:
2959         case PK_INIT_INPUT:
2960         case OK_BOTH_INPUT:
2961             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_PASSKEY) != 0;
2962         case OOB:
2963             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_OOB) != 0;
2964         case NK_BOTH_INPUT:
2965             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON) != 0;
2966             return 1;
2967         default:
2968             return 0;
2969     }
2970 }
2971 
2972 static void sm_pdu_handler(uint8_t packet_type, hci_con_handle_t con_handle, uint8_t *packet, uint16_t size){
2973 
2974     if (packet_type == HCI_EVENT_PACKET && packet[0] == L2CAP_EVENT_CAN_SEND_NOW){
2975         sm_run();
2976     }
2977 
2978     if (packet_type != SM_DATA_PACKET) return;
2979 
2980     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
2981     if (!sm_conn) return;
2982 
2983     if (packet[0] == SM_CODE_PAIRING_FAILED){
2984         sm_conn->sm_engine_state = sm_conn->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
2985         return;
2986     }
2987 
2988     log_debug("sm_pdu_handler: state %u, pdu 0x%02x", sm_conn->sm_engine_state, packet[0]);
2989 
2990     int err;
2991 
2992     switch (sm_conn->sm_engine_state){
2993 
2994         // a sm timeout requries a new physical connection
2995         case SM_GENERAL_TIMEOUT:
2996             return;
2997 
2998         // Initiator
2999         case SM_INITIATOR_CONNECTED:
3000             if ((packet[0] != SM_CODE_SECURITY_REQUEST) || (sm_conn->sm_role)){
3001                 sm_pdu_received_in_wrong_state(sm_conn);
3002                 break;
3003             }
3004             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_FAILED){
3005                 sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3006                 break;
3007             }
3008             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_SUCCEEDED){
3009                 uint16_t ediv;
3010                 sm_key_t ltk;
3011                 le_device_db_encryption_get(sm_conn->sm_le_db_index, &ediv, NULL, ltk, NULL, NULL, NULL);
3012                 if (!sm_is_null_key(ltk) || ediv){
3013                     log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3014                     sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3015                 } else {
3016                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3017                 }
3018                 break;
3019             }
3020             // otherwise, store security request
3021             sm_conn->sm_security_request_received = 1;
3022             break;
3023 
3024         case SM_INITIATOR_PH1_W4_PAIRING_RESPONSE:
3025             if (packet[0] != SM_CODE_PAIRING_RESPONSE){
3026                 sm_pdu_received_in_wrong_state(sm_conn);
3027                 break;
3028             }
3029             // store pairing request
3030             memcpy(&setup->sm_s_pres, packet, sizeof(sm_pairing_packet_t));
3031             err = sm_stk_generation_init(sm_conn);
3032             if (err){
3033                 setup->sm_pairing_failed_reason = err;
3034                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3035                 break;
3036             }
3037 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3038             if (setup->sm_use_secure_connections){
3039                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
3040                 if (setup->sm_stk_generation_method == JUST_WORKS){
3041                     sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3042                     sm_trigger_user_response(sm_conn);
3043                     if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3044                         sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3045                     }
3046                 } else {
3047                     sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3048                 }
3049                 break;
3050             }
3051 #endif
3052             // generate random number first, if we need to show passkey
3053             if (setup->sm_stk_generation_method == PK_RESP_INPUT){
3054                 sm_conn->sm_engine_state = SM_PH2_GET_RANDOM_TK;
3055                 break;
3056             }
3057             sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3058             sm_trigger_user_response(sm_conn);
3059             // response_idle == nothing <--> sm_trigger_user_response() did not require response
3060             if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3061                 sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3062             }
3063             break;
3064 
3065         case SM_INITIATOR_PH2_W4_PAIRING_CONFIRM:
3066             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3067                 sm_pdu_received_in_wrong_state(sm_conn);
3068                 break;
3069             }
3070 
3071             // store s_confirm
3072             reverse_128(&packet[1], setup->sm_peer_confirm);
3073             sm_conn->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
3074             break;
3075 
3076         case SM_INITIATOR_PH2_W4_PAIRING_RANDOM:
3077             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3078                 sm_pdu_received_in_wrong_state(sm_conn);
3079                 break;;
3080             }
3081 
3082             // received random value
3083             reverse_128(&packet[1], setup->sm_peer_random);
3084             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3085             break;
3086 
3087         // Responder
3088         case SM_RESPONDER_IDLE:
3089         case SM_RESPONDER_SEND_SECURITY_REQUEST:
3090         case SM_RESPONDER_PH1_W4_PAIRING_REQUEST:
3091             if (packet[0] != SM_CODE_PAIRING_REQUEST){
3092                 sm_pdu_received_in_wrong_state(sm_conn);
3093                 break;;
3094             }
3095 
3096             // store pairing request
3097             memcpy(&sm_conn->sm_m_preq, packet, sizeof(sm_pairing_packet_t));
3098             sm_conn->sm_engine_state = SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED;
3099             break;
3100 
3101 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3102         case SM_SC_W4_PUBLIC_KEY_COMMAND:
3103             if (packet[0] != SM_CODE_PAIRING_PUBLIC_KEY){
3104                 sm_pdu_received_in_wrong_state(sm_conn);
3105                 break;
3106             }
3107 
3108             // store public key for DH Key calculation
3109             reverse_256(&packet[01], setup->sm_peer_qx);
3110             reverse_256(&packet[33], setup->sm_peer_qy);
3111 
3112 #ifdef USE_MBEDTLS_FOR_ECDH
3113             // validate public key
3114             mbedtls_ecp_group grp;
3115             mbedtls_ecp_group_init( &grp );
3116             mbedtls_ecp_group_load(&grp, MBEDTLS_ECP_DP_SECP256R1);
3117 
3118             mbedtls_ecp_point Q;
3119             mbedtls_ecp_point_init( &Q );
3120             mbedtls_mpi_read_binary(&Q.X, setup->sm_peer_qx, 32);
3121             mbedtls_mpi_read_binary(&Q.Y, setup->sm_peer_qy, 32);
3122             mbedtls_mpi_read_string(&Q.Z, 16, "1" );
3123             err = mbedtls_ecp_check_pubkey(&grp, &Q);
3124             if (err){
3125                 log_error("sm: peer public key invalid %x", err);
3126                 // uses "unspecified reason", there is no "public key invalid" error code
3127                 sm_pdu_received_in_wrong_state(sm_conn);
3128                 break;
3129             }
3130 #endif
3131             if (sm_conn->sm_role){
3132                 // responder
3133                 sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3134             } else {
3135                 // initiator
3136                 // stk generation method
3137                 // passkey entry: notify app to show passkey or to request passkey
3138                 switch (setup->sm_stk_generation_method){
3139                     case JUST_WORKS:
3140                     case NK_BOTH_INPUT:
3141                         sm_conn->sm_engine_state = SM_SC_W4_CONFIRMATION;
3142                         break;
3143                     case PK_RESP_INPUT:
3144                         sm_sc_start_calculating_local_confirm(sm_conn);
3145                         break;
3146                     case PK_INIT_INPUT:
3147                     case OK_BOTH_INPUT:
3148                         if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3149                             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3150                             break;
3151                         }
3152                         sm_sc_start_calculating_local_confirm(sm_conn);
3153                         break;
3154                     case OOB:
3155                         // TODO: implement SC OOB
3156                         break;
3157                 }
3158             }
3159             break;
3160 
3161         case SM_SC_W4_CONFIRMATION:
3162             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3163                 sm_pdu_received_in_wrong_state(sm_conn);
3164                 break;
3165             }
3166             // received confirm value
3167             reverse_128(&packet[1], setup->sm_peer_confirm);
3168 
3169             if (sm_conn->sm_role){
3170                 // responder
3171                 if (sm_passkey_used(setup->sm_stk_generation_method)){
3172                     if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3173                         // still waiting for passkey
3174                         sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3175                         break;
3176                     }
3177                 }
3178                 sm_sc_start_calculating_local_confirm(sm_conn);
3179             } else {
3180                 // initiator
3181                 if (sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
3182                     sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
3183                 } else {
3184                     sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
3185                 }
3186             }
3187             break;
3188 
3189         case SM_SC_W4_PAIRING_RANDOM:
3190             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3191                 sm_pdu_received_in_wrong_state(sm_conn);
3192                 break;
3193             }
3194 
3195             // received random value
3196             reverse_128(&packet[1], setup->sm_peer_nonce);
3197 
3198             // validate confirm value if Cb = f4(Pkb, Pka, Nb, z)
3199             // only check for JUST WORK/NC in initiator role AND passkey entry
3200             int passkey_entry = sm_passkey_used(setup->sm_stk_generation_method);
3201             if (sm_conn->sm_role || passkey_entry) {
3202                  sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION;
3203             }
3204 
3205             sm_sc_state_after_receiving_random(sm_conn);
3206             break;
3207 
3208         case SM_SC_W2_CALCULATE_G2:
3209         case SM_SC_W4_CALCULATE_G2:
3210         case SM_SC_W2_CALCULATE_F5_SALT:
3211         case SM_SC_W4_CALCULATE_F5_SALT:
3212         case SM_SC_W2_CALCULATE_F5_MACKEY:
3213         case SM_SC_W4_CALCULATE_F5_MACKEY:
3214         case SM_SC_W2_CALCULATE_F5_LTK:
3215         case SM_SC_W4_CALCULATE_F5_LTK:
3216         case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
3217         case SM_SC_W4_DHKEY_CHECK_COMMAND:
3218         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
3219             if (packet[0] != SM_CODE_PAIRING_DHKEY_CHECK){
3220                 sm_pdu_received_in_wrong_state(sm_conn);
3221                 break;
3222             }
3223             // store DHKey Check
3224             setup->sm_state_vars |= SM_STATE_VAR_DHKEY_COMMAND_RECEIVED;
3225             reverse_128(&packet[01], setup->sm_peer_dhkey_check);
3226 
3227             // have we been only waiting for dhkey check command?
3228             if (sm_conn->sm_engine_state == SM_SC_W4_DHKEY_CHECK_COMMAND){
3229                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
3230             }
3231             break;
3232 #endif
3233 
3234         case SM_RESPONDER_PH1_W4_PAIRING_CONFIRM:
3235             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3236                 sm_pdu_received_in_wrong_state(sm_conn);
3237                 break;
3238             }
3239 
3240             // received confirm value
3241             reverse_128(&packet[1], setup->sm_peer_confirm);
3242 
3243             // notify client to hide shown passkey
3244             if (setup->sm_stk_generation_method == PK_INIT_INPUT){
3245                 sm_notify_client_base(SM_EVENT_PASSKEY_DISPLAY_CANCEL, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
3246             }
3247 
3248             // handle user cancel pairing?
3249             if (setup->sm_user_response == SM_USER_RESPONSE_DECLINE){
3250                 setup->sm_pairing_failed_reason = SM_REASON_PASSKEYT_ENTRY_FAILED;
3251                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3252                 break;
3253             }
3254 
3255             // wait for user action?
3256             if (setup->sm_user_response == SM_USER_RESPONSE_PENDING){
3257                 sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3258                 break;
3259             }
3260 
3261             // calculate and send local_confirm
3262             sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3263             break;
3264 
3265         case SM_RESPONDER_PH2_W4_PAIRING_RANDOM:
3266             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3267                 sm_pdu_received_in_wrong_state(sm_conn);
3268                 break;;
3269             }
3270 
3271             // received random value
3272             reverse_128(&packet[1], setup->sm_peer_random);
3273             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3274             break;
3275 
3276         case SM_PH3_RECEIVE_KEYS:
3277             switch(packet[0]){
3278                 case SM_CODE_ENCRYPTION_INFORMATION:
3279                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
3280                     reverse_128(&packet[1], setup->sm_peer_ltk);
3281                     break;
3282 
3283                 case SM_CODE_MASTER_IDENTIFICATION:
3284                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
3285                     setup->sm_peer_ediv = little_endian_read_16(packet, 1);
3286                     reverse_64(&packet[3], setup->sm_peer_rand);
3287                     break;
3288 
3289                 case SM_CODE_IDENTITY_INFORMATION:
3290                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
3291                     reverse_128(&packet[1], setup->sm_peer_irk);
3292                     break;
3293 
3294                 case SM_CODE_IDENTITY_ADDRESS_INFORMATION:
3295                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
3296                     setup->sm_peer_addr_type = packet[1];
3297                     reverse_bd_addr(&packet[2], setup->sm_peer_address);
3298                     break;
3299 
3300                 case SM_CODE_SIGNING_INFORMATION:
3301                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
3302                     reverse_128(&packet[1], setup->sm_peer_csrk);
3303                     break;
3304                 default:
3305                     // Unexpected PDU
3306                     log_info("Unexpected PDU %u in SM_PH3_RECEIVE_KEYS", packet[0]);
3307                     break;
3308             }
3309             // done with key distribution?
3310             if (sm_key_distribution_all_received(sm_conn)){
3311 
3312                 sm_key_distribution_handle_all_received(sm_conn);
3313 
3314                 if (sm_conn->sm_role){
3315                     sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
3316                     sm_done_for_handle(sm_conn->sm_handle);
3317                 } else {
3318                     if (setup->sm_use_secure_connections){
3319                         sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
3320                     } else {
3321                         sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3322                     }
3323                 }
3324             }
3325             break;
3326         default:
3327             // Unexpected PDU
3328             log_info("Unexpected PDU %u in state %u", packet[0], sm_conn->sm_engine_state);
3329             break;
3330     }
3331 
3332     // try to send preparared packet
3333     sm_run();
3334 }
3335 
3336 // Security Manager Client API
3337 void sm_register_oob_data_callback( int (*get_oob_data_callback)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data)){
3338     sm_get_oob_data = get_oob_data_callback;
3339 }
3340 
3341 void sm_add_event_handler(btstack_packet_callback_registration_t * callback_handler){
3342     btstack_linked_list_add_tail(&sm_event_handlers, (btstack_linked_item_t*) callback_handler);
3343 }
3344 
3345 void sm_set_accepted_stk_generation_methods(uint8_t accepted_stk_generation_methods){
3346     sm_accepted_stk_generation_methods = accepted_stk_generation_methods;
3347 }
3348 
3349 void sm_set_encryption_key_size_range(uint8_t min_size, uint8_t max_size){
3350 	sm_min_encryption_key_size = min_size;
3351 	sm_max_encryption_key_size = max_size;
3352 }
3353 
3354 void sm_set_authentication_requirements(uint8_t auth_req){
3355     sm_auth_req = auth_req;
3356 }
3357 
3358 void sm_set_io_capabilities(io_capability_t io_capability){
3359     sm_io_capabilities = io_capability;
3360 }
3361 
3362 void sm_set_request_security(int enable){
3363     sm_slave_request_security = enable;
3364 }
3365 
3366 void sm_set_er(sm_key_t er){
3367     memcpy(sm_persistent_er, er, 16);
3368 }
3369 
3370 void sm_set_ir(sm_key_t ir){
3371     memcpy(sm_persistent_ir, ir, 16);
3372 }
3373 
3374 // Testing support only
3375 void sm_test_set_irk(sm_key_t irk){
3376     memcpy(sm_persistent_irk, irk, 16);
3377     sm_persistent_irk_ready = 1;
3378 }
3379 
3380 void sm_test_use_fixed_local_csrk(void){
3381     test_use_fixed_local_csrk = 1;
3382 }
3383 
3384 void sm_init(void){
3385     // set some (BTstack default) ER and IR
3386     int i;
3387     sm_key_t er;
3388     sm_key_t ir;
3389     for (i=0;i<16;i++){
3390         er[i] = 0x30 + i;
3391         ir[i] = 0x90 + i;
3392     }
3393     sm_set_er(er);
3394     sm_set_ir(ir);
3395     // defaults
3396     sm_accepted_stk_generation_methods = SM_STK_GENERATION_METHOD_JUST_WORKS
3397                                        | SM_STK_GENERATION_METHOD_OOB
3398                                        | SM_STK_GENERATION_METHOD_PASSKEY
3399                                        | SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON;
3400 
3401     sm_max_encryption_key_size = 16;
3402     sm_min_encryption_key_size = 7;
3403 
3404     sm_cmac_state  = CMAC_IDLE;
3405     dkg_state = DKG_W4_WORKING;
3406     rau_state = RAU_W4_WORKING;
3407     sm_aes128_state = SM_AES128_IDLE;
3408     sm_address_resolution_test = -1;    // no private address to resolve yet
3409     sm_address_resolution_ah_calculation_active = 0;
3410     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
3411     sm_address_resolution_general_queue = NULL;
3412 
3413     gap_random_adress_update_period = 15 * 60 * 1000L;
3414 
3415     sm_active_connection = 0;
3416 
3417     test_use_fixed_local_csrk = 0;
3418 
3419     // register for HCI Events from HCI
3420     hci_event_callback_registration.callback = &sm_event_packet_handler;
3421     hci_add_event_handler(&hci_event_callback_registration);
3422 
3423     // and L2CAP PDUs + L2CAP_EVENT_CAN_SEND_NOW
3424     l2cap_register_fixed_channel(sm_pdu_handler, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
3425 
3426 #ifdef USE_MBEDTLS_FOR_ECDH
3427     ec_key_generation_state = EC_KEY_GENERATION_IDLE;
3428 #endif
3429 }
3430 
3431 void sm_test_use_fixed_ec_keypair(void){
3432     test_use_fixed_ec_keypair = 1;
3433 #ifdef USE_MBEDTLS_FOR_ECDH
3434     // use test keypair from spec
3435     mbedtls_ecp_keypair_init(&le_keypair);
3436     mbedtls_ecp_group_load(&le_keypair.grp, MBEDTLS_ECP_DP_SECP256R1);
3437     mbedtls_mpi_read_string( &le_keypair.d,   16, "3f49f6d4a3c55f3874c9b3e3d2103f504aff607beb40b7995899b8a6cd3c1abd");
3438     mbedtls_mpi_read_string( &le_keypair.Q.X, 16, "20b003d2f297be2c5e2c83a7e9f9a5b9eff49111acf4fddbcc0301480e359de6");
3439     mbedtls_mpi_read_string( &le_keypair.Q.Y, 16, "dc809c49652aeb6d63329abf5a52155c766345c28fed3024741c8ed01589d28b");
3440     mbedtls_mpi_read_string( &le_keypair.Q.Z, 16, "1");
3441 #endif
3442 }
3443 
3444 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle){
3445     hci_connection_t * hci_con = hci_connection_for_handle(con_handle);
3446     if (!hci_con) return NULL;
3447     return &hci_con->sm_connection;
3448 }
3449 
3450 // @returns 0 if not encrypted, 7-16 otherwise
3451 int sm_encryption_key_size(hci_con_handle_t con_handle){
3452     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3453     if (!sm_conn) return 0;     // wrong connection
3454     if (!sm_conn->sm_connection_encrypted) return 0;
3455     return sm_conn->sm_actual_encryption_key_size;
3456 }
3457 
3458 int sm_authenticated(hci_con_handle_t con_handle){
3459     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3460     if (!sm_conn) return 0;     // wrong connection
3461     if (!sm_conn->sm_connection_encrypted) return 0; // unencrypted connection cannot be authenticated
3462     return sm_conn->sm_connection_authenticated;
3463 }
3464 
3465 authorization_state_t sm_authorization_state(hci_con_handle_t con_handle){
3466     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3467     if (!sm_conn) return AUTHORIZATION_UNKNOWN;     // wrong connection
3468     if (!sm_conn->sm_connection_encrypted)               return AUTHORIZATION_UNKNOWN; // unencrypted connection cannot be authorized
3469     if (!sm_conn->sm_connection_authenticated)           return AUTHORIZATION_UNKNOWN; // unauthenticatd connection cannot be authorized
3470     return sm_conn->sm_connection_authorization_state;
3471 }
3472 
3473 static void sm_send_security_request_for_connection(sm_connection_t * sm_conn){
3474     switch (sm_conn->sm_engine_state){
3475         case SM_GENERAL_IDLE:
3476         case SM_RESPONDER_IDLE:
3477             sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
3478             sm_run();
3479             break;
3480         default:
3481             break;
3482     }
3483 }
3484 
3485 /**
3486  * @brief Trigger Security Request
3487  */
3488 void sm_send_security_request(hci_con_handle_t con_handle){
3489     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3490     if (!sm_conn) return;
3491     sm_send_security_request_for_connection(sm_conn);
3492 }
3493 
3494 // request pairing
3495 void sm_request_pairing(hci_con_handle_t con_handle){
3496     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3497     if (!sm_conn) return;     // wrong connection
3498 
3499     log_info("sm_request_pairing in role %u, state %u", sm_conn->sm_role, sm_conn->sm_engine_state);
3500     if (sm_conn->sm_role){
3501         sm_send_security_request_for_connection(sm_conn);
3502     } else {
3503         // used as a trigger to start central/master/initiator security procedures
3504         uint16_t ediv;
3505         sm_key_t ltk;
3506         if (sm_conn->sm_engine_state == SM_INITIATOR_CONNECTED){
3507             switch (sm_conn->sm_irk_lookup_state){
3508                 case IRK_LOOKUP_FAILED:
3509                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3510                     break;
3511                 case IRK_LOOKUP_SUCCEEDED:
3512                         le_device_db_encryption_get(sm_conn->sm_le_db_index, &ediv, NULL, ltk, NULL, NULL, NULL);
3513                         if (!sm_is_null_key(ltk) || ediv){
3514                             log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3515                             sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3516                         } else {
3517                             sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3518                         }
3519                         break;
3520                 default:
3521                     sm_conn->sm_bonding_requested = 1;
3522                     break;
3523             }
3524         } else if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
3525             sm_conn->sm_bonding_requested = 1;
3526         }
3527     }
3528     sm_run();
3529 }
3530 
3531 // called by client app on authorization request
3532 void sm_authorization_decline(hci_con_handle_t con_handle){
3533     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3534     if (!sm_conn) return;     // wrong connection
3535     sm_conn->sm_connection_authorization_state = AUTHORIZATION_DECLINED;
3536     sm_notify_client_authorization(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 0);
3537 }
3538 
3539 void sm_authorization_grant(hci_con_handle_t con_handle){
3540     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3541     if (!sm_conn) return;     // wrong connection
3542     sm_conn->sm_connection_authorization_state = AUTHORIZATION_GRANTED;
3543     sm_notify_client_authorization(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 1);
3544 }
3545 
3546 // GAP Bonding API
3547 
3548 void sm_bonding_decline(hci_con_handle_t con_handle){
3549     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3550     if (!sm_conn) return;     // wrong connection
3551     setup->sm_user_response = SM_USER_RESPONSE_DECLINE;
3552 
3553     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3554         switch (setup->sm_stk_generation_method){
3555             case PK_RESP_INPUT:
3556             case PK_INIT_INPUT:
3557             case OK_BOTH_INPUT:
3558                 sm_pairing_error(sm_conn, SM_GENERAL_SEND_PAIRING_FAILED);
3559                 break;
3560             case NK_BOTH_INPUT:
3561                 sm_pairing_error(sm_conn, SM_REASON_NUMERIC_COMPARISON_FAILED);
3562                 break;
3563             case JUST_WORKS:
3564             case OOB:
3565                 sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
3566                 break;
3567         }
3568     }
3569     sm_run();
3570 }
3571 
3572 void sm_just_works_confirm(hci_con_handle_t con_handle){
3573     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3574     if (!sm_conn) return;     // wrong connection
3575     setup->sm_user_response = SM_USER_RESPONSE_CONFIRM;
3576     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3577         if (setup->sm_use_secure_connections){
3578             sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3579         } else {
3580             sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3581         }
3582     }
3583 
3584 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3585     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
3586         sm_sc_prepare_dhkey_check(sm_conn);
3587     }
3588 #endif
3589 
3590     sm_run();
3591 }
3592 
3593 void sm_numeric_comparison_confirm(hci_con_handle_t con_handle){
3594     // for now, it's the same
3595     sm_just_works_confirm(con_handle);
3596 }
3597 
3598 void sm_passkey_input(hci_con_handle_t con_handle, uint32_t passkey){
3599     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3600     if (!sm_conn) return;     // wrong connection
3601     sm_reset_tk();
3602     big_endian_store_32(setup->sm_tk, 12, passkey);
3603     setup->sm_user_response = SM_USER_RESPONSE_PASSKEY;
3604     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3605         sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3606     }
3607 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3608     memcpy(setup->sm_ra, setup->sm_tk, 16);
3609     memcpy(setup->sm_rb, setup->sm_tk, 16);
3610     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
3611         sm_sc_start_calculating_local_confirm(sm_conn);
3612     }
3613 #endif
3614     sm_run();
3615 }
3616 
3617 /**
3618  * @brief Identify device in LE Device DB
3619  * @param handle
3620  * @returns index from le_device_db or -1 if not found/identified
3621  */
3622 int sm_le_device_index(hci_con_handle_t con_handle ){
3623     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3624     if (!sm_conn) return -1;
3625     return sm_conn->sm_le_db_index;
3626 }
3627 
3628 // GAP LE API
3629 void gap_random_address_set_mode(gap_random_address_type_t random_address_type){
3630     gap_random_address_update_stop();
3631     gap_random_adress_type = random_address_type;
3632     if (random_address_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return;
3633     gap_random_address_update_start();
3634     gap_random_address_trigger();
3635 }
3636 
3637 gap_random_address_type_t gap_random_address_get_mode(void){
3638     return gap_random_adress_type;
3639 }
3640 
3641 void gap_random_address_set_update_period(int period_ms){
3642     gap_random_adress_update_period = period_ms;
3643     if (gap_random_adress_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return;
3644     gap_random_address_update_stop();
3645     gap_random_address_update_start();
3646 }
3647 
3648 void gap_random_address_set(bd_addr_t addr){
3649     gap_random_address_set_mode(GAP_RANDOM_ADDRESS_TYPE_OFF);
3650     memcpy(sm_random_address, addr, 6);
3651     rau_state = RAU_SET_ADDRESS;
3652     sm_run();
3653 }
3654 
3655 /*
3656  * @brief Set Advertisement Paramters
3657  * @param adv_int_min
3658  * @param adv_int_max
3659  * @param adv_type
3660  * @param direct_address_type
3661  * @param direct_address
3662  * @param channel_map
3663  * @param filter_policy
3664  *
3665  * @note own_address_type is used from gap_random_address_set_mode
3666  */
3667 void gap_advertisements_set_params(uint16_t adv_int_min, uint16_t adv_int_max, uint8_t adv_type,
3668     uint8_t direct_address_typ, bd_addr_t direct_address, uint8_t channel_map, uint8_t filter_policy){
3669     hci_le_advertisements_set_params(adv_int_min, adv_int_max, adv_type, gap_random_adress_type,
3670         direct_address_typ, direct_address, channel_map, filter_policy);
3671 }
3672 
3673