xref: /btstack/src/ble/sm.c (revision 891bb64a1987f6bf37257fe9d19b2f37c3d1e9e6)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #include <stdio.h>
39 #include <string.h>
40 #include <inttypes.h>
41 
42 #include "ble/le_device_db.h"
43 #include "ble/core.h"
44 #include "ble/sm.h"
45 #include "btstack_debug.h"
46 #include "btstack_event.h"
47 #include "btstack_linked_list.h"
48 #include "btstack_memory.h"
49 #include "gap.h"
50 #include "hci.h"
51 #include "l2cap.h"
52 
53 #ifdef ENABLE_LE_SECURE_CONNECTIONS
54 #ifdef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
55 #error "Support for DHKEY Support in HCI Controller not implemented yet. Please use software implementation"
56 #else
57 #define USE_MBEDTLS_FOR_ECDH
58 #endif
59 #endif
60 
61 
62 // Software ECDH implementation provided by mbedtls
63 #ifdef USE_MBEDTLS_FOR_ECDH
64 #include "mbedtls/config.h"
65 #if defined(MBEDTLS_PLATFORM_C)
66 #include "mbedtls/platform.h"
67 #else
68 #include <stdio.h>
69 #define mbedtls_printf     printf
70 #endif
71 #include "mbedtls/ecp.h"
72 #endif
73 
74 //
75 // SM internal types and globals
76 //
77 
78 typedef enum {
79     DKG_W4_WORKING,
80     DKG_CALC_IRK,
81     DKG_W4_IRK,
82     DKG_CALC_DHK,
83     DKG_W4_DHK,
84     DKG_READY
85 } derived_key_generation_t;
86 
87 typedef enum {
88     RAU_W4_WORKING,
89     RAU_IDLE,
90     RAU_GET_RANDOM,
91     RAU_W4_RANDOM,
92     RAU_GET_ENC,
93     RAU_W4_ENC,
94     RAU_SET_ADDRESS,
95 } random_address_update_t;
96 
97 typedef enum {
98     CMAC_IDLE,
99     CMAC_CALC_SUBKEYS,
100     CMAC_W4_SUBKEYS,
101     CMAC_CALC_MI,
102     CMAC_W4_MI,
103     CMAC_CALC_MLAST,
104     CMAC_W4_MLAST
105 } cmac_state_t;
106 
107 typedef enum {
108     JUST_WORKS,
109     PK_RESP_INPUT,  // Initiator displays PK, responder inputs PK
110     PK_INIT_INPUT,  // Responder displays PK, initiator inputs PK
111     OK_BOTH_INPUT,  // Only input on both, both input PK
112     NK_BOTH_INPUT,  // Only numerical compparison (yes/no) on on both sides
113     OOB             // OOB available on both sides
114 } stk_generation_method_t;
115 
116 typedef enum {
117     SM_USER_RESPONSE_IDLE,
118     SM_USER_RESPONSE_PENDING,
119     SM_USER_RESPONSE_CONFIRM,
120     SM_USER_RESPONSE_PASSKEY,
121     SM_USER_RESPONSE_DECLINE
122 } sm_user_response_t;
123 
124 typedef enum {
125     SM_AES128_IDLE,
126     SM_AES128_ACTIVE
127 } sm_aes128_state_t;
128 
129 typedef enum {
130     ADDRESS_RESOLUTION_IDLE,
131     ADDRESS_RESOLUTION_GENERAL,
132     ADDRESS_RESOLUTION_FOR_CONNECTION,
133 } address_resolution_mode_t;
134 
135 typedef enum {
136     ADDRESS_RESOLUTION_SUCEEDED,
137     ADDRESS_RESOLUTION_FAILED,
138 } address_resolution_event_t;
139 
140 typedef enum {
141     EC_KEY_GENERATION_IDLE,
142     EC_KEY_GENERATION_ACTIVE,
143     EC_KEY_GENERATION_DONE,
144 } ec_key_generation_state_t;
145 
146 typedef enum {
147     SM_STATE_VAR_DHKEY_COMMAND_RECEIVED = 1 << 0
148 } sm_state_var_t;
149 
150 //
151 // GLOBAL DATA
152 //
153 
154 static uint8_t test_use_fixed_local_csrk;
155 static uint8_t test_use_fixed_ec_keypair;
156 
157 // configuration
158 static uint8_t sm_accepted_stk_generation_methods;
159 static uint8_t sm_max_encryption_key_size;
160 static uint8_t sm_min_encryption_key_size;
161 static uint8_t sm_auth_req = 0;
162 static uint8_t sm_io_capabilities = IO_CAPABILITY_NO_INPUT_NO_OUTPUT;
163 static uint8_t sm_slave_request_security;
164 
165 // Security Manager Master Keys, please use sm_set_er(er) and sm_set_ir(ir) with your own 128 bit random values
166 static sm_key_t sm_persistent_er;
167 static sm_key_t sm_persistent_ir;
168 
169 // derived from sm_persistent_ir
170 static sm_key_t sm_persistent_dhk;
171 static sm_key_t sm_persistent_irk;
172 static uint8_t  sm_persistent_irk_ready = 0;    // used for testing
173 static derived_key_generation_t dkg_state;
174 
175 // derived from sm_persistent_er
176 // ..
177 
178 // random address update
179 static random_address_update_t rau_state;
180 static bd_addr_t sm_random_address;
181 
182 // CMAC Calculation: General
183 static cmac_state_t sm_cmac_state;
184 static uint16_t     sm_cmac_message_len;
185 static sm_key_t     sm_cmac_k;
186 static sm_key_t     sm_cmac_x;
187 static sm_key_t     sm_cmac_m_last;
188 static uint8_t      sm_cmac_block_current;
189 static uint8_t      sm_cmac_block_count;
190 static uint8_t      (*sm_cmac_get_byte)(uint16_t offset);
191 static void         (*sm_cmac_done_handler)(uint8_t * hash);
192 
193 // CMAC for ATT Signed Writes
194 static uint8_t      sm_cmac_header[3];
195 static const uint8_t * sm_cmac_message;
196 static uint8_t      sm_cmac_sign_counter[4];
197 
198 // CMAC for Secure Connection functions
199 #ifdef ENABLE_LE_SECURE_CONNECTIONS
200 static sm_connection_t * sm_cmac_connection;
201 static uint8_t           sm_cmac_sc_buffer[80];
202 #endif
203 
204 // resolvable private address lookup / CSRK calculation
205 static int       sm_address_resolution_test;
206 static int       sm_address_resolution_ah_calculation_active;
207 static uint8_t   sm_address_resolution_addr_type;
208 static bd_addr_t sm_address_resolution_address;
209 static void *    sm_address_resolution_context;
210 static address_resolution_mode_t sm_address_resolution_mode;
211 static btstack_linked_list_t sm_address_resolution_general_queue;
212 
213 // aes128 crypto engine. store current sm_connection_t in sm_aes128_context
214 static sm_aes128_state_t  sm_aes128_state;
215 static void *             sm_aes128_context;
216 
217 // random engine. store context (ususally sm_connection_t)
218 static void * sm_random_context;
219 
220 // to receive hci events
221 static btstack_packet_callback_registration_t hci_event_callback_registration;
222 
223 /* to dispatch sm event */
224 static btstack_linked_list_t sm_event_handlers;
225 
226 // Software ECDH implementation provided by mbedtls
227 #ifdef USE_MBEDTLS_FOR_ECDH
228 static mbedtls_ecp_keypair le_keypair;
229 static ec_key_generation_state_t ec_key_generation_state;
230 #endif
231 
232 //
233 // Volume 3, Part H, Chapter 24
234 // "Security shall be initiated by the Security Manager in the device in the master role.
235 // The device in the slave role shall be the responding device."
236 // -> master := initiator, slave := responder
237 //
238 
239 // data needed for security setup
240 typedef struct sm_setup_context {
241 
242     btstack_timer_source_t sm_timeout;
243 
244     // used in all phases
245     uint8_t   sm_pairing_failed_reason;
246 
247     // user response, (Phase 1 and/or 2)
248     uint8_t   sm_user_response;
249 
250     // defines which keys will be send after connection is encrypted - calculated during Phase 1, used Phase 3
251     int       sm_key_distribution_send_set;
252     int       sm_key_distribution_received_set;
253 
254     // Phase 2 (Pairing over SMP)
255     stk_generation_method_t sm_stk_generation_method;
256     sm_key_t  sm_tk;
257     uint8_t   sm_use_secure_connections;
258 
259     sm_key_t  sm_c1_t3_value;   // c1 calculation
260     sm_pairing_packet_t sm_m_preq; // pairing request - needed only for c1
261     sm_pairing_packet_t sm_s_pres; // pairing response - needed only for c1
262     sm_key_t  sm_local_random;
263     sm_key_t  sm_local_confirm;
264     sm_key_t  sm_peer_random;
265     sm_key_t  sm_peer_confirm;
266     uint8_t   sm_m_addr_type;   // address and type can be removed
267     uint8_t   sm_s_addr_type;   //  ''
268     bd_addr_t sm_m_address;     //  ''
269     bd_addr_t sm_s_address;     //  ''
270     sm_key_t  sm_ltk;
271 
272 #ifdef ENABLE_LE_SECURE_CONNECTIONS
273     uint8_t   sm_peer_qx[32];   // also stores random for EC key generation during init
274     uint8_t   sm_peer_qy[32];   //  ''
275     sm_key_t  sm_peer_nonce;    // might be combined with sm_peer_random
276     sm_key_t  sm_local_nonce;   // might be combined with sm_local_random
277     sm_key_t  sm_peer_dhkey_check;
278     sm_key_t  sm_local_dhkey_check;
279     sm_key_t  sm_ra;
280     sm_key_t  sm_rb;
281     sm_key_t  sm_t;             // used for f5
282     sm_key_t  sm_mackey;
283     uint8_t   sm_passkey_bit;   // also stores number of generated random bytes for EC key generation
284     uint8_t   sm_state_vars;
285 #endif
286 
287     // Phase 3
288 
289     // key distribution, we generate
290     uint16_t  sm_local_y;
291     uint16_t  sm_local_div;
292     uint16_t  sm_local_ediv;
293     uint8_t   sm_local_rand[8];
294     sm_key_t  sm_local_ltk;
295     sm_key_t  sm_local_csrk;
296     sm_key_t  sm_local_irk;
297     // sm_local_address/addr_type not needed
298 
299     // key distribution, received from peer
300     uint16_t  sm_peer_y;
301     uint16_t  sm_peer_div;
302     uint16_t  sm_peer_ediv;
303     uint8_t   sm_peer_rand[8];
304     sm_key_t  sm_peer_ltk;
305     sm_key_t  sm_peer_irk;
306     sm_key_t  sm_peer_csrk;
307     uint8_t   sm_peer_addr_type;
308     bd_addr_t sm_peer_address;
309 
310 } sm_setup_context_t;
311 
312 //
313 static sm_setup_context_t the_setup;
314 static sm_setup_context_t * setup = &the_setup;
315 
316 // active connection - the one for which the_setup is used for
317 static uint16_t sm_active_connection = 0;
318 
319 // @returns 1 if oob data is available
320 // stores oob data in provided 16 byte buffer if not null
321 static int (*sm_get_oob_data)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data) = NULL;
322 
323 // used to notify applicationss that user interaction is neccessary, see sm_notify_t below
324 static btstack_packet_handler_t sm_client_packet_handler = NULL;
325 
326 // horizontal: initiator capabilities
327 // vertial:    responder capabilities
328 static const stk_generation_method_t stk_generation_method [5] [5] = {
329     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
330     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
331     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
332     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
333     { PK_RESP_INPUT,   PK_RESP_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
334 };
335 
336 // uses numeric comparison if one side has DisplayYesNo and KeyboardDisplay combinations
337 #ifdef ENABLE_LE_SECURE_CONNECTIONS
338 static const stk_generation_method_t stk_generation_method_with_secure_connection[5][5] = {
339     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
340     { JUST_WORKS,      NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
341     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
342     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
343     { PK_RESP_INPUT,   NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
344 };
345 #endif
346 
347 static void sm_run(void);
348 static void sm_done_for_handle(hci_con_handle_t con_handle);
349 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle);
350 static inline int sm_calc_actual_encryption_key_size(int other);
351 static int sm_validate_stk_generation_method(void);
352 static void sm_shift_left_by_one_bit_inplace(int len, uint8_t * data);
353 
354 static void log_info_hex16(const char * name, uint16_t value){
355     log_info("%-6s 0x%04x", name, value);
356 }
357 
358 // @returns 1 if all bytes are 0
359 static int sm_is_null(uint8_t * data, int size){
360     int i;
361     for (i=0; i < size ; i++){
362         if (data[i]) return 0;
363     }
364     return 1;
365 }
366 
367 static int sm_is_null_random(uint8_t random[8]){
368     return sm_is_null(random, 8);
369 }
370 
371 static int sm_is_null_key(uint8_t * key){
372     return sm_is_null(key, 16);
373 }
374 
375 // Key utils
376 static void sm_reset_tk(void){
377     int i;
378     for (i=0;i<16;i++){
379         setup->sm_tk[i] = 0;
380     }
381 }
382 
383 // "For example, if a 128-bit encryption key is 0x123456789ABCDEF0123456789ABCDEF0
384 // and it is reduced to 7 octets (56 bits), then the resulting key is 0x0000000000000000003456789ABCDEF0.""
385 static void sm_truncate_key(sm_key_t key, int max_encryption_size){
386     int i;
387     for (i = max_encryption_size ; i < 16 ; i++){
388         key[15-i] = 0;
389     }
390 }
391 
392 // SMP Timeout implementation
393 
394 // Upon transmission of the Pairing Request command or reception of the Pairing Request command,
395 // the Security Manager Timer shall be reset and started.
396 //
397 // The Security Manager Timer shall be reset when an L2CAP SMP command is queued for transmission.
398 //
399 // If the Security Manager Timer reaches 30 seconds, the procedure shall be considered to have failed,
400 // and the local higher layer shall be notified. No further SMP commands shall be sent over the L2CAP
401 // Security Manager Channel. A new SM procedure shall only be performed when a new physical link has been
402 // established.
403 
404 static void sm_timeout_handler(btstack_timer_source_t * timer){
405     log_info("SM timeout");
406     sm_connection_t * sm_conn = (sm_connection_t*) btstack_run_loop_get_timer_context(timer);
407     sm_conn->sm_engine_state = SM_GENERAL_TIMEOUT;
408     sm_done_for_handle(sm_conn->sm_handle);
409 
410     // trigger handling of next ready connection
411     sm_run();
412 }
413 static void sm_timeout_start(sm_connection_t * sm_conn){
414     btstack_run_loop_remove_timer(&setup->sm_timeout);
415     btstack_run_loop_set_timer_context(&setup->sm_timeout, sm_conn);
416     btstack_run_loop_set_timer_handler(&setup->sm_timeout, sm_timeout_handler);
417     btstack_run_loop_set_timer(&setup->sm_timeout, 30000); // 30 seconds sm timeout
418     btstack_run_loop_add_timer(&setup->sm_timeout);
419 }
420 static void sm_timeout_stop(void){
421     btstack_run_loop_remove_timer(&setup->sm_timeout);
422 }
423 static void sm_timeout_reset(sm_connection_t * sm_conn){
424     sm_timeout_stop();
425     sm_timeout_start(sm_conn);
426 }
427 
428 // end of sm timeout
429 
430 // GAP Random Address updates
431 static gap_random_address_type_t gap_random_adress_type;
432 static btstack_timer_source_t gap_random_address_update_timer;
433 static uint32_t gap_random_adress_update_period;
434 
435 static void gap_random_address_trigger(void){
436     if (rau_state != RAU_IDLE) return;
437     log_info("gap_random_address_trigger");
438     rau_state = RAU_GET_RANDOM;
439     sm_run();
440 }
441 
442 static void gap_random_address_update_handler(btstack_timer_source_t * timer){
443     log_info("GAP Random Address Update due");
444     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
445     btstack_run_loop_add_timer(&gap_random_address_update_timer);
446     gap_random_address_trigger();
447 }
448 
449 static void gap_random_address_update_start(void){
450     btstack_run_loop_set_timer_handler(&gap_random_address_update_timer, gap_random_address_update_handler);
451     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
452     btstack_run_loop_add_timer(&gap_random_address_update_timer);
453 }
454 
455 static void gap_random_address_update_stop(void){
456     btstack_run_loop_remove_timer(&gap_random_address_update_timer);
457 }
458 
459 
460 static void sm_random_start(void * context){
461     sm_random_context = context;
462     hci_send_cmd(&hci_le_rand);
463 }
464 
465 // pre: sm_aes128_state != SM_AES128_ACTIVE, hci_can_send_command == 1
466 // context is made availabe to aes128 result handler by this
467 static void sm_aes128_start(sm_key_t key, sm_key_t plaintext, void * context){
468     sm_aes128_state = SM_AES128_ACTIVE;
469     sm_key_t key_flipped, plaintext_flipped;
470     reverse_128(key, key_flipped);
471     reverse_128(plaintext, plaintext_flipped);
472     sm_aes128_context = context;
473     hci_send_cmd(&hci_le_encrypt, key_flipped, plaintext_flipped);
474 }
475 
476 // ah(k,r) helper
477 // r = padding || r
478 // r - 24 bit value
479 static void sm_ah_r_prime(uint8_t r[3], sm_key_t r_prime){
480     // r'= padding || r
481     memset(r_prime, 0, 16);
482     memcpy(&r_prime[13], r, 3);
483 }
484 
485 // d1 helper
486 // d' = padding || r || d
487 // d,r - 16 bit values
488 static void sm_d1_d_prime(uint16_t d, uint16_t r, sm_key_t d1_prime){
489     // d'= padding || r || d
490     memset(d1_prime, 0, 16);
491     big_endian_store_16(d1_prime, 12, r);
492     big_endian_store_16(d1_prime, 14, d);
493 }
494 
495 // dm helper
496 // r’ = padding || r
497 // r - 64 bit value
498 static void sm_dm_r_prime(uint8_t r[8], sm_key_t r_prime){
499     memset(r_prime, 0, 16);
500     memcpy(&r_prime[8], r, 8);
501 }
502 
503 // calculate arguments for first AES128 operation in C1 function
504 static void sm_c1_t1(sm_key_t r, uint8_t preq[7], uint8_t pres[7], uint8_t iat, uint8_t rat, sm_key_t t1){
505 
506     // p1 = pres || preq || rat’ || iat’
507     // "The octet of iat’ becomes the least significant octet of p1 and the most signifi-
508     // cant octet of pres becomes the most significant octet of p1.
509     // For example, if the 8-bit iat’ is 0x01, the 8-bit rat’ is 0x00, the 56-bit preq
510     // is 0x07071000000101 and the 56 bit pres is 0x05000800000302 then
511     // p1 is 0x05000800000302070710000001010001."
512 
513     sm_key_t p1;
514     reverse_56(pres, &p1[0]);
515     reverse_56(preq, &p1[7]);
516     p1[14] = rat;
517     p1[15] = iat;
518     log_info_key("p1", p1);
519     log_info_key("r", r);
520 
521     // t1 = r xor p1
522     int i;
523     for (i=0;i<16;i++){
524         t1[i] = r[i] ^ p1[i];
525     }
526     log_info_key("t1", t1);
527 }
528 
529 // calculate arguments for second AES128 operation in C1 function
530 static void sm_c1_t3(sm_key_t t2, bd_addr_t ia, bd_addr_t ra, sm_key_t t3){
531      // p2 = padding || ia || ra
532     // "The least significant octet of ra becomes the least significant octet of p2 and
533     // the most significant octet of padding becomes the most significant octet of p2.
534     // For example, if 48-bit ia is 0xA1A2A3A4A5A6 and the 48-bit ra is
535     // 0xB1B2B3B4B5B6 then p2 is 0x00000000A1A2A3A4A5A6B1B2B3B4B5B6.
536 
537     sm_key_t p2;
538     memset(p2, 0, 16);
539     memcpy(&p2[4],  ia, 6);
540     memcpy(&p2[10], ra, 6);
541     log_info_key("p2", p2);
542 
543     // c1 = e(k, t2_xor_p2)
544     int i;
545     for (i=0;i<16;i++){
546         t3[i] = t2[i] ^ p2[i];
547     }
548     log_info_key("t3", t3);
549 }
550 
551 static void sm_s1_r_prime(sm_key_t r1, sm_key_t r2, sm_key_t r_prime){
552     log_info_key("r1", r1);
553     log_info_key("r2", r2);
554     memcpy(&r_prime[8], &r2[8], 8);
555     memcpy(&r_prime[0], &r1[8], 8);
556 }
557 
558 #ifdef ENABLE_LE_SECURE_CONNECTIONS
559 // Software implementations of crypto toolbox for LE Secure Connection
560 // TODO: replace with code to use AES Engine of HCI Controller
561 typedef uint8_t sm_key24_t[3];
562 typedef uint8_t sm_key56_t[7];
563 typedef uint8_t sm_key256_t[32];
564 
565 #if 0
566 static void aes128_calc_cyphertext(const uint8_t key[16], const uint8_t plaintext[16], uint8_t cyphertext[16]){
567     uint32_t rk[RKLENGTH(KEYBITS)];
568     int nrounds = rijndaelSetupEncrypt(rk, &key[0], KEYBITS);
569     rijndaelEncrypt(rk, nrounds, plaintext, cyphertext);
570 }
571 
572 static void calc_subkeys(sm_key_t k0, sm_key_t k1, sm_key_t k2){
573     memcpy(k1, k0, 16);
574     sm_shift_left_by_one_bit_inplace(16, k1);
575     if (k0[0] & 0x80){
576         k1[15] ^= 0x87;
577     }
578     memcpy(k2, k1, 16);
579     sm_shift_left_by_one_bit_inplace(16, k2);
580     if (k1[0] & 0x80){
581         k2[15] ^= 0x87;
582     }
583 }
584 
585 static void aes_cmac(sm_key_t aes_cmac, const sm_key_t key, const uint8_t * data, int cmac_message_len){
586     sm_key_t k0, k1, k2, zero;
587     memset(zero, 0, 16);
588 
589     aes128_calc_cyphertext(key, zero, k0);
590     calc_subkeys(k0, k1, k2);
591 
592     int cmac_block_count = (cmac_message_len + 15) / 16;
593 
594     // step 3: ..
595     if (cmac_block_count==0){
596         cmac_block_count = 1;
597     }
598 
599     // step 4: set m_last
600     sm_key_t cmac_m_last;
601     int sm_cmac_last_block_complete = cmac_message_len != 0 && (cmac_message_len & 0x0f) == 0;
602     int i;
603     if (sm_cmac_last_block_complete){
604         for (i=0;i<16;i++){
605             cmac_m_last[i] = data[cmac_message_len - 16 + i] ^ k1[i];
606         }
607     } else {
608         int valid_octets_in_last_block = cmac_message_len & 0x0f;
609         for (i=0;i<16;i++){
610             if (i < valid_octets_in_last_block){
611                 cmac_m_last[i] = data[(cmac_message_len & 0xfff0) + i] ^ k2[i];
612                 continue;
613             }
614             if (i == valid_octets_in_last_block){
615                 cmac_m_last[i] = 0x80 ^ k2[i];
616                 continue;
617             }
618             cmac_m_last[i] = k2[i];
619         }
620     }
621 
622     // printf("sm_cmac_start: len %u, block count %u\n", cmac_message_len, cmac_block_count);
623     // LOG_KEY(cmac_m_last);
624 
625     // Step 5
626     sm_key_t cmac_x;
627     memset(cmac_x, 0, 16);
628 
629     // Step 6
630     sm_key_t sm_cmac_y;
631     for (int block = 0 ; block < cmac_block_count-1 ; block++){
632         for (i=0;i<16;i++){
633             sm_cmac_y[i] = cmac_x[i] ^ data[block * 16 + i];
634         }
635         aes128_calc_cyphertext(key, sm_cmac_y, cmac_x);
636     }
637     for (i=0;i<16;i++){
638         sm_cmac_y[i] = cmac_x[i] ^ cmac_m_last[i];
639     }
640 
641     // Step 7
642     aes128_calc_cyphertext(key, sm_cmac_y, aes_cmac);
643 }
644 #endif
645 
646 #if 0
647 //
648 // Link Key Conversion Function h6
649 //
650 // h6(W, keyID) = AES-CMACW(keyID)
651 // - W is 128 bits
652 // - keyID is 32 bits
653 static void h6(sm_key_t res, const sm_key_t w, const uint32_t key_id){
654     uint8_t key_id_buffer[4];
655     big_endian_store_32(key_id_buffer, 0, key_id);
656     aes_cmac(res, w, key_id_buffer, 4);
657 }
658 #endif
659 #endif
660 
661 static void sm_setup_event_base(uint8_t * event, int event_size, uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
662     event[0] = type;
663     event[1] = event_size - 2;
664     little_endian_store_16(event, 2, con_handle);
665     event[4] = addr_type;
666     reverse_bd_addr(address, &event[5]);
667 }
668 
669 static void sm_dispatch_event(uint8_t packet_type, uint16_t channel, uint8_t * packet, uint16_t size){
670     if (sm_client_packet_handler) {
671         sm_client_packet_handler(HCI_EVENT_PACKET, 0, packet, size);
672     }
673     // dispatch to all event handlers
674     btstack_linked_list_iterator_t it;
675     btstack_linked_list_iterator_init(&it, &sm_event_handlers);
676     while (btstack_linked_list_iterator_has_next(&it)){
677         btstack_packet_callback_registration_t * entry = (btstack_packet_callback_registration_t*) btstack_linked_list_iterator_next(&it);
678         entry->callback(packet_type, 0, packet, size);
679     }
680 }
681 
682 static void sm_notify_client_base(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
683     uint8_t event[11];
684     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
685     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
686 }
687 
688 static void sm_notify_client_passkey(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint32_t passkey){
689     uint8_t event[15];
690     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
691     little_endian_store_32(event, 11, passkey);
692     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
693 }
694 
695 static void sm_notify_client_index(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint16_t index){
696     uint8_t event[13];
697     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
698     little_endian_store_16(event, 11, index);
699     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
700 }
701 
702 static void sm_notify_client_authorization(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint8_t result){
703 
704     uint8_t event[18];
705     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
706     event[11] = result;
707     sm_dispatch_event(HCI_EVENT_PACKET, 0, (uint8_t*) &event, sizeof(event));
708 }
709 
710 // decide on stk generation based on
711 // - pairing request
712 // - io capabilities
713 // - OOB data availability
714 static void sm_setup_tk(void){
715 
716     // default: just works
717     setup->sm_stk_generation_method = JUST_WORKS;
718 
719 #ifdef ENABLE_LE_SECURE_CONNECTIONS
720     setup->sm_use_secure_connections = ( sm_pairing_packet_get_auth_req(setup->sm_m_preq)
721                                        & sm_pairing_packet_get_auth_req(setup->sm_s_pres)
722                                        & SM_AUTHREQ_SECURE_CONNECTION ) != 0;
723     memset(setup->sm_ra, 0, 16);
724     memset(setup->sm_rb, 0, 16);
725 #else
726     setup->sm_use_secure_connections = 0;
727 #endif
728 
729     // If both devices have not set the MITM option in the Authentication Requirements
730     // Flags, then the IO capabilities shall be ignored and the Just Works association
731     // model shall be used.
732     if (((sm_pairing_packet_get_auth_req(setup->sm_m_preq) & SM_AUTHREQ_MITM_PROTECTION) == 0)
733     &&  ((sm_pairing_packet_get_auth_req(setup->sm_s_pres) & SM_AUTHREQ_MITM_PROTECTION) == 0)){
734         log_info("SM: MITM not required by both -> JUST WORKS");
735         return;
736     }
737 
738     // TODO: with LE SC, OOB is used to transfer data OOB during pairing, single device with OOB is sufficient
739 
740     // If both devices have out of band authentication data, then the Authentication
741     // Requirements Flags shall be ignored when selecting the pairing method and the
742     // Out of Band pairing method shall be used.
743     if (sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq)
744     &&  sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres)){
745         log_info("SM: have OOB data");
746         log_info_key("OOB", setup->sm_tk);
747         setup->sm_stk_generation_method = OOB;
748         return;
749     }
750 
751     // Reset TK as it has been setup in sm_init_setup
752     sm_reset_tk();
753 
754     // Also use just works if unknown io capabilites
755     if ((sm_pairing_packet_get_io_capability(setup->sm_m_preq) > IO_CAPABILITY_KEYBOARD_DISPLAY) || (sm_pairing_packet_get_io_capability(setup->sm_s_pres) > IO_CAPABILITY_KEYBOARD_DISPLAY)){
756         return;
757     }
758 
759     // Otherwise the IO capabilities of the devices shall be used to determine the
760     // pairing method as defined in Table 2.4.
761     // see http://stackoverflow.com/a/1052837/393697 for how to specify pointer to 2-dimensional array
762     const stk_generation_method_t (*generation_method)[5] = stk_generation_method;
763 
764 #ifdef ENABLE_LE_SECURE_CONNECTIONS
765     // table not define by default
766     if (setup->sm_use_secure_connections){
767         generation_method = stk_generation_method_with_secure_connection;
768     }
769 #endif
770     setup->sm_stk_generation_method = generation_method[sm_pairing_packet_get_io_capability(setup->sm_s_pres)][sm_pairing_packet_get_io_capability(setup->sm_m_preq)];
771 
772     log_info("sm_setup_tk: master io cap: %u, slave io cap: %u -> method %u",
773         sm_pairing_packet_get_io_capability(setup->sm_m_preq), sm_pairing_packet_get_io_capability(setup->sm_s_pres), setup->sm_stk_generation_method);
774 }
775 
776 static int sm_key_distribution_flags_for_set(uint8_t key_set){
777     int flags = 0;
778     if (key_set & SM_KEYDIST_ENC_KEY){
779         flags |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
780         flags |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
781     }
782     if (key_set & SM_KEYDIST_ID_KEY){
783         flags |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
784         flags |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
785     }
786     if (key_set & SM_KEYDIST_SIGN){
787         flags |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
788     }
789     return flags;
790 }
791 
792 static void sm_setup_key_distribution(uint8_t key_set){
793     setup->sm_key_distribution_received_set = 0;
794     setup->sm_key_distribution_send_set = sm_key_distribution_flags_for_set(key_set);
795 }
796 
797 // CSRK Key Lookup
798 
799 
800 static int sm_address_resolution_idle(void){
801     return sm_address_resolution_mode == ADDRESS_RESOLUTION_IDLE;
802 }
803 
804 static void sm_address_resolution_start_lookup(uint8_t addr_type, hci_con_handle_t con_handle, bd_addr_t addr, address_resolution_mode_t mode, void * context){
805     memcpy(sm_address_resolution_address, addr, 6);
806     sm_address_resolution_addr_type = addr_type;
807     sm_address_resolution_test = 0;
808     sm_address_resolution_mode = mode;
809     sm_address_resolution_context = context;
810     sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_STARTED, con_handle, addr_type, addr);
811 }
812 
813 int sm_address_resolution_lookup(uint8_t address_type, bd_addr_t address){
814     // check if already in list
815     btstack_linked_list_iterator_t it;
816     sm_lookup_entry_t * entry;
817     btstack_linked_list_iterator_init(&it, &sm_address_resolution_general_queue);
818     while(btstack_linked_list_iterator_has_next(&it)){
819         entry = (sm_lookup_entry_t *) btstack_linked_list_iterator_next(&it);
820         if (entry->address_type != address_type) continue;
821         if (memcmp(entry->address, address, 6))  continue;
822         // already in list
823         return BTSTACK_BUSY;
824     }
825     entry = btstack_memory_sm_lookup_entry_get();
826     if (!entry) return BTSTACK_MEMORY_ALLOC_FAILED;
827     entry->address_type = (bd_addr_type_t) address_type;
828     memcpy(entry->address, address, 6);
829     btstack_linked_list_add(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
830     sm_run();
831     return 0;
832 }
833 
834 // CMAC Implementation using AES128 engine
835 static void sm_shift_left_by_one_bit_inplace(int len, uint8_t * data){
836     int i;
837     int carry = 0;
838     for (i=len-1; i >= 0 ; i--){
839         int new_carry = data[i] >> 7;
840         data[i] = data[i] << 1 | carry;
841         carry = new_carry;
842     }
843 }
844 
845 // while x_state++ for an enum is possible in C, it isn't in C++. we use this helpers to avoid compile errors for now
846 static inline void sm_next_responding_state(sm_connection_t * sm_conn){
847     sm_conn->sm_engine_state = (security_manager_state_t) (((int)sm_conn->sm_engine_state) + 1);
848 }
849 static inline void dkg_next_state(void){
850     dkg_state = (derived_key_generation_t) (((int)dkg_state) + 1);
851 }
852 static inline void rau_next_state(void){
853     rau_state = (random_address_update_t) (((int)rau_state) + 1);
854 }
855 
856 // CMAC calculation using AES Engine
857 
858 static inline void sm_cmac_next_state(void){
859     sm_cmac_state = (cmac_state_t) (((int)sm_cmac_state) + 1);
860 }
861 
862 static int sm_cmac_last_block_complete(void){
863     if (sm_cmac_message_len == 0) return 0;
864     return (sm_cmac_message_len & 0x0f) == 0;
865 }
866 
867 static inline uint8_t sm_cmac_message_get_byte(uint16_t offset){
868     if (offset >= sm_cmac_message_len) {
869         log_error("sm_cmac_message_get_byte. out of bounds, access %u, len %u", offset, sm_cmac_message_len);
870         return 0;
871     }
872 
873     offset = sm_cmac_message_len - 1 - offset;
874 
875     // sm_cmac_header[3] | message[] | sm_cmac_sign_counter[4]
876     if (offset < 3){
877         return sm_cmac_header[offset];
878     }
879     int actual_message_len_incl_header = sm_cmac_message_len - 4;
880     if (offset <  actual_message_len_incl_header){
881         return sm_cmac_message[offset - 3];
882     }
883     return sm_cmac_sign_counter[offset - actual_message_len_incl_header];
884 }
885 
886 // generic cmac calculation
887 void sm_cmac_general_start(const sm_key_t key, uint16_t message_len, uint8_t (*get_byte_callback)(uint16_t offset), void (*done_callback)(uint8_t hash[8])){
888     // Generalized CMAC
889     memcpy(sm_cmac_k, key, 16);
890     memset(sm_cmac_x, 0, 16);
891     sm_cmac_block_current = 0;
892     sm_cmac_message_len  = message_len;
893     sm_cmac_done_handler = done_callback;
894     sm_cmac_get_byte     = get_byte_callback;
895 
896     // step 2: n := ceil(len/const_Bsize);
897     sm_cmac_block_count = (sm_cmac_message_len + 15) / 16;
898 
899     // step 3: ..
900     if (sm_cmac_block_count==0){
901         sm_cmac_block_count = 1;
902     }
903     log_info("sm_cmac_connection %p", sm_cmac_connection);
904     log_info("sm_cmac_general_start: len %u, block count %u", sm_cmac_message_len, sm_cmac_block_count);
905 
906     // first, we need to compute l for k1, k2, and m_last
907     sm_cmac_state = CMAC_CALC_SUBKEYS;
908 
909     // let's go
910     sm_run();
911 }
912 
913 // cmac for ATT Message signing
914 void sm_cmac_start(const sm_key_t k, uint8_t opcode, hci_con_handle_t con_handle, uint16_t message_len, const uint8_t * message, uint32_t sign_counter, void (*done_handler)(uint8_t * hash)){
915     // ATT Message Signing
916     sm_cmac_header[0] = opcode;
917     little_endian_store_16(sm_cmac_header, 1, con_handle);
918     little_endian_store_32(sm_cmac_sign_counter, 0, sign_counter);
919     uint16_t total_message_len = 3 + message_len + 4;  // incl. virtually prepended att opcode, handle and appended sign_counter in LE
920     sm_cmac_message = message;
921     sm_cmac_general_start(k, total_message_len, &sm_cmac_message_get_byte, done_handler);
922 }
923 
924 int sm_cmac_ready(void){
925     return sm_cmac_state == CMAC_IDLE;
926 }
927 
928 static void sm_cmac_handle_aes_engine_ready(void){
929     switch (sm_cmac_state){
930         case CMAC_CALC_SUBKEYS: {
931             sm_key_t const_zero;
932             memset(const_zero, 0, 16);
933             sm_cmac_next_state();
934             sm_aes128_start(sm_cmac_k, const_zero, NULL);
935             break;
936         }
937         case CMAC_CALC_MI: {
938             int j;
939             sm_key_t y;
940             for (j=0;j<16;j++){
941                 y[j] = sm_cmac_x[j] ^ sm_cmac_get_byte(sm_cmac_block_current*16 + j);
942             }
943             sm_cmac_block_current++;
944             sm_cmac_next_state();
945             sm_aes128_start(sm_cmac_k, y, NULL);
946             break;
947         }
948         case CMAC_CALC_MLAST: {
949             int i;
950             sm_key_t y;
951             for (i=0;i<16;i++){
952                 y[i] = sm_cmac_x[i] ^ sm_cmac_m_last[i];
953             }
954             log_info_key("Y", y);
955             sm_cmac_block_current++;
956             sm_cmac_next_state();
957             sm_aes128_start(sm_cmac_k, y, NULL);
958             break;
959         }
960         default:
961             log_info("sm_cmac_handle_aes_engine_ready called in state %u", sm_cmac_state);
962             break;
963     }
964 }
965 
966 static void sm_cmac_handle_encryption_result(sm_key_t data){
967     switch (sm_cmac_state){
968         case CMAC_W4_SUBKEYS: {
969             sm_key_t k1;
970             memcpy(k1, data, 16);
971             sm_shift_left_by_one_bit_inplace(16, k1);
972             if (data[0] & 0x80){
973                 k1[15] ^= 0x87;
974             }
975             sm_key_t k2;
976             memcpy(k2, k1, 16);
977             sm_shift_left_by_one_bit_inplace(16, k2);
978             if (k1[0] & 0x80){
979                 k2[15] ^= 0x87;
980             }
981 
982             log_info_key("k", sm_cmac_k);
983             log_info_key("k1", k1);
984             log_info_key("k2", k2);
985 
986             // step 4: set m_last
987             int i;
988             if (sm_cmac_last_block_complete()){
989                 for (i=0;i<16;i++){
990                     sm_cmac_m_last[i] = sm_cmac_get_byte(sm_cmac_message_len - 16 + i) ^ k1[i];
991                 }
992             } else {
993                 int valid_octets_in_last_block = sm_cmac_message_len & 0x0f;
994                 for (i=0;i<16;i++){
995                     if (i < valid_octets_in_last_block){
996                         sm_cmac_m_last[i] = sm_cmac_get_byte((sm_cmac_message_len & 0xfff0) + i) ^ k2[i];
997                         continue;
998                     }
999                     if (i == valid_octets_in_last_block){
1000                         sm_cmac_m_last[i] = 0x80 ^ k2[i];
1001                         continue;
1002                     }
1003                     sm_cmac_m_last[i] = k2[i];
1004                 }
1005             }
1006 
1007             // next
1008             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
1009             break;
1010         }
1011         case CMAC_W4_MI:
1012             memcpy(sm_cmac_x, data, 16);
1013             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
1014             break;
1015         case CMAC_W4_MLAST:
1016             // done
1017             log_info("Setting CMAC Engine to IDLE");
1018             sm_cmac_state = CMAC_IDLE;
1019             log_info_key("CMAC", data);
1020             sm_cmac_done_handler(data);
1021             break;
1022         default:
1023             log_info("sm_cmac_handle_encryption_result called in state %u", sm_cmac_state);
1024             break;
1025     }
1026 }
1027 
1028 static void sm_trigger_user_response(sm_connection_t * sm_conn){
1029     // notify client for: JUST WORKS confirm, Numeric comparison confirm, PASSKEY display or input
1030     setup->sm_user_response = SM_USER_RESPONSE_IDLE;
1031     switch (setup->sm_stk_generation_method){
1032         case PK_RESP_INPUT:
1033             if (sm_conn->sm_role){
1034                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1035                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1036             } else {
1037                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1038             }
1039             break;
1040         case PK_INIT_INPUT:
1041             if (sm_conn->sm_role){
1042                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1043             } else {
1044                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1045                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1046             }
1047             break;
1048         case OK_BOTH_INPUT:
1049             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1050             sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1051             break;
1052         case NK_BOTH_INPUT:
1053             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1054             sm_notify_client_passkey(SM_EVENT_NUMERIC_COMPARISON_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1055             break;
1056         case JUST_WORKS:
1057             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1058             sm_notify_client_base(SM_EVENT_JUST_WORKS_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1059             break;
1060         case OOB:
1061             // client already provided OOB data, let's skip notification.
1062             break;
1063     }
1064 }
1065 
1066 static int sm_key_distribution_all_received(sm_connection_t * sm_conn){
1067     int recv_flags;
1068     if (sm_conn->sm_role){
1069         // slave / responder
1070         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres));
1071     } else {
1072         // master / initiator
1073         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
1074     }
1075     log_debug("sm_key_distribution_all_received: received 0x%02x, expecting 0x%02x", setup->sm_key_distribution_received_set, recv_flags);
1076     return recv_flags == setup->sm_key_distribution_received_set;
1077 }
1078 
1079 static void sm_done_for_handle(hci_con_handle_t con_handle){
1080     if (sm_active_connection == con_handle){
1081         sm_timeout_stop();
1082         sm_active_connection = 0;
1083         log_info("sm: connection 0x%x released setup context", con_handle);
1084     }
1085 }
1086 
1087 static int sm_key_distribution_flags_for_auth_req(void){
1088     int flags = SM_KEYDIST_ID_KEY | SM_KEYDIST_SIGN;
1089     if (sm_auth_req & SM_AUTHREQ_BONDING){
1090         // encryption information only if bonding requested
1091         flags |= SM_KEYDIST_ENC_KEY;
1092     }
1093     return flags;
1094 }
1095 
1096 static void sm_init_setup(sm_connection_t * sm_conn){
1097 
1098     // fill in sm setup
1099     setup->sm_state_vars = 0;
1100     sm_reset_tk();
1101     setup->sm_peer_addr_type = sm_conn->sm_peer_addr_type;
1102     memcpy(setup->sm_peer_address, sm_conn->sm_peer_address, 6);
1103 
1104     // query client for OOB data
1105     int have_oob_data = 0;
1106     if (sm_get_oob_data) {
1107         have_oob_data = (*sm_get_oob_data)(sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, setup->sm_tk);
1108     }
1109 
1110     sm_pairing_packet_t * local_packet;
1111     if (sm_conn->sm_role){
1112         // slave
1113         local_packet = &setup->sm_s_pres;
1114         gap_advertisements_get_address(&setup->sm_s_addr_type, setup->sm_s_address);
1115         setup->sm_m_addr_type = sm_conn->sm_peer_addr_type;
1116         memcpy(setup->sm_m_address, sm_conn->sm_peer_address, 6);
1117     } else {
1118         // master
1119         local_packet = &setup->sm_m_preq;
1120         gap_advertisements_get_address(&setup->sm_m_addr_type, setup->sm_m_address);
1121         setup->sm_s_addr_type = sm_conn->sm_peer_addr_type;
1122         memcpy(setup->sm_s_address, sm_conn->sm_peer_address, 6);
1123 
1124         int key_distribution_flags = sm_key_distribution_flags_for_auth_req();
1125         sm_pairing_packet_set_initiator_key_distribution(setup->sm_m_preq, key_distribution_flags);
1126         sm_pairing_packet_set_responder_key_distribution(setup->sm_m_preq, key_distribution_flags);
1127     }
1128 
1129     sm_pairing_packet_set_io_capability(*local_packet, sm_io_capabilities);
1130     sm_pairing_packet_set_oob_data_flag(*local_packet, have_oob_data);
1131     sm_pairing_packet_set_auth_req(*local_packet, sm_auth_req);
1132     sm_pairing_packet_set_max_encryption_key_size(*local_packet, sm_max_encryption_key_size);
1133 }
1134 
1135 static int sm_stk_generation_init(sm_connection_t * sm_conn){
1136 
1137     sm_pairing_packet_t * remote_packet;
1138     int                   remote_key_request;
1139     if (sm_conn->sm_role){
1140         // slave / responder
1141         remote_packet      = &setup->sm_m_preq;
1142         remote_key_request = sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq);
1143     } else {
1144         // master / initiator
1145         remote_packet      = &setup->sm_s_pres;
1146         remote_key_request = sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres);
1147     }
1148 
1149     // check key size
1150     sm_conn->sm_actual_encryption_key_size = sm_calc_actual_encryption_key_size(sm_pairing_packet_get_max_encryption_key_size(*remote_packet));
1151     if (sm_conn->sm_actual_encryption_key_size == 0) return SM_REASON_ENCRYPTION_KEY_SIZE;
1152 
1153     // decide on STK generation method
1154     sm_setup_tk();
1155     log_info("SMP: generation method %u", setup->sm_stk_generation_method);
1156 
1157     // check if STK generation method is acceptable by client
1158     if (!sm_validate_stk_generation_method()) return SM_REASON_AUTHENTHICATION_REQUIREMENTS;
1159 
1160     // identical to responder
1161     sm_setup_key_distribution(remote_key_request);
1162 
1163     // JUST WORKS doens't provide authentication
1164     sm_conn->sm_connection_authenticated = setup->sm_stk_generation_method == JUST_WORKS ? 0 : 1;
1165 
1166     return 0;
1167 }
1168 
1169 static void sm_address_resolution_handle_event(address_resolution_event_t event){
1170 
1171     // cache and reset context
1172     int matched_device_id = sm_address_resolution_test;
1173     address_resolution_mode_t mode = sm_address_resolution_mode;
1174     void * context = sm_address_resolution_context;
1175 
1176     // reset context
1177     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
1178     sm_address_resolution_context = NULL;
1179     sm_address_resolution_test = -1;
1180     hci_con_handle_t con_handle = 0;
1181 
1182     sm_connection_t * sm_connection;
1183     uint16_t ediv;
1184     switch (mode){
1185         case ADDRESS_RESOLUTION_GENERAL:
1186             break;
1187         case ADDRESS_RESOLUTION_FOR_CONNECTION:
1188             sm_connection = (sm_connection_t *) context;
1189             con_handle = sm_connection->sm_handle;
1190             switch (event){
1191                 case ADDRESS_RESOLUTION_SUCEEDED:
1192                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_SUCCEEDED;
1193                     sm_connection->sm_le_db_index = matched_device_id;
1194                     log_info("ADDRESS_RESOLUTION_SUCEEDED, index %d", sm_connection->sm_le_db_index);
1195                     if (sm_connection->sm_role) break;
1196                     if (!sm_connection->sm_bonding_requested && !sm_connection->sm_security_request_received) break;
1197                     sm_connection->sm_security_request_received = 0;
1198                     sm_connection->sm_bonding_requested = 0;
1199                     le_device_db_encryption_get(sm_connection->sm_le_db_index, &ediv, NULL, NULL, NULL, NULL, NULL);
1200                     if (ediv){
1201                         sm_connection->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
1202                     } else {
1203                         sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1204                     }
1205                     break;
1206                 case ADDRESS_RESOLUTION_FAILED:
1207                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_FAILED;
1208                     if (sm_connection->sm_role) break;
1209                     if (!sm_connection->sm_bonding_requested && !sm_connection->sm_security_request_received) break;
1210                     sm_connection->sm_security_request_received = 0;
1211                     sm_connection->sm_bonding_requested = 0;
1212                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1213                     break;
1214             }
1215             break;
1216         default:
1217             break;
1218     }
1219 
1220     switch (event){
1221         case ADDRESS_RESOLUTION_SUCEEDED:
1222             sm_notify_client_index(SM_EVENT_IDENTITY_RESOLVING_SUCCEEDED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address, matched_device_id);
1223             break;
1224         case ADDRESS_RESOLUTION_FAILED:
1225             sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_FAILED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address);
1226             break;
1227     }
1228 }
1229 
1230 static void sm_key_distribution_handle_all_received(sm_connection_t * sm_conn){
1231 
1232     int le_db_index = -1;
1233 
1234     // lookup device based on IRK
1235     if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
1236         int i;
1237         for (i=0; i < le_device_db_count(); i++){
1238             sm_key_t irk;
1239             bd_addr_t address;
1240             int address_type;
1241             le_device_db_info(i, &address_type, address, irk);
1242             if (memcmp(irk, setup->sm_peer_irk, 16) == 0){
1243                 log_info("sm: device found for IRK, updating");
1244                 le_db_index = i;
1245                 break;
1246             }
1247         }
1248     }
1249 
1250     // if not found, lookup via public address if possible
1251     log_info("sm peer addr type %u, peer addres %s", setup->sm_peer_addr_type, bd_addr_to_str(setup->sm_peer_address));
1252     if (le_db_index < 0 && setup->sm_peer_addr_type == BD_ADDR_TYPE_LE_PUBLIC){
1253         int i;
1254         for (i=0; i < le_device_db_count(); i++){
1255             bd_addr_t address;
1256             int address_type;
1257             le_device_db_info(i, &address_type, address, NULL);
1258             log_info("device %u, sm peer addr type %u, peer addres %s", i, address_type, bd_addr_to_str(address));
1259             if (address_type == BD_ADDR_TYPE_LE_PUBLIC && memcmp(address, setup->sm_peer_address, 6) == 0){
1260                 log_info("sm: device found for public address, updating");
1261                 le_db_index = i;
1262                 break;
1263             }
1264         }
1265     }
1266 
1267     // if not found, add to db
1268     if (le_db_index < 0) {
1269         le_db_index = le_device_db_add(setup->sm_peer_addr_type, setup->sm_peer_address, setup->sm_peer_irk);
1270     }
1271 
1272     if (le_db_index >= 0){
1273         le_device_db_local_counter_set(le_db_index, 0);
1274 
1275         // store local CSRK
1276         if (setup->sm_key_distribution_send_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1277             log_info("sm: store local CSRK");
1278             le_device_db_local_csrk_set(le_db_index, setup->sm_local_csrk);
1279             le_device_db_local_counter_set(le_db_index, 0);
1280         }
1281 
1282         // store remote CSRK
1283         if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1284             log_info("sm: store remote CSRK");
1285             le_device_db_remote_csrk_set(le_db_index, setup->sm_peer_csrk);
1286             le_device_db_remote_counter_set(le_db_index, 0);
1287         }
1288 
1289         // store encryption information
1290         if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION
1291             && setup->sm_key_distribution_received_set &  SM_KEYDIST_FLAG_MASTER_IDENTIFICATION){
1292             log_info("sm: set encryption information (key size %u, authenticatd %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
1293             le_device_db_encryption_set(le_db_index, setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1294                 sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
1295         }
1296     }
1297 
1298     // keep le_db_index
1299     sm_conn->sm_le_db_index = le_db_index;
1300 }
1301 
1302 static void sm_pairing_error(sm_connection_t * sm_conn, uint8_t reason){
1303     setup->sm_pairing_failed_reason = reason;
1304     sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1305 }
1306 
1307 static inline void sm_pdu_received_in_wrong_state(sm_connection_t * sm_conn){
1308     sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
1309 }
1310 
1311 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1312 
1313 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn);
1314 static int sm_passkey_used(stk_generation_method_t method);
1315 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method);
1316 
1317 static void sm_sc_start_calculating_local_confirm(sm_connection_t * sm_conn){
1318     if (sm_passkey_used(setup->sm_stk_generation_method)){
1319         sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
1320     } else {
1321         sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
1322     }
1323 }
1324 
1325 static void sm_sc_state_after_receiving_random(sm_connection_t * sm_conn){
1326     if (sm_conn->sm_role){
1327         // Responder
1328         sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
1329     } else {
1330         // Initiator role
1331         switch (setup->sm_stk_generation_method){
1332             case JUST_WORKS:
1333                 sm_sc_prepare_dhkey_check(sm_conn);
1334                 break;
1335 
1336             case NK_BOTH_INPUT:
1337                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_G2;
1338                 break;
1339             case PK_INIT_INPUT:
1340             case PK_RESP_INPUT:
1341             case OK_BOTH_INPUT:
1342                 if (setup->sm_passkey_bit < 20) {
1343                     sm_sc_start_calculating_local_confirm(sm_conn);
1344                 } else {
1345                     sm_sc_prepare_dhkey_check(sm_conn);
1346                 }
1347                 break;
1348             case OOB:
1349                 // TODO: implement SC OOB
1350                 break;
1351         }
1352     }
1353 }
1354 
1355 static uint8_t sm_sc_cmac_get_byte(uint16_t offset){
1356     return sm_cmac_sc_buffer[offset];
1357 }
1358 
1359 static void sm_sc_cmac_done(uint8_t * hash){
1360     log_info("sm_sc_cmac_done: ");
1361     log_info_hexdump(hash, 16);
1362 
1363     sm_connection_t * sm_conn = sm_cmac_connection;
1364     sm_cmac_connection = NULL;
1365 
1366     switch (sm_conn->sm_engine_state){
1367         case SM_SC_W4_CMAC_FOR_CONFIRMATION:
1368             memcpy(setup->sm_local_confirm, hash, 16);
1369             sm_conn->sm_engine_state = SM_SC_SEND_CONFIRMATION;
1370             break;
1371         case SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION:
1372             // check
1373             if (0 != memcmp(hash, setup->sm_peer_confirm, 16)){
1374                 sm_pairing_error(sm_conn, SM_REASON_CONFIRM_VALUE_FAILED);
1375                 break;
1376             }
1377             sm_sc_state_after_receiving_random(sm_conn);
1378             break;
1379         case SM_SC_W4_CALCULATE_G2: {
1380             uint32_t vab = big_endian_read_32(hash, 12) % 1000000;
1381             big_endian_store_32(setup->sm_tk, 12, vab);
1382             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
1383             sm_trigger_user_response(sm_conn);
1384             break;
1385         }
1386         case SM_SC_W4_CALCULATE_F5_SALT:
1387             memcpy(setup->sm_t, hash, 16);
1388             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_MACKEY;
1389             break;
1390         case SM_SC_W4_CALCULATE_F5_MACKEY:
1391             memcpy(setup->sm_mackey, hash, 16);
1392             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_LTK;
1393             break;
1394         case SM_SC_W4_CALCULATE_F5_LTK:
1395             memcpy(setup->sm_ltk, hash, 16);
1396             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK;
1397             break;
1398         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
1399             memcpy(setup->sm_local_dhkey_check, hash, 16);
1400             if (sm_conn->sm_role){
1401                 // responder
1402                 if (setup->sm_state_vars & SM_STATE_VAR_DHKEY_COMMAND_RECEIVED){
1403                     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
1404                 } else {
1405                     sm_conn->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
1406                 }
1407             } else {
1408                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1409             }
1410             break;
1411         case SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
1412             if (0 != memcmp(hash, setup->sm_peer_dhkey_check, 16) ){
1413                 sm_pairing_error(sm_conn, SM_REASON_DHKEY_CHECK_FAILED);
1414                 break;
1415             }
1416             if (sm_conn->sm_role){
1417                 // responder
1418                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1419             } else {
1420                 // initiator
1421                 sm_conn->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
1422             }
1423             break;
1424         default:
1425             log_error("sm_sc_cmac_done in state %u", sm_conn->sm_engine_state);
1426             break;
1427     }
1428     sm_run();
1429 }
1430 
1431 static void f4_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, uint8_t z){
1432     const uint16_t message_len = 65;
1433     sm_cmac_connection = sm_conn;
1434     memcpy(sm_cmac_sc_buffer, u, 32);
1435     memcpy(sm_cmac_sc_buffer+32, v, 32);
1436     sm_cmac_sc_buffer[64] = z;
1437     log_info("f4 key");
1438     log_info_hexdump(x, 16);
1439     log_info("f4 message");
1440     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1441     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1442 }
1443 
1444 static const sm_key_t f5_salt = { 0x6C ,0x88, 0x83, 0x91, 0xAA, 0xF5, 0xA5, 0x38, 0x60, 0x37, 0x0B, 0xDB, 0x5A, 0x60, 0x83, 0xBE};
1445 static const uint8_t f5_key_id[] = { 0x62, 0x74, 0x6c, 0x65 };
1446 static const uint8_t f5_length[] = { 0x01, 0x00};
1447 
1448 static void sm_sc_calculate_dhkey(sm_key256_t dhkey){
1449 #ifdef USE_MBEDTLS_FOR_ECDH
1450     // da * Pb
1451     mbedtls_ecp_group grp;
1452     mbedtls_ecp_group_init(&grp );
1453     mbedtls_ecp_group_load(&grp, MBEDTLS_ECP_DP_SECP256R1);
1454     mbedtls_ecp_point Q;
1455     mbedtls_ecp_point_init( &Q );
1456     mbedtls_mpi_read_binary(&Q.X, setup->sm_peer_qx, 32);
1457     mbedtls_mpi_read_binary(&Q.Y, setup->sm_peer_qy, 32);
1458     mbedtls_mpi_read_string(&Q.Z, 16, "1" );
1459     mbedtls_ecp_point DH;
1460     mbedtls_ecp_point_init(&DH);
1461     mbedtls_ecp_mul(&grp, &DH, &le_keypair.d, &Q, NULL, NULL);
1462     mbedtls_mpi_write_binary(&DH.X, dhkey, 32);
1463     mbedtls_ecp_point_free(&DH);
1464     mbedtls_ecp_point_free(&Q);
1465     mbedtls_ecp_group_free(&grp);
1466 #endif
1467     log_info("dhkey");
1468     log_info_hexdump(dhkey, 32);
1469 }
1470 
1471 static void f5_calculate_salt(sm_connection_t * sm_conn){
1472     // calculate DHKEY
1473     sm_key256_t dhkey;
1474     sm_sc_calculate_dhkey(dhkey);
1475 
1476     // calculate salt for f5
1477     const uint16_t message_len = 32;
1478     sm_cmac_connection = sm_conn;
1479     memcpy(sm_cmac_sc_buffer, dhkey, message_len);
1480     sm_cmac_general_start(f5_salt, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1481 }
1482 
1483 static inline void f5_mackkey(sm_connection_t * sm_conn, sm_key_t t, const sm_key_t n1, const sm_key_t n2, const sm_key56_t a1, const sm_key56_t a2){
1484     const uint16_t message_len = 53;
1485     sm_cmac_connection = sm_conn;
1486 
1487     // f5(W, N1, N2, A1, A2) = AES-CMACT (Counter = 0 || keyID || N1 || N2|| A1|| A2 || Length = 256) -- this is the MacKey
1488     sm_cmac_sc_buffer[0] = 0;
1489     memcpy(sm_cmac_sc_buffer+01, f5_key_id, 4);
1490     memcpy(sm_cmac_sc_buffer+05, n1, 16);
1491     memcpy(sm_cmac_sc_buffer+21, n2, 16);
1492     memcpy(sm_cmac_sc_buffer+37, a1, 7);
1493     memcpy(sm_cmac_sc_buffer+44, a2, 7);
1494     memcpy(sm_cmac_sc_buffer+51, f5_length, 2);
1495     log_info("f5 key");
1496     log_info_hexdump(t, 16);
1497     log_info("f5 message for MacKey");
1498     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1499     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1500 }
1501 
1502 static void f5_calculate_mackey(sm_connection_t * sm_conn){
1503     sm_key56_t bd_addr_master, bd_addr_slave;
1504     bd_addr_master[0] =  setup->sm_m_addr_type;
1505     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1506     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1507     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1508     if (sm_conn->sm_role){
1509         // responder
1510         f5_mackkey(sm_conn, setup->sm_t, setup->sm_peer_nonce, setup->sm_local_nonce, bd_addr_master, bd_addr_slave);
1511     } else {
1512         // initiator
1513         f5_mackkey(sm_conn, setup->sm_t, setup->sm_local_nonce, setup->sm_peer_nonce, bd_addr_master, bd_addr_slave);
1514     }
1515 }
1516 
1517 // note: must be called right after f5_mackey, as sm_cmac_buffer[1..52] will be reused
1518 static inline void f5_ltk(sm_connection_t * sm_conn, sm_key_t t){
1519     const uint16_t message_len = 53;
1520     sm_cmac_connection = sm_conn;
1521     sm_cmac_sc_buffer[0] = 1;
1522     // 1..52 setup before
1523     log_info("f5 key");
1524     log_info_hexdump(t, 16);
1525     log_info("f5 message for LTK");
1526     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1527     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1528 }
1529 
1530 static void f5_calculate_ltk(sm_connection_t * sm_conn){
1531     f5_ltk(sm_conn, setup->sm_t);
1532 }
1533 
1534 static void f6_engine(sm_connection_t * sm_conn, const sm_key_t w, const sm_key_t n1, const sm_key_t n2, const sm_key_t r, const sm_key24_t io_cap, const sm_key56_t a1, const sm_key56_t a2){
1535     const uint16_t message_len = 65;
1536     sm_cmac_connection = sm_conn;
1537     memcpy(sm_cmac_sc_buffer, n1, 16);
1538     memcpy(sm_cmac_sc_buffer+16, n2, 16);
1539     memcpy(sm_cmac_sc_buffer+32, r, 16);
1540     memcpy(sm_cmac_sc_buffer+48, io_cap, 3);
1541     memcpy(sm_cmac_sc_buffer+51, a1, 7);
1542     memcpy(sm_cmac_sc_buffer+58, a2, 7);
1543     log_info("f6 key");
1544     log_info_hexdump(w, 16);
1545     log_info("f6 message");
1546     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1547     sm_cmac_general_start(w, 65, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1548 }
1549 
1550 // g2(U, V, X, Y) = AES-CMACX(U || V || Y) mod 2^32
1551 // - U is 256 bits
1552 // - V is 256 bits
1553 // - X is 128 bits
1554 // - Y is 128 bits
1555 static void g2_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, const sm_key_t y){
1556     const uint16_t message_len = 80;
1557     sm_cmac_connection = sm_conn;
1558     memcpy(sm_cmac_sc_buffer, u, 32);
1559     memcpy(sm_cmac_sc_buffer+32, v, 32);
1560     memcpy(sm_cmac_sc_buffer+64, y, 16);
1561     log_info("g2 key");
1562     log_info_hexdump(x, 16);
1563     log_info("g2 message");
1564     log_info_hexdump(sm_cmac_sc_buffer, sizeof(sm_cmac_sc_buffer));
1565     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1566 }
1567 
1568 static void g2_calculate(sm_connection_t * sm_conn) {
1569     // calc Va if numeric comparison
1570     uint8_t value[32];
1571     mbedtls_mpi_write_binary(&le_keypair.Q.X, value, sizeof(value));
1572     if (sm_conn->sm_role){
1573         // responder
1574         g2_engine(sm_conn, setup->sm_peer_qx, value, setup->sm_peer_nonce, setup->sm_local_nonce);;
1575     } else {
1576         // initiator
1577         g2_engine(sm_conn, value, setup->sm_peer_qx, setup->sm_local_nonce, setup->sm_peer_nonce);
1578     }
1579 }
1580 
1581 static void sm_sc_calculate_local_confirm(sm_connection_t * sm_conn){
1582     uint8_t z = 0;
1583     if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT){
1584         // some form of passkey
1585         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1586         z = 0x80 | ((pk >> setup->sm_passkey_bit) & 1);
1587         setup->sm_passkey_bit++;
1588     }
1589 #ifdef USE_MBEDTLS_FOR_ECDH
1590     uint8_t local_qx[32];
1591     mbedtls_mpi_write_binary(&le_keypair.Q.X, local_qx, sizeof(local_qx));
1592 #endif
1593     f4_engine(sm_conn, local_qx, setup->sm_peer_qx, setup->sm_local_nonce, z);
1594 }
1595 
1596 static void sm_sc_calculate_remote_confirm(sm_connection_t * sm_conn){
1597     uint8_t z = 0;
1598     if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT){
1599         // some form of passkey
1600         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1601         // sm_passkey_bit was increased before sending confirm value
1602         z = 0x80 | ((pk >> (setup->sm_passkey_bit-1)) & 1);
1603     }
1604 #ifdef USE_MBEDTLS_FOR_ECDH
1605     uint8_t local_qx[32];
1606     mbedtls_mpi_write_binary(&le_keypair.Q.X, local_qx, sizeof(local_qx));
1607 #endif
1608     f4_engine(sm_conn, setup->sm_peer_qx, local_qx, setup->sm_peer_nonce, z);
1609 }
1610 
1611 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn){
1612     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_SALT;
1613 }
1614 
1615 static void sm_sc_calculate_f6_for_dhkey_check(sm_connection_t * sm_conn){
1616     // calculate DHKCheck
1617     sm_key56_t bd_addr_master, bd_addr_slave;
1618     bd_addr_master[0] =  setup->sm_m_addr_type;
1619     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1620     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1621     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1622     uint8_t iocap_a[3];
1623     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1624     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1625     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1626     uint8_t iocap_b[3];
1627     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1628     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1629     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1630     if (sm_conn->sm_role){
1631         // responder
1632         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1633     } else {
1634         // initiator
1635         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1636     }
1637 }
1638 
1639 static void sm_sc_calculate_f6_to_verify_dhkey_check(sm_connection_t * sm_conn){
1640     // validate E = f6()
1641     sm_key56_t bd_addr_master, bd_addr_slave;
1642     bd_addr_master[0] =  setup->sm_m_addr_type;
1643     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1644     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1645     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1646 
1647     uint8_t iocap_a[3];
1648     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1649     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1650     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1651     uint8_t iocap_b[3];
1652     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1653     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1654     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1655     if (sm_conn->sm_role){
1656         // responder
1657         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1658     } else {
1659         // initiator
1660         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1661     }
1662 }
1663 #endif
1664 
1665 static void sm_load_security_info(sm_connection_t * sm_connection){
1666     int encryption_key_size;
1667     int authenticated;
1668     int authorized;
1669 
1670     // fetch data from device db - incl. authenticated/authorized/key size. Note all sm_connection_X require encryption enabled
1671     le_device_db_encryption_get(sm_connection->sm_le_db_index, &setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1672                                 &encryption_key_size, &authenticated, &authorized);
1673     log_info("db index %u, key size %u, authenticated %u, authorized %u", sm_connection->sm_le_db_index, encryption_key_size, authenticated, authorized);
1674     sm_connection->sm_actual_encryption_key_size = encryption_key_size;
1675     sm_connection->sm_connection_authenticated = authenticated;
1676     sm_connection->sm_connection_authorization_state = authorized ? AUTHORIZATION_GRANTED : AUTHORIZATION_UNKNOWN;
1677 }
1678 
1679 static void sm_run(void){
1680 
1681     btstack_linked_list_iterator_t it;
1682 
1683     // assert that we can send at least commands
1684     if (!hci_can_send_command_packet_now()) return;
1685 
1686     //
1687     // non-connection related behaviour
1688     //
1689 
1690     // distributed key generation
1691     switch (dkg_state){
1692         case DKG_CALC_IRK:
1693             // already busy?
1694             if (sm_aes128_state == SM_AES128_IDLE) {
1695                 // IRK = d1(IR, 1, 0)
1696                 sm_key_t d1_prime;
1697                 sm_d1_d_prime(1, 0, d1_prime);  // plaintext
1698                 dkg_next_state();
1699                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
1700                 return;
1701             }
1702             break;
1703         case DKG_CALC_DHK:
1704             // already busy?
1705             if (sm_aes128_state == SM_AES128_IDLE) {
1706                 // DHK = d1(IR, 3, 0)
1707                 sm_key_t d1_prime;
1708                 sm_d1_d_prime(3, 0, d1_prime);  // plaintext
1709                 dkg_next_state();
1710                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
1711                 return;
1712             }
1713             break;
1714         default:
1715             break;
1716     }
1717 
1718 #ifdef USE_MBEDTLS_FOR_ECDH
1719     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
1720         sm_random_start(NULL);
1721         return;
1722     }
1723 #endif
1724 
1725     // random address updates
1726     switch (rau_state){
1727         case RAU_GET_RANDOM:
1728             rau_next_state();
1729             sm_random_start(NULL);
1730             return;
1731         case RAU_GET_ENC:
1732             // already busy?
1733             if (sm_aes128_state == SM_AES128_IDLE) {
1734                 sm_key_t r_prime;
1735                 sm_ah_r_prime(sm_random_address, r_prime);
1736                 rau_next_state();
1737                 sm_aes128_start(sm_persistent_irk, r_prime, NULL);
1738                 return;
1739             }
1740             break;
1741         case RAU_SET_ADDRESS:
1742             log_info("New random address: %s", bd_addr_to_str(sm_random_address));
1743             rau_state = RAU_IDLE;
1744             hci_send_cmd(&hci_le_set_random_address, sm_random_address);
1745             return;
1746         default:
1747             break;
1748     }
1749 
1750     // CMAC
1751     switch (sm_cmac_state){
1752         case CMAC_CALC_SUBKEYS:
1753         case CMAC_CALC_MI:
1754         case CMAC_CALC_MLAST:
1755             // already busy?
1756             if (sm_aes128_state == SM_AES128_ACTIVE) break;
1757             sm_cmac_handle_aes_engine_ready();
1758             return;
1759         default:
1760             break;
1761     }
1762 
1763     // CSRK Lookup
1764     // -- if csrk lookup ready, find connection that require csrk lookup
1765     if (sm_address_resolution_idle()){
1766         hci_connections_get_iterator(&it);
1767         while(btstack_linked_list_iterator_has_next(&it)){
1768             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1769             sm_connection_t  * sm_connection  = &hci_connection->sm_connection;
1770             if (sm_connection->sm_irk_lookup_state == IRK_LOOKUP_W4_READY){
1771                 // and start lookup
1772                 sm_address_resolution_start_lookup(sm_connection->sm_peer_addr_type, sm_connection->sm_handle, sm_connection->sm_peer_address, ADDRESS_RESOLUTION_FOR_CONNECTION, sm_connection);
1773                 sm_connection->sm_irk_lookup_state = IRK_LOOKUP_STARTED;
1774                 break;
1775             }
1776         }
1777     }
1778 
1779     // -- if csrk lookup ready, resolved addresses for received addresses
1780     if (sm_address_resolution_idle()) {
1781         if (!btstack_linked_list_empty(&sm_address_resolution_general_queue)){
1782             sm_lookup_entry_t * entry = (sm_lookup_entry_t *) sm_address_resolution_general_queue;
1783             btstack_linked_list_remove(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
1784             sm_address_resolution_start_lookup(entry->address_type, 0, entry->address, ADDRESS_RESOLUTION_GENERAL, NULL);
1785             btstack_memory_sm_lookup_entry_free(entry);
1786         }
1787     }
1788 
1789     // -- Continue with CSRK device lookup by public or resolvable private address
1790     if (!sm_address_resolution_idle()){
1791         log_info("LE Device Lookup: device %u/%u", sm_address_resolution_test, le_device_db_count());
1792         while (sm_address_resolution_test < le_device_db_count()){
1793             int addr_type;
1794             bd_addr_t addr;
1795             sm_key_t irk;
1796             le_device_db_info(sm_address_resolution_test, &addr_type, addr, irk);
1797             log_info("device type %u, addr: %s", addr_type, bd_addr_to_str(addr));
1798 
1799             if (sm_address_resolution_addr_type == addr_type && memcmp(addr, sm_address_resolution_address, 6) == 0){
1800                 log_info("LE Device Lookup: found CSRK by { addr_type, address} ");
1801                 sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
1802                 break;
1803             }
1804 
1805             if (sm_address_resolution_addr_type == 0){
1806                 sm_address_resolution_test++;
1807                 continue;
1808             }
1809 
1810             if (sm_aes128_state == SM_AES128_ACTIVE) break;
1811 
1812             log_info("LE Device Lookup: calculate AH");
1813             log_info_key("IRK", irk);
1814 
1815             sm_key_t r_prime;
1816             sm_ah_r_prime(sm_address_resolution_address, r_prime);
1817             sm_address_resolution_ah_calculation_active = 1;
1818             sm_aes128_start(irk, r_prime, sm_address_resolution_context);   // keep context
1819             return;
1820         }
1821 
1822         if (sm_address_resolution_test >= le_device_db_count()){
1823             log_info("LE Device Lookup: not found");
1824             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_FAILED);
1825         }
1826     }
1827 
1828 
1829     //
1830     // active connection handling
1831     // -- use loop to handle next connection if lock on setup context is released
1832 
1833     while (1) {
1834 
1835         // Find connections that requires setup context and make active if no other is locked
1836         hci_connections_get_iterator(&it);
1837         while(!sm_active_connection && btstack_linked_list_iterator_has_next(&it)){
1838             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1839             sm_connection_t  * sm_connection = &hci_connection->sm_connection;
1840             // - if no connection locked and we're ready/waiting for setup context, fetch it and start
1841             int done = 1;
1842             int err;
1843             switch (sm_connection->sm_engine_state) {
1844                 case SM_RESPONDER_SEND_SECURITY_REQUEST:
1845                     // send packet if possible,
1846                     if (l2cap_can_send_fixed_channel_packet_now(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)){
1847                         const uint8_t buffer[2] = { SM_CODE_SECURITY_REQUEST, SM_AUTHREQ_BONDING};
1848                         sm_connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_REQUEST;
1849                         l2cap_send_connectionless(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
1850                     } else {
1851                         l2cap_request_can_send_fix_channel_now_event(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
1852                     }
1853                     // don't lock sxetup context yet
1854                     done = 0;
1855                     break;
1856                 case SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED:
1857                     sm_init_setup(sm_connection);
1858                     // recover pairing request
1859                     memcpy(&setup->sm_m_preq, &sm_connection->sm_m_preq, sizeof(sm_pairing_packet_t));
1860                     err = sm_stk_generation_init(sm_connection);
1861                     if (err){
1862                         setup->sm_pairing_failed_reason = err;
1863                         sm_connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1864                         break;
1865                     }
1866                     sm_timeout_start(sm_connection);
1867                     // generate random number first, if we need to show passkey
1868                     if (setup->sm_stk_generation_method == PK_INIT_INPUT){
1869                         sm_connection->sm_engine_state = SM_PH2_GET_RANDOM_TK;
1870                         break;
1871                     }
1872                     sm_connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
1873                     break;
1874                 case SM_INITIATOR_PH0_HAS_LTK:
1875                     sm_load_security_info(sm_connection);
1876                     sm_connection->sm_engine_state = SM_INITIATOR_PH0_SEND_START_ENCRYPTION;
1877                     break;
1878                 case SM_RESPONDER_PH0_RECEIVED_LTK:
1879                     switch (sm_connection->sm_irk_lookup_state){
1880                         case IRK_LOOKUP_SUCCEEDED:{
1881                                 sm_load_security_info(sm_connection);
1882                                 sm_connection->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
1883                                 break;
1884                             }
1885                         case IRK_LOOKUP_FAILED:
1886                             // assume that we don't have a LTK for ediv == 0 and random == null
1887                             if (sm_connection->sm_local_ediv == 0 && sm_is_null_random(sm_connection->sm_local_rand)){
1888                                 log_info("LTK Request: ediv & random are empty");
1889                                 sm_connection->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
1890                                 // TODO: no need to lock context yet -> done = 0;
1891                                 break;
1892                             }
1893                             // re-establish previously used LTK using Rand and EDIV
1894                             memcpy(setup->sm_local_rand, sm_connection->sm_local_rand, 8);
1895                             setup->sm_local_ediv = sm_connection->sm_local_ediv;
1896                             // re-establish used key encryption size
1897                             // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
1898                             sm_connection->sm_actual_encryption_key_size = (setup->sm_local_rand[7] & 0x0f) + 1;
1899                             // no db for authenticated flag hack: flag is stored in bit 4 of LSB
1900                             sm_connection->sm_connection_authenticated = (setup->sm_local_rand[7] & 0x10) >> 4;
1901                             log_info("sm: received ltk request with key size %u, authenticated %u",
1902                                     sm_connection->sm_actual_encryption_key_size, sm_connection->sm_connection_authenticated);
1903                             sm_connection->sm_engine_state = SM_RESPONDER_PH4_Y_GET_ENC;
1904                             break;
1905                         default:
1906                             // just wait until IRK lookup is completed
1907                             // don't lock sxetup context yet
1908                             done = 0;
1909                             break;
1910                     }
1911                     break;
1912                 case SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST:
1913                     sm_init_setup(sm_connection);
1914                     sm_timeout_start(sm_connection);
1915                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_SEND_PAIRING_REQUEST;
1916                     break;
1917                 default:
1918                     done = 0;
1919                     break;
1920             }
1921             if (done){
1922                 sm_active_connection = sm_connection->sm_handle;
1923                 log_info("sm: connection 0x%04x locked setup context as %s", sm_active_connection, sm_connection->sm_role ? "responder" : "initiator");
1924             }
1925         }
1926 
1927         //
1928         // active connection handling
1929         //
1930 
1931         if (sm_active_connection == 0) return;
1932 
1933         // assert that we could send a SM PDU - not needed for all of the following
1934         if (!l2cap_can_send_fixed_channel_packet_now(sm_active_connection, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)) {
1935             l2cap_request_can_send_fix_channel_now_event(sm_active_connection, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
1936             return;
1937         }
1938 
1939         sm_connection_t * connection = sm_get_connection_for_handle(sm_active_connection);
1940         if (!connection) return;
1941 
1942         sm_key_t plaintext;
1943         int key_distribution_flags;
1944 
1945         log_info("sm_run: state %u", connection->sm_engine_state);
1946 
1947         // responding state
1948         switch (connection->sm_engine_state){
1949 
1950             // general
1951             case SM_GENERAL_SEND_PAIRING_FAILED: {
1952                 uint8_t buffer[2];
1953                 buffer[0] = SM_CODE_PAIRING_FAILED;
1954                 buffer[1] = setup->sm_pairing_failed_reason;
1955                 connection->sm_engine_state = connection->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
1956                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
1957                 sm_done_for_handle(connection->sm_handle);
1958                 break;
1959             }
1960 
1961 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1962             case SM_SC_W2_GET_RANDOM_A:
1963                 sm_random_start(connection);
1964                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_A;
1965                 break;
1966             case SM_SC_W2_GET_RANDOM_B:
1967                 sm_random_start(connection);
1968                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_B;
1969                 break;
1970             case SM_SC_W2_CMAC_FOR_CONFIRMATION:
1971                 if (!sm_cmac_ready()) break;
1972                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CONFIRMATION;
1973                 sm_sc_calculate_local_confirm(connection);
1974                 break;
1975             case SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION:
1976                 if (!sm_cmac_ready()) break;
1977                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION;
1978                 sm_sc_calculate_remote_confirm(connection);
1979                 break;
1980             case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
1981                 if (!sm_cmac_ready()) break;
1982                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK;
1983                 sm_sc_calculate_f6_for_dhkey_check(connection);
1984                 break;
1985             case SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
1986                 if (!sm_cmac_ready()) break;
1987                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
1988                 sm_sc_calculate_f6_to_verify_dhkey_check(connection);
1989                 break;
1990             case SM_SC_W2_CALCULATE_F5_SALT:
1991                 if (!sm_cmac_ready()) break;
1992                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_SALT;
1993                 f5_calculate_salt(connection);
1994                 break;
1995             case SM_SC_W2_CALCULATE_F5_MACKEY:
1996                 if (!sm_cmac_ready()) break;
1997                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_MACKEY;
1998                 f5_calculate_mackey(connection);
1999                 break;
2000             case SM_SC_W2_CALCULATE_F5_LTK:
2001                 if (!sm_cmac_ready()) break;
2002                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_LTK;
2003                 f5_calculate_ltk(connection);
2004                 break;
2005             case SM_SC_W2_CALCULATE_G2:
2006                 if (!sm_cmac_ready()) break;
2007                 connection->sm_engine_state = SM_SC_W4_CALCULATE_G2;
2008                 g2_calculate(connection);
2009                 break;
2010 
2011 #endif
2012             // initiator side
2013             case SM_INITIATOR_PH0_SEND_START_ENCRYPTION: {
2014                 sm_key_t peer_ltk_flipped;
2015                 reverse_128(setup->sm_peer_ltk, peer_ltk_flipped);
2016                 connection->sm_engine_state = SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED;
2017                 log_info("sm: hci_le_start_encryption ediv 0x%04x", setup->sm_peer_ediv);
2018                 uint32_t rand_high = big_endian_read_32(setup->sm_peer_rand, 0);
2019                 uint32_t rand_low  = big_endian_read_32(setup->sm_peer_rand, 4);
2020                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle,rand_low, rand_high, setup->sm_peer_ediv, peer_ltk_flipped);
2021                 return;
2022             }
2023 
2024             case SM_INITIATOR_PH1_SEND_PAIRING_REQUEST:
2025                 sm_pairing_packet_set_code(setup->sm_m_preq, SM_CODE_PAIRING_REQUEST);
2026                 connection->sm_engine_state = SM_INITIATOR_PH1_W4_PAIRING_RESPONSE;
2027                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_m_preq, sizeof(sm_pairing_packet_t));
2028                 sm_timeout_reset(connection);
2029                 break;
2030 
2031             // responder side
2032             case SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY:
2033                 connection->sm_engine_state = SM_RESPONDER_IDLE;
2034                 hci_send_cmd(&hci_le_long_term_key_negative_reply, connection->sm_handle);
2035                 sm_done_for_handle(connection->sm_handle);
2036                 return;
2037 
2038 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2039             case SM_SC_SEND_PUBLIC_KEY_COMMAND: {
2040                 uint8_t buffer[65];
2041                 buffer[0] = SM_CODE_PAIRING_PUBLIC_KEY;
2042                 //
2043 #ifdef USE_MBEDTLS_FOR_ECDH
2044                 uint8_t value[32];
2045                 mbedtls_mpi_write_binary(&le_keypair.Q.X, value, sizeof(value));
2046                 reverse_256(value, &buffer[1]);
2047                 mbedtls_mpi_write_binary(&le_keypair.Q.Y, value, sizeof(value));
2048                 reverse_256(value, &buffer[33]);
2049 #endif
2050 
2051                 // stk generation method
2052                 // passkey entry: notify app to show passkey or to request passkey
2053                 switch (setup->sm_stk_generation_method){
2054                     case JUST_WORKS:
2055                     case NK_BOTH_INPUT:
2056                         if (connection->sm_role){
2057                             // responder
2058                             sm_sc_start_calculating_local_confirm(connection);
2059                         } else {
2060                             // initiator
2061                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2062                         }
2063                         break;
2064                     case PK_INIT_INPUT:
2065                     case PK_RESP_INPUT:
2066                     case OK_BOTH_INPUT:
2067                         // use random TK for display
2068                         memcpy(setup->sm_ra, setup->sm_tk, 16);
2069                         memcpy(setup->sm_rb, setup->sm_tk, 16);
2070                         setup->sm_passkey_bit = 0;
2071 
2072                         if (connection->sm_role){
2073                             // responder
2074                             connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2075                         } else {
2076                             // initiator
2077                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2078                         }
2079                         sm_trigger_user_response(connection);
2080                         break;
2081                     case OOB:
2082                         // TODO: implement SC OOB
2083                         break;
2084                 }
2085 
2086                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2087                 sm_timeout_reset(connection);
2088                 break;
2089             }
2090             case SM_SC_SEND_CONFIRMATION: {
2091                 uint8_t buffer[17];
2092                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2093                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2094                 if (connection->sm_role){
2095                     connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2096                 } else {
2097                     connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2098                 }
2099                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2100                 sm_timeout_reset(connection);
2101                 break;
2102             }
2103             case SM_SC_SEND_PAIRING_RANDOM: {
2104                 uint8_t buffer[17];
2105                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2106                 reverse_128(setup->sm_local_nonce, &buffer[1]);
2107                 if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT && setup->sm_passkey_bit < 20){
2108                     if (connection->sm_role){
2109                         // responder
2110                         connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2111                     } else {
2112                         // initiator
2113                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2114                     }
2115                 } else {
2116                     if (connection->sm_role){
2117                         // responder
2118                         if (setup->sm_stk_generation_method == NK_BOTH_INPUT){
2119                             connection->sm_engine_state = SM_SC_W2_CALCULATE_G2;
2120                         } else {
2121                             sm_sc_prepare_dhkey_check(connection);
2122                         }
2123                     } else {
2124                         // initiator
2125                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2126                     }
2127                 }
2128                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2129                 sm_timeout_reset(connection);
2130                 break;
2131             }
2132             case SM_SC_SEND_DHKEY_CHECK_COMMAND: {
2133                 uint8_t buffer[17];
2134                 buffer[0] = SM_CODE_PAIRING_DHKEY_CHECK;
2135                 reverse_128(setup->sm_local_dhkey_check, &buffer[1]);
2136 
2137                 if (connection->sm_role){
2138                     connection->sm_engine_state = SM_SC_W4_LTK_REQUEST_SC;
2139                 } else {
2140                     connection->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
2141                 }
2142 
2143                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2144                 sm_timeout_reset(connection);
2145                 break;
2146             }
2147 
2148 #endif
2149             case SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE:
2150                 // echo initiator for now
2151                 sm_pairing_packet_set_code(setup->sm_s_pres,SM_CODE_PAIRING_RESPONSE);
2152                 key_distribution_flags = sm_key_distribution_flags_for_auth_req();
2153 
2154                 connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_CONFIRM;
2155 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2156                 if (setup->sm_use_secure_connections){
2157                     connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2158                     // skip LTK/EDIV for SC
2159                     log_info("sm: dropping encryption information flag");
2160                     key_distribution_flags &= ~SM_KEYDIST_ENC_KEY;
2161                 }
2162 #endif
2163                 sm_pairing_packet_set_initiator_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_initiator_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2164                 sm_pairing_packet_set_responder_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2165                 // update key distribution after ENC was dropped
2166                 sm_setup_key_distribution(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
2167 
2168                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_s_pres, sizeof(sm_pairing_packet_t));
2169                 sm_timeout_reset(connection);
2170                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
2171                 if (setup->sm_stk_generation_method == JUST_WORKS){
2172                     sm_trigger_user_response(connection);
2173                 }
2174                 return;
2175 
2176             case SM_PH2_SEND_PAIRING_RANDOM: {
2177                 uint8_t buffer[17];
2178                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2179                 reverse_128(setup->sm_local_random, &buffer[1]);
2180                 if (connection->sm_role){
2181                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_LTK_REQUEST;
2182                 } else {
2183                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_RANDOM;
2184                 }
2185                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2186                 sm_timeout_reset(connection);
2187                 break;
2188             }
2189 
2190             case SM_PH2_GET_RANDOM_TK:
2191             case SM_PH2_C1_GET_RANDOM_A:
2192             case SM_PH2_C1_GET_RANDOM_B:
2193             case SM_PH3_GET_RANDOM:
2194             case SM_PH3_GET_DIV:
2195                 sm_next_responding_state(connection);
2196                 sm_random_start(connection);
2197                 return;
2198 
2199             case SM_PH2_C1_GET_ENC_B:
2200             case SM_PH2_C1_GET_ENC_D:
2201                 // already busy?
2202                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2203                 sm_next_responding_state(connection);
2204                 sm_aes128_start(setup->sm_tk, setup->sm_c1_t3_value, connection);
2205                 return;
2206 
2207             case SM_PH3_LTK_GET_ENC:
2208             case SM_RESPONDER_PH4_LTK_GET_ENC:
2209                 // already busy?
2210                 if (sm_aes128_state == SM_AES128_IDLE) {
2211                     sm_key_t d_prime;
2212                     sm_d1_d_prime(setup->sm_local_div, 0, d_prime);
2213                     sm_next_responding_state(connection);
2214                     sm_aes128_start(sm_persistent_er, d_prime, connection);
2215                     return;
2216                 }
2217                 break;
2218 
2219             case SM_PH3_CSRK_GET_ENC:
2220                 // already busy?
2221                 if (sm_aes128_state == SM_AES128_IDLE) {
2222                     sm_key_t d_prime;
2223                     sm_d1_d_prime(setup->sm_local_div, 1, d_prime);
2224                     sm_next_responding_state(connection);
2225                     sm_aes128_start(sm_persistent_er, d_prime, connection);
2226                     return;
2227                 }
2228                 break;
2229 
2230             case SM_PH2_C1_GET_ENC_C:
2231                 // already busy?
2232                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2233                 // calculate m_confirm using aes128 engine - step 1
2234                 sm_c1_t1(setup->sm_peer_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
2235                 sm_next_responding_state(connection);
2236                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2237                 break;
2238             case SM_PH2_C1_GET_ENC_A:
2239                 // already busy?
2240                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2241                 // calculate confirm using aes128 engine - step 1
2242                 sm_c1_t1(setup->sm_local_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
2243                 sm_next_responding_state(connection);
2244                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2245                 break;
2246             case SM_PH2_CALC_STK:
2247                 // already busy?
2248                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2249                 // calculate STK
2250                 if (connection->sm_role){
2251                     sm_s1_r_prime(setup->sm_local_random, setup->sm_peer_random, plaintext);
2252                 } else {
2253                     sm_s1_r_prime(setup->sm_peer_random, setup->sm_local_random, plaintext);
2254                 }
2255                 sm_next_responding_state(connection);
2256                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2257                 break;
2258             case SM_PH3_Y_GET_ENC:
2259                 // already busy?
2260                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2261                 // PH3B2 - calculate Y from      - enc
2262                 // Y = dm(DHK, Rand)
2263                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
2264                 sm_next_responding_state(connection);
2265                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
2266                 return;
2267             case SM_PH2_C1_SEND_PAIRING_CONFIRM: {
2268                 uint8_t buffer[17];
2269                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2270                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2271                 if (connection->sm_role){
2272                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_PAIRING_RANDOM;
2273                 } else {
2274                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_CONFIRM;
2275                 }
2276                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2277                 sm_timeout_reset(connection);
2278                 return;
2279             }
2280             case SM_RESPONDER_PH2_SEND_LTK_REPLY: {
2281                 sm_key_t stk_flipped;
2282                 reverse_128(setup->sm_ltk, stk_flipped);
2283                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2284                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, stk_flipped);
2285                 return;
2286             }
2287             case SM_INITIATOR_PH3_SEND_START_ENCRYPTION: {
2288                 sm_key_t stk_flipped;
2289                 reverse_128(setup->sm_ltk, stk_flipped);
2290                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2291                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle, 0, 0, 0, stk_flipped);
2292                 return;
2293             }
2294             case SM_RESPONDER_PH4_SEND_LTK: {
2295                 sm_key_t ltk_flipped;
2296                 reverse_128(setup->sm_ltk, ltk_flipped);
2297                 connection->sm_engine_state = SM_RESPONDER_IDLE;
2298                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, ltk_flipped);
2299                 return;
2300             }
2301             case SM_RESPONDER_PH4_Y_GET_ENC:
2302                 // already busy?
2303                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2304                 log_info("LTK Request: recalculating with ediv 0x%04x", setup->sm_local_ediv);
2305                 // Y = dm(DHK, Rand)
2306                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
2307                 sm_next_responding_state(connection);
2308                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
2309                 return;
2310 
2311             case SM_PH3_DISTRIBUTE_KEYS:
2312                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION){
2313                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
2314                     uint8_t buffer[17];
2315                     buffer[0] = SM_CODE_ENCRYPTION_INFORMATION;
2316                     reverse_128(setup->sm_ltk, &buffer[1]);
2317                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2318                     sm_timeout_reset(connection);
2319                     return;
2320                 }
2321                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_MASTER_IDENTIFICATION){
2322                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
2323                     uint8_t buffer[11];
2324                     buffer[0] = SM_CODE_MASTER_IDENTIFICATION;
2325                     little_endian_store_16(buffer, 1, setup->sm_local_ediv);
2326                     reverse_64(setup->sm_local_rand, &buffer[3]);
2327                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2328                     sm_timeout_reset(connection);
2329                     return;
2330                 }
2331                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
2332                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
2333                     uint8_t buffer[17];
2334                     buffer[0] = SM_CODE_IDENTITY_INFORMATION;
2335                     reverse_128(sm_persistent_irk, &buffer[1]);
2336                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2337                     sm_timeout_reset(connection);
2338                     return;
2339                 }
2340                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION){
2341                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
2342                     bd_addr_t local_address;
2343                     uint8_t buffer[8];
2344                     buffer[0] = SM_CODE_IDENTITY_ADDRESS_INFORMATION;
2345                     gap_advertisements_get_address(&buffer[1], local_address);
2346                     reverse_bd_addr(local_address, &buffer[2]);
2347                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2348                     sm_timeout_reset(connection);
2349                     return;
2350                 }
2351                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
2352                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
2353 
2354                     // hack to reproduce test runs
2355                     if (test_use_fixed_local_csrk){
2356                         memset(setup->sm_local_csrk, 0xcc, 16);
2357                     }
2358 
2359                     uint8_t buffer[17];
2360                     buffer[0] = SM_CODE_SIGNING_INFORMATION;
2361                     reverse_128(setup->sm_local_csrk, &buffer[1]);
2362                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2363                     sm_timeout_reset(connection);
2364                     return;
2365                 }
2366 
2367                 // keys are sent
2368                 if (connection->sm_role){
2369                     // slave -> receive master keys if any
2370                     if (sm_key_distribution_all_received(connection)){
2371                         sm_key_distribution_handle_all_received(connection);
2372                         connection->sm_engine_state = SM_RESPONDER_IDLE;
2373                         sm_done_for_handle(connection->sm_handle);
2374                     } else {
2375                         connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2376                     }
2377                 } else {
2378                     // master -> all done
2379                     connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2380                     sm_done_for_handle(connection->sm_handle);
2381                 }
2382                 break;
2383 
2384             default:
2385                 break;
2386         }
2387 
2388         // check again if active connection was released
2389         if (sm_active_connection) break;
2390     }
2391 }
2392 
2393 // note: aes engine is ready as we just got the aes result
2394 static void sm_handle_encryption_result(uint8_t * data){
2395 
2396     sm_aes128_state = SM_AES128_IDLE;
2397 
2398     if (sm_address_resolution_ah_calculation_active){
2399         sm_address_resolution_ah_calculation_active = 0;
2400         // compare calulated address against connecting device
2401         uint8_t hash[3];
2402         reverse_24(data, hash);
2403         if (memcmp(&sm_address_resolution_address[3], hash, 3) == 0){
2404             log_info("LE Device Lookup: matched resolvable private address");
2405             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
2406             return;
2407         }
2408         // no match, try next
2409         sm_address_resolution_test++;
2410         return;
2411     }
2412 
2413     switch (dkg_state){
2414         case DKG_W4_IRK:
2415             reverse_128(data, sm_persistent_irk);
2416             log_info_key("irk", sm_persistent_irk);
2417             dkg_next_state();
2418             return;
2419         case DKG_W4_DHK:
2420             reverse_128(data, sm_persistent_dhk);
2421             log_info_key("dhk", sm_persistent_dhk);
2422             dkg_next_state();
2423             // SM Init Finished
2424             return;
2425         default:
2426             break;
2427     }
2428 
2429     switch (rau_state){
2430         case RAU_W4_ENC:
2431             reverse_24(data, &sm_random_address[3]);
2432             rau_next_state();
2433             return;
2434         default:
2435             break;
2436     }
2437 
2438     switch (sm_cmac_state){
2439         case CMAC_W4_SUBKEYS:
2440         case CMAC_W4_MI:
2441         case CMAC_W4_MLAST:
2442             {
2443             sm_key_t t;
2444             reverse_128(data, t);
2445             sm_cmac_handle_encryption_result(t);
2446             }
2447             return;
2448         default:
2449             break;
2450     }
2451 
2452     // retrieve sm_connection provided to sm_aes128_start_encryption
2453     sm_connection_t * connection = (sm_connection_t*) sm_aes128_context;
2454     if (!connection) return;
2455     switch (connection->sm_engine_state){
2456         case SM_PH2_C1_W4_ENC_A:
2457         case SM_PH2_C1_W4_ENC_C:
2458             {
2459             sm_key_t t2;
2460             reverse_128(data, t2);
2461             sm_c1_t3(t2, setup->sm_m_address, setup->sm_s_address, setup->sm_c1_t3_value);
2462             }
2463             sm_next_responding_state(connection);
2464             return;
2465         case SM_PH2_C1_W4_ENC_B:
2466             reverse_128(data, setup->sm_local_confirm);
2467             log_info_key("c1!", setup->sm_local_confirm);
2468             connection->sm_engine_state = SM_PH2_C1_SEND_PAIRING_CONFIRM;
2469             return;
2470         case SM_PH2_C1_W4_ENC_D:
2471             {
2472             sm_key_t peer_confirm_test;
2473             reverse_128(data, peer_confirm_test);
2474             log_info_key("c1!", peer_confirm_test);
2475             if (memcmp(setup->sm_peer_confirm, peer_confirm_test, 16) != 0){
2476                 setup->sm_pairing_failed_reason = SM_REASON_CONFIRM_VALUE_FAILED;
2477                 connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
2478                 return;
2479             }
2480             if (connection->sm_role){
2481                 connection->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
2482             } else {
2483                 connection->sm_engine_state = SM_PH2_CALC_STK;
2484             }
2485             }
2486             return;
2487         case SM_PH2_W4_STK:
2488             reverse_128(data, setup->sm_ltk);
2489             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2490             log_info_key("stk", setup->sm_ltk);
2491             if (connection->sm_role){
2492                 connection->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2493             } else {
2494                 connection->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
2495             }
2496             return;
2497         case SM_PH3_Y_W4_ENC:{
2498             sm_key_t y128;
2499             reverse_128(data, y128);
2500             setup->sm_local_y = big_endian_read_16(y128, 14);
2501             log_info_hex16("y", setup->sm_local_y);
2502             // PH3B3 - calculate EDIV
2503             setup->sm_local_ediv = setup->sm_local_y ^ setup->sm_local_div;
2504             log_info_hex16("ediv", setup->sm_local_ediv);
2505             // PH3B4 - calculate LTK         - enc
2506             // LTK = d1(ER, DIV, 0))
2507             connection->sm_engine_state = SM_PH3_LTK_GET_ENC;
2508             return;
2509         }
2510         case SM_RESPONDER_PH4_Y_W4_ENC:{
2511             sm_key_t y128;
2512             reverse_128(data, y128);
2513             setup->sm_local_y = big_endian_read_16(y128, 14);
2514             log_info_hex16("y", setup->sm_local_y);
2515 
2516             // PH3B3 - calculate DIV
2517             setup->sm_local_div = setup->sm_local_y ^ setup->sm_local_ediv;
2518             log_info_hex16("ediv", setup->sm_local_ediv);
2519             // PH3B4 - calculate LTK         - enc
2520             // LTK = d1(ER, DIV, 0))
2521             connection->sm_engine_state = SM_RESPONDER_PH4_LTK_GET_ENC;
2522             return;
2523         }
2524         case SM_PH3_LTK_W4_ENC:
2525             reverse_128(data, setup->sm_ltk);
2526             log_info_key("ltk", setup->sm_ltk);
2527             // calc CSRK next
2528             connection->sm_engine_state = SM_PH3_CSRK_GET_ENC;
2529             return;
2530         case SM_PH3_CSRK_W4_ENC:
2531             reverse_128(data, setup->sm_local_csrk);
2532             log_info_key("csrk", setup->sm_local_csrk);
2533             if (setup->sm_key_distribution_send_set){
2534                 connection->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
2535             } else {
2536                 // no keys to send, just continue
2537                 if (connection->sm_role){
2538                     // slave -> receive master keys
2539                     connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2540                 } else {
2541                     // master -> all done
2542                     connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2543                     sm_done_for_handle(connection->sm_handle);
2544                 }
2545             }
2546             return;
2547         case SM_RESPONDER_PH4_LTK_W4_ENC:
2548             reverse_128(data, setup->sm_ltk);
2549             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2550             log_info_key("ltk", setup->sm_ltk);
2551             connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK;
2552             return;
2553         default:
2554             break;
2555     }
2556 }
2557 
2558 #ifdef USE_MBEDTLS_FOR_ECDH
2559 
2560 static void sm_log_ec_keypair(void){
2561     // print keypair
2562     char buffer[100];
2563     size_t len;
2564     mbedtls_mpi_write_string( &le_keypair.d, 16, buffer, sizeof(buffer), &len);
2565     log_info("d: %s", buffer);
2566     mbedtls_mpi_write_string( &le_keypair.Q.X, 16, buffer, sizeof(buffer), &len);
2567     log_info("X: %s", buffer);
2568     mbedtls_mpi_write_string( &le_keypair.Q.Y, 16, buffer, sizeof(buffer), &len);
2569     log_info("Y: %s", buffer);
2570 }
2571 
2572 static int sm_generate_f_rng(void * context, unsigned char * buffer, size_t size){
2573     int offset = setup->sm_passkey_bit;
2574     log_info("sm_generate_f_rng: size %u - offset %u", (int) size, offset);
2575     while (size) {
2576         if (offset < 32){
2577             *buffer++ = setup->sm_peer_qx[offset++];
2578         } else {
2579             *buffer++ = setup->sm_peer_qx[offset++ - 32];
2580         }
2581         size--;
2582     }
2583     setup->sm_passkey_bit = offset;
2584     return 0;
2585 }
2586 #endif
2587 
2588 // note: random generator is ready. this doesn NOT imply that aes engine is unused!
2589 static void sm_handle_random_result(uint8_t * data){
2590 
2591 #ifdef USE_MBEDTLS_FOR_ECDH
2592     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
2593         int num_bytes = setup->sm_passkey_bit;
2594         if (num_bytes < 32){
2595             memcpy(&setup->sm_peer_qx[num_bytes], data, 8);
2596         } else {
2597             memcpy(&setup->sm_peer_qx[num_bytes-32], data, 8);
2598         }
2599         num_bytes += 8;
2600         setup->sm_passkey_bit = num_bytes;
2601 
2602         if (num_bytes >= 64){
2603             // generate EC key
2604             setup->sm_passkey_bit = 0;
2605             mbedtls_ecp_gen_key(MBEDTLS_ECP_DP_SECP256R1, &le_keypair, &sm_generate_f_rng, NULL);
2606             sm_log_ec_keypair();
2607             ec_key_generation_state = EC_KEY_GENERATION_DONE;
2608         }
2609     }
2610 #endif
2611 
2612     switch (rau_state){
2613         case RAU_W4_RANDOM:
2614             // non-resolvable vs. resolvable
2615             switch (gap_random_adress_type){
2616                 case GAP_RANDOM_ADDRESS_RESOLVABLE:
2617                     // resolvable: use random as prand and calc address hash
2618                     // "The two most significant bits of prand shall be equal to ‘0’ and ‘1"
2619                     memcpy(sm_random_address, data, 3);
2620                     sm_random_address[0] &= 0x3f;
2621                     sm_random_address[0] |= 0x40;
2622                     rau_state = RAU_GET_ENC;
2623                     break;
2624                 case GAP_RANDOM_ADDRESS_NON_RESOLVABLE:
2625                 default:
2626                     // "The two most significant bits of the address shall be equal to ‘0’""
2627                     memcpy(sm_random_address, data, 6);
2628                     sm_random_address[0] &= 0x3f;
2629                     rau_state = RAU_SET_ADDRESS;
2630                     break;
2631             }
2632             return;
2633         default:
2634             break;
2635     }
2636 
2637     // retrieve sm_connection provided to sm_random_start
2638     sm_connection_t * connection = (sm_connection_t *) sm_random_context;
2639     if (!connection) return;
2640     switch (connection->sm_engine_state){
2641 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2642         case SM_SC_W4_GET_RANDOM_A:
2643             memcpy(&setup->sm_local_nonce[0], data, 8);
2644             connection->sm_engine_state = SM_SC_W2_GET_RANDOM_B;
2645             break;
2646         case SM_SC_W4_GET_RANDOM_B:
2647             memcpy(&setup->sm_local_nonce[8], data, 8);
2648             // initiator & jw/nc -> send pairing random
2649             if (connection->sm_role == 0 && sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
2650                 connection->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
2651                 break;
2652             } else {
2653                 connection->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
2654             }
2655             break;
2656 #endif
2657 
2658         case SM_PH2_W4_RANDOM_TK:
2659         {
2660             // map random to 0-999999 without speding much cycles on a modulus operation
2661             uint32_t tk = little_endian_read_32(data,0);
2662             tk = tk & 0xfffff;  // 1048575
2663             if (tk >= 999999){
2664                 tk = tk - 999999;
2665             }
2666             sm_reset_tk();
2667             big_endian_store_32(setup->sm_tk, 12, tk);
2668             if (connection->sm_role){
2669                 connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
2670             } else {
2671                 connection->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
2672                 sm_trigger_user_response(connection);
2673                 // response_idle == nothing <--> sm_trigger_user_response() did not require response
2674                 if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
2675                     connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
2676                 }
2677             }
2678             return;
2679         }
2680         case SM_PH2_C1_W4_RANDOM_A:
2681             memcpy(&setup->sm_local_random[0], data, 8); // random endinaness
2682             connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_B;
2683             return;
2684         case SM_PH2_C1_W4_RANDOM_B:
2685             memcpy(&setup->sm_local_random[8], data, 8); // random endinaness
2686             connection->sm_engine_state = SM_PH2_C1_GET_ENC_A;
2687             return;
2688         case SM_PH3_W4_RANDOM:
2689             reverse_64(data, setup->sm_local_rand);
2690             // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
2691             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xf0) + (connection->sm_actual_encryption_key_size - 1);
2692             // no db for authenticated flag hack: store flag in bit 4 of LSB
2693             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xef) + (connection->sm_connection_authenticated << 4);
2694             connection->sm_engine_state = SM_PH3_GET_DIV;
2695             return;
2696         case SM_PH3_W4_DIV:
2697             // use 16 bit from random value as div
2698             setup->sm_local_div = big_endian_read_16(data, 0);
2699             log_info_hex16("div", setup->sm_local_div);
2700             connection->sm_engine_state = SM_PH3_Y_GET_ENC;
2701             return;
2702         default:
2703             break;
2704     }
2705 }
2706 
2707 static void sm_event_packet_handler (uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
2708 
2709     sm_connection_t  * sm_conn;
2710     hci_con_handle_t con_handle;
2711 
2712     switch (packet_type) {
2713 
2714 		case HCI_EVENT_PACKET:
2715 			switch (hci_event_packet_get_type(packet)) {
2716 
2717                 case BTSTACK_EVENT_STATE:
2718 					// bt stack activated, get started
2719 					if (btstack_event_state_get_state(packet) == HCI_STATE_WORKING){
2720                         log_info("HCI Working!");
2721                         dkg_state = sm_persistent_irk_ready ? DKG_CALC_DHK : DKG_CALC_IRK;
2722                         rau_state = RAU_IDLE;
2723 #ifdef USE_MBEDTLS_FOR_ECDH
2724                         if (!test_use_fixed_ec_keypair){
2725                             setup->sm_passkey_bit = 0;
2726                             ec_key_generation_state = EC_KEY_GENERATION_ACTIVE;
2727                         }
2728 #endif
2729                         sm_run();
2730 					}
2731 					break;
2732 
2733                 case HCI_EVENT_LE_META:
2734                     switch (packet[2]) {
2735                         case HCI_SUBEVENT_LE_CONNECTION_COMPLETE:
2736 
2737                             log_info("sm: connected");
2738 
2739                             if (packet[3]) return; // connection failed
2740 
2741                             con_handle = little_endian_read_16(packet, 4);
2742                             sm_conn = sm_get_connection_for_handle(con_handle);
2743                             if (!sm_conn) break;
2744 
2745                             sm_conn->sm_handle = con_handle;
2746                             sm_conn->sm_role = packet[6];
2747                             sm_conn->sm_peer_addr_type = packet[7];
2748                             reverse_bd_addr(&packet[8],
2749                                             sm_conn->sm_peer_address);
2750 
2751                             log_info("New sm_conn, role %s", sm_conn->sm_role ? "slave" : "master");
2752 
2753                             // reset security properties
2754                             sm_conn->sm_connection_encrypted = 0;
2755                             sm_conn->sm_connection_authenticated = 0;
2756                             sm_conn->sm_connection_authorization_state = AUTHORIZATION_UNKNOWN;
2757                             sm_conn->sm_le_db_index = -1;
2758 
2759                             // prepare CSRK lookup (does not involve setup)
2760                             sm_conn->sm_irk_lookup_state = IRK_LOOKUP_W4_READY;
2761 
2762                             // just connected -> everything else happens in sm_run()
2763                             if (sm_conn->sm_role){
2764                                 // slave - state already could be SM_RESPONDER_SEND_SECURITY_REQUEST instead
2765                                 if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
2766                                     if (sm_slave_request_security) {
2767                                         // request security if requested by app
2768                                         sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
2769                                     } else {
2770                                         // otherwise, wait for pairing request
2771                                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
2772                                     }
2773                                 }
2774                                 break;
2775                             } else {
2776                                 // master
2777                                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2778                             }
2779                             break;
2780 
2781                         case HCI_SUBEVENT_LE_LONG_TERM_KEY_REQUEST:
2782                             con_handle = little_endian_read_16(packet, 3);
2783                             sm_conn = sm_get_connection_for_handle(con_handle);
2784                             if (!sm_conn) break;
2785 
2786                             log_info("LTK Request: state %u", sm_conn->sm_engine_state);
2787                             if (sm_conn->sm_engine_state == SM_RESPONDER_PH2_W4_LTK_REQUEST){
2788                                 sm_conn->sm_engine_state = SM_PH2_CALC_STK;
2789                                 break;
2790                             }
2791                             if (sm_conn->sm_engine_state == SM_SC_W4_LTK_REQUEST_SC){
2792                                 sm_conn->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2793                                 break;
2794                             }
2795 
2796                             // store rand and ediv
2797                             reverse_64(&packet[5], sm_conn->sm_local_rand);
2798                             sm_conn->sm_local_ediv   = little_endian_read_16(packet, 13);
2799                             sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK;
2800                             break;
2801 
2802                         default:
2803                             break;
2804                     }
2805                     break;
2806 
2807                 case HCI_EVENT_ENCRYPTION_CHANGE:
2808                     con_handle = little_endian_read_16(packet, 3);
2809                     sm_conn = sm_get_connection_for_handle(con_handle);
2810                     if (!sm_conn) break;
2811 
2812                     sm_conn->sm_connection_encrypted = packet[5];
2813                     log_info("Encryption state change: %u, key size %u", sm_conn->sm_connection_encrypted,
2814                         sm_conn->sm_actual_encryption_key_size);
2815                     log_info("event handler, state %u", sm_conn->sm_engine_state);
2816                     if (!sm_conn->sm_connection_encrypted) break;
2817                     // continue if part of initial pairing
2818                     switch (sm_conn->sm_engine_state){
2819                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
2820                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2821                             sm_done_for_handle(sm_conn->sm_handle);
2822                             break;
2823                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
2824                             if (sm_conn->sm_role){
2825                                 // slave
2826                                 if (setup->sm_use_secure_connections){
2827                                     sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
2828                                 } else {
2829                                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
2830                                 }
2831                             } else {
2832                                 // master
2833                                 if (sm_key_distribution_all_received(sm_conn)){
2834                                     // skip receiving keys as there are none
2835                                     sm_key_distribution_handle_all_received(sm_conn);
2836                                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
2837                                 } else {
2838                                     sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2839                                 }
2840                             }
2841                             break;
2842                         default:
2843                             break;
2844                     }
2845                     break;
2846 
2847                 case HCI_EVENT_ENCRYPTION_KEY_REFRESH_COMPLETE:
2848                     con_handle = little_endian_read_16(packet, 3);
2849                     sm_conn = sm_get_connection_for_handle(con_handle);
2850                     if (!sm_conn) break;
2851 
2852                     log_info("Encryption key refresh complete, key size %u", sm_conn->sm_actual_encryption_key_size);
2853                     log_info("event handler, state %u", sm_conn->sm_engine_state);
2854                     // continue if part of initial pairing
2855                     switch (sm_conn->sm_engine_state){
2856                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
2857                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2858                             sm_done_for_handle(sm_conn->sm_handle);
2859                             break;
2860                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
2861                             if (sm_conn->sm_role){
2862                                 // slave
2863                                 sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
2864                             } else {
2865                                 // master
2866                                 sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2867                             }
2868                             break;
2869                         default:
2870                             break;
2871                     }
2872                     break;
2873 
2874 
2875                 case HCI_EVENT_DISCONNECTION_COMPLETE:
2876                     con_handle = little_endian_read_16(packet, 3);
2877                     sm_done_for_handle(con_handle);
2878                     sm_conn = sm_get_connection_for_handle(con_handle);
2879                     if (!sm_conn) break;
2880 
2881                     // delete stored bonding on disconnect with authentication failure in ph0
2882                     if (sm_conn->sm_role == 0
2883                         && sm_conn->sm_engine_state == SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED
2884                         && packet[2] == ERROR_CODE_AUTHENTICATION_FAILURE){
2885                         le_device_db_remove(sm_conn->sm_le_db_index);
2886                     }
2887 
2888                     sm_conn->sm_engine_state = SM_GENERAL_IDLE;
2889                     sm_conn->sm_handle = 0;
2890                     break;
2891 
2892 				case HCI_EVENT_COMMAND_COMPLETE:
2893                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_encrypt)){
2894                         sm_handle_encryption_result(&packet[6]);
2895                         break;
2896                     }
2897                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_rand)){
2898                         sm_handle_random_result(&packet[6]);
2899                         break;
2900                     }
2901                     break;
2902                 default:
2903                     break;
2904 			}
2905             break;
2906         default:
2907             break;
2908 	}
2909 
2910     sm_run();
2911 }
2912 
2913 static inline int sm_calc_actual_encryption_key_size(int other){
2914     if (other < sm_min_encryption_key_size) return 0;
2915     if (other < sm_max_encryption_key_size) return other;
2916     return sm_max_encryption_key_size;
2917 }
2918 
2919 
2920 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method){
2921     switch (method){
2922         case JUST_WORKS:
2923         case NK_BOTH_INPUT:
2924             return 1;
2925         default:
2926             return 0;
2927     }
2928 }
2929 // responder
2930 
2931 static int sm_passkey_used(stk_generation_method_t method){
2932     switch (method){
2933         case PK_RESP_INPUT:
2934             return 1;
2935         default:
2936             return 0;
2937     }
2938 }
2939 
2940 /**
2941  * @return ok
2942  */
2943 static int sm_validate_stk_generation_method(void){
2944     // check if STK generation method is acceptable by client
2945     switch (setup->sm_stk_generation_method){
2946         case JUST_WORKS:
2947             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_JUST_WORKS) != 0;
2948         case PK_RESP_INPUT:
2949         case PK_INIT_INPUT:
2950         case OK_BOTH_INPUT:
2951             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_PASSKEY) != 0;
2952         case OOB:
2953             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_OOB) != 0;
2954         case NK_BOTH_INPUT:
2955             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON) != 0;
2956             return 1;
2957         default:
2958             return 0;
2959     }
2960 }
2961 
2962 static void sm_pdu_handler(uint8_t packet_type, hci_con_handle_t con_handle, uint8_t *packet, uint16_t size){
2963 
2964     if (packet_type == HCI_EVENT_PACKET && packet[0] == L2CAP_EVENT_CAN_SEND_NOW){
2965         sm_run();
2966     }
2967 
2968     if (packet_type != SM_DATA_PACKET) return;
2969 
2970     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
2971     if (!sm_conn) return;
2972 
2973     if (packet[0] == SM_CODE_PAIRING_FAILED){
2974         sm_conn->sm_engine_state = sm_conn->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
2975         return;
2976     }
2977 
2978     log_debug("sm_pdu_handler: state %u, pdu 0x%02x", sm_conn->sm_engine_state, packet[0]);
2979 
2980     int err;
2981 
2982     switch (sm_conn->sm_engine_state){
2983 
2984         // a sm timeout requries a new physical connection
2985         case SM_GENERAL_TIMEOUT:
2986             return;
2987 
2988         // Initiator
2989         case SM_INITIATOR_CONNECTED:
2990             if ((packet[0] != SM_CODE_SECURITY_REQUEST) || (sm_conn->sm_role)){
2991                 sm_pdu_received_in_wrong_state(sm_conn);
2992                 break;
2993             }
2994             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_FAILED){
2995                 sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
2996                 break;
2997             }
2998             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_SUCCEEDED){
2999                 uint16_t ediv;
3000                 sm_key_t ltk;
3001                 le_device_db_encryption_get(sm_conn->sm_le_db_index, &ediv, NULL, ltk, NULL, NULL, NULL);
3002                 if (!sm_is_null_key(ltk) || ediv){
3003                     log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3004                     sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3005                 } else {
3006                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3007                 }
3008                 break;
3009             }
3010             // otherwise, store security request
3011             sm_conn->sm_security_request_received = 1;
3012             break;
3013 
3014         case SM_INITIATOR_PH1_W4_PAIRING_RESPONSE:
3015             if (packet[0] != SM_CODE_PAIRING_RESPONSE){
3016                 sm_pdu_received_in_wrong_state(sm_conn);
3017                 break;
3018             }
3019             // store pairing request
3020             memcpy(&setup->sm_s_pres, packet, sizeof(sm_pairing_packet_t));
3021             err = sm_stk_generation_init(sm_conn);
3022             if (err){
3023                 setup->sm_pairing_failed_reason = err;
3024                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3025                 break;
3026             }
3027 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3028             if (setup->sm_use_secure_connections){
3029                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
3030                 if (setup->sm_stk_generation_method == JUST_WORKS){
3031                     sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3032                     sm_trigger_user_response(sm_conn);
3033                     if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3034                         sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3035                     }
3036                 } else {
3037                     sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3038                 }
3039                 break;
3040             }
3041 #endif
3042             // generate random number first, if we need to show passkey
3043             if (setup->sm_stk_generation_method == PK_RESP_INPUT){
3044                 sm_conn->sm_engine_state = SM_PH2_GET_RANDOM_TK;
3045                 break;
3046             }
3047             sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3048             sm_trigger_user_response(sm_conn);
3049             // response_idle == nothing <--> sm_trigger_user_response() did not require response
3050             if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3051                 sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3052             }
3053             break;
3054 
3055         case SM_INITIATOR_PH2_W4_PAIRING_CONFIRM:
3056             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3057                 sm_pdu_received_in_wrong_state(sm_conn);
3058                 break;
3059             }
3060 
3061             // store s_confirm
3062             reverse_128(&packet[1], setup->sm_peer_confirm);
3063             sm_conn->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
3064             break;
3065 
3066         case SM_INITIATOR_PH2_W4_PAIRING_RANDOM:
3067             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3068                 sm_pdu_received_in_wrong_state(sm_conn);
3069                 break;;
3070             }
3071 
3072             // received random value
3073             reverse_128(&packet[1], setup->sm_peer_random);
3074             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3075             break;
3076 
3077         // Responder
3078         case SM_RESPONDER_IDLE:
3079         case SM_RESPONDER_SEND_SECURITY_REQUEST:
3080         case SM_RESPONDER_PH1_W4_PAIRING_REQUEST:
3081             if (packet[0] != SM_CODE_PAIRING_REQUEST){
3082                 sm_pdu_received_in_wrong_state(sm_conn);
3083                 break;;
3084             }
3085 
3086             // store pairing request
3087             memcpy(&sm_conn->sm_m_preq, packet, sizeof(sm_pairing_packet_t));
3088             sm_conn->sm_engine_state = SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED;
3089             break;
3090 
3091 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3092         case SM_SC_W4_PUBLIC_KEY_COMMAND:
3093             if (packet[0] != SM_CODE_PAIRING_PUBLIC_KEY){
3094                 sm_pdu_received_in_wrong_state(sm_conn);
3095                 break;
3096             }
3097 
3098             // store public key for DH Key calculation
3099             reverse_256(&packet[01], setup->sm_peer_qx);
3100             reverse_256(&packet[33], setup->sm_peer_qy);
3101 
3102 #ifdef USE_MBEDTLS_FOR_ECDH
3103             // validate public key
3104             mbedtls_ecp_group grp;
3105             mbedtls_ecp_group_init( &grp );
3106             mbedtls_ecp_group_load(&grp, MBEDTLS_ECP_DP_SECP256R1);
3107 
3108             mbedtls_ecp_point Q;
3109             mbedtls_ecp_point_init( &Q );
3110             mbedtls_mpi_read_binary(&Q.X, setup->sm_peer_qx, 32);
3111             mbedtls_mpi_read_binary(&Q.Y, setup->sm_peer_qy, 32);
3112             mbedtls_mpi_read_string(&Q.Z, 16, "1" );
3113             err = mbedtls_ecp_check_pubkey(&grp, &Q);
3114             mbedtls_ecp_point_free( & Q);
3115             mbedtls_ecp_group_free( &grp);
3116             if (err){
3117                 log_error("sm: peer public key invalid %x", err);
3118                 // uses "unspecified reason", there is no "public key invalid" error code
3119                 sm_pdu_received_in_wrong_state(sm_conn);
3120                 break;
3121             }
3122 
3123 #endif
3124             if (sm_conn->sm_role){
3125                 // responder
3126                 sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3127             } else {
3128                 // initiator
3129                 // stk generation method
3130                 // passkey entry: notify app to show passkey or to request passkey
3131                 switch (setup->sm_stk_generation_method){
3132                     case JUST_WORKS:
3133                     case NK_BOTH_INPUT:
3134                         sm_conn->sm_engine_state = SM_SC_W4_CONFIRMATION;
3135                         break;
3136                     case PK_RESP_INPUT:
3137                         sm_sc_start_calculating_local_confirm(sm_conn);
3138                         break;
3139                     case PK_INIT_INPUT:
3140                     case OK_BOTH_INPUT:
3141                         if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3142                             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3143                             break;
3144                         }
3145                         sm_sc_start_calculating_local_confirm(sm_conn);
3146                         break;
3147                     case OOB:
3148                         // TODO: implement SC OOB
3149                         break;
3150                 }
3151             }
3152             break;
3153 
3154         case SM_SC_W4_CONFIRMATION:
3155             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3156                 sm_pdu_received_in_wrong_state(sm_conn);
3157                 break;
3158             }
3159             // received confirm value
3160             reverse_128(&packet[1], setup->sm_peer_confirm);
3161 
3162             if (sm_conn->sm_role){
3163                 // responder
3164                 if (sm_passkey_used(setup->sm_stk_generation_method)){
3165                     if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3166                         // still waiting for passkey
3167                         sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3168                         break;
3169                     }
3170                 }
3171                 sm_sc_start_calculating_local_confirm(sm_conn);
3172             } else {
3173                 // initiator
3174                 if (sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
3175                     sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
3176                 } else {
3177                     sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
3178                 }
3179             }
3180             break;
3181 
3182         case SM_SC_W4_PAIRING_RANDOM:
3183             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3184                 sm_pdu_received_in_wrong_state(sm_conn);
3185                 break;
3186             }
3187 
3188             // received random value
3189             reverse_128(&packet[1], setup->sm_peer_nonce);
3190 
3191             // validate confirm value if Cb = f4(Pkb, Pka, Nb, z)
3192             // only check for JUST WORK/NC in initiator role AND passkey entry
3193             int passkey_entry = sm_passkey_used(setup->sm_stk_generation_method);
3194             if (sm_conn->sm_role || passkey_entry) {
3195                  sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION;
3196             }
3197 
3198             sm_sc_state_after_receiving_random(sm_conn);
3199             break;
3200 
3201         case SM_SC_W2_CALCULATE_G2:
3202         case SM_SC_W4_CALCULATE_G2:
3203         case SM_SC_W2_CALCULATE_F5_SALT:
3204         case SM_SC_W4_CALCULATE_F5_SALT:
3205         case SM_SC_W2_CALCULATE_F5_MACKEY:
3206         case SM_SC_W4_CALCULATE_F5_MACKEY:
3207         case SM_SC_W2_CALCULATE_F5_LTK:
3208         case SM_SC_W4_CALCULATE_F5_LTK:
3209         case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
3210         case SM_SC_W4_DHKEY_CHECK_COMMAND:
3211         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
3212             if (packet[0] != SM_CODE_PAIRING_DHKEY_CHECK){
3213                 sm_pdu_received_in_wrong_state(sm_conn);
3214                 break;
3215             }
3216             // store DHKey Check
3217             setup->sm_state_vars |= SM_STATE_VAR_DHKEY_COMMAND_RECEIVED;
3218             reverse_128(&packet[01], setup->sm_peer_dhkey_check);
3219 
3220             // have we been only waiting for dhkey check command?
3221             if (sm_conn->sm_engine_state == SM_SC_W4_DHKEY_CHECK_COMMAND){
3222                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
3223             }
3224             break;
3225 #endif
3226 
3227         case SM_RESPONDER_PH1_W4_PAIRING_CONFIRM:
3228             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3229                 sm_pdu_received_in_wrong_state(sm_conn);
3230                 break;
3231             }
3232 
3233             // received confirm value
3234             reverse_128(&packet[1], setup->sm_peer_confirm);
3235 
3236             // notify client to hide shown passkey
3237             if (setup->sm_stk_generation_method == PK_INIT_INPUT){
3238                 sm_notify_client_base(SM_EVENT_PASSKEY_DISPLAY_CANCEL, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
3239             }
3240 
3241             // handle user cancel pairing?
3242             if (setup->sm_user_response == SM_USER_RESPONSE_DECLINE){
3243                 setup->sm_pairing_failed_reason = SM_REASON_PASSKEYT_ENTRY_FAILED;
3244                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3245                 break;
3246             }
3247 
3248             // wait for user action?
3249             if (setup->sm_user_response == SM_USER_RESPONSE_PENDING){
3250                 sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3251                 break;
3252             }
3253 
3254             // calculate and send local_confirm
3255             sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3256             break;
3257 
3258         case SM_RESPONDER_PH2_W4_PAIRING_RANDOM:
3259             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3260                 sm_pdu_received_in_wrong_state(sm_conn);
3261                 break;;
3262             }
3263 
3264             // received random value
3265             reverse_128(&packet[1], setup->sm_peer_random);
3266             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3267             break;
3268 
3269         case SM_PH3_RECEIVE_KEYS:
3270             switch(packet[0]){
3271                 case SM_CODE_ENCRYPTION_INFORMATION:
3272                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
3273                     reverse_128(&packet[1], setup->sm_peer_ltk);
3274                     break;
3275 
3276                 case SM_CODE_MASTER_IDENTIFICATION:
3277                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
3278                     setup->sm_peer_ediv = little_endian_read_16(packet, 1);
3279                     reverse_64(&packet[3], setup->sm_peer_rand);
3280                     break;
3281 
3282                 case SM_CODE_IDENTITY_INFORMATION:
3283                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
3284                     reverse_128(&packet[1], setup->sm_peer_irk);
3285                     break;
3286 
3287                 case SM_CODE_IDENTITY_ADDRESS_INFORMATION:
3288                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
3289                     setup->sm_peer_addr_type = packet[1];
3290                     reverse_bd_addr(&packet[2], setup->sm_peer_address);
3291                     break;
3292 
3293                 case SM_CODE_SIGNING_INFORMATION:
3294                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
3295                     reverse_128(&packet[1], setup->sm_peer_csrk);
3296                     break;
3297                 default:
3298                     // Unexpected PDU
3299                     log_info("Unexpected PDU %u in SM_PH3_RECEIVE_KEYS", packet[0]);
3300                     break;
3301             }
3302             // done with key distribution?
3303             if (sm_key_distribution_all_received(sm_conn)){
3304 
3305                 sm_key_distribution_handle_all_received(sm_conn);
3306 
3307                 if (sm_conn->sm_role){
3308                     sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
3309                     sm_done_for_handle(sm_conn->sm_handle);
3310                 } else {
3311                     if (setup->sm_use_secure_connections){
3312                         sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
3313                     } else {
3314                         sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3315                     }
3316                 }
3317             }
3318             break;
3319         default:
3320             // Unexpected PDU
3321             log_info("Unexpected PDU %u in state %u", packet[0], sm_conn->sm_engine_state);
3322             break;
3323     }
3324 
3325     // try to send preparared packet
3326     sm_run();
3327 }
3328 
3329 // Security Manager Client API
3330 void sm_register_oob_data_callback( int (*get_oob_data_callback)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data)){
3331     sm_get_oob_data = get_oob_data_callback;
3332 }
3333 
3334 void sm_add_event_handler(btstack_packet_callback_registration_t * callback_handler){
3335     btstack_linked_list_add_tail(&sm_event_handlers, (btstack_linked_item_t*) callback_handler);
3336 }
3337 
3338 void sm_set_accepted_stk_generation_methods(uint8_t accepted_stk_generation_methods){
3339     sm_accepted_stk_generation_methods = accepted_stk_generation_methods;
3340 }
3341 
3342 void sm_set_encryption_key_size_range(uint8_t min_size, uint8_t max_size){
3343 	sm_min_encryption_key_size = min_size;
3344 	sm_max_encryption_key_size = max_size;
3345 }
3346 
3347 void sm_set_authentication_requirements(uint8_t auth_req){
3348     sm_auth_req = auth_req;
3349 }
3350 
3351 void sm_set_io_capabilities(io_capability_t io_capability){
3352     sm_io_capabilities = io_capability;
3353 }
3354 
3355 void sm_set_request_security(int enable){
3356     sm_slave_request_security = enable;
3357 }
3358 
3359 void sm_set_er(sm_key_t er){
3360     memcpy(sm_persistent_er, er, 16);
3361 }
3362 
3363 void sm_set_ir(sm_key_t ir){
3364     memcpy(sm_persistent_ir, ir, 16);
3365 }
3366 
3367 // Testing support only
3368 void sm_test_set_irk(sm_key_t irk){
3369     memcpy(sm_persistent_irk, irk, 16);
3370     sm_persistent_irk_ready = 1;
3371 }
3372 
3373 void sm_test_use_fixed_local_csrk(void){
3374     test_use_fixed_local_csrk = 1;
3375 }
3376 
3377 void sm_init(void){
3378     // set some (BTstack default) ER and IR
3379     int i;
3380     sm_key_t er;
3381     sm_key_t ir;
3382     for (i=0;i<16;i++){
3383         er[i] = 0x30 + i;
3384         ir[i] = 0x90 + i;
3385     }
3386     sm_set_er(er);
3387     sm_set_ir(ir);
3388     // defaults
3389     sm_accepted_stk_generation_methods = SM_STK_GENERATION_METHOD_JUST_WORKS
3390                                        | SM_STK_GENERATION_METHOD_OOB
3391                                        | SM_STK_GENERATION_METHOD_PASSKEY
3392                                        | SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON;
3393 
3394     sm_max_encryption_key_size = 16;
3395     sm_min_encryption_key_size = 7;
3396 
3397     sm_cmac_state  = CMAC_IDLE;
3398     dkg_state = DKG_W4_WORKING;
3399     rau_state = RAU_W4_WORKING;
3400     sm_aes128_state = SM_AES128_IDLE;
3401     sm_address_resolution_test = -1;    // no private address to resolve yet
3402     sm_address_resolution_ah_calculation_active = 0;
3403     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
3404     sm_address_resolution_general_queue = NULL;
3405 
3406     gap_random_adress_update_period = 15 * 60 * 1000L;
3407 
3408     sm_active_connection = 0;
3409 
3410     test_use_fixed_local_csrk = 0;
3411 
3412     // register for HCI Events from HCI
3413     hci_event_callback_registration.callback = &sm_event_packet_handler;
3414     hci_add_event_handler(&hci_event_callback_registration);
3415 
3416     // and L2CAP PDUs + L2CAP_EVENT_CAN_SEND_NOW
3417     l2cap_register_fixed_channel(sm_pdu_handler, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
3418 
3419 #ifdef USE_MBEDTLS_FOR_ECDH
3420     ec_key_generation_state = EC_KEY_GENERATION_IDLE;
3421 #endif
3422 }
3423 
3424 void sm_test_use_fixed_ec_keypair(void){
3425     test_use_fixed_ec_keypair = 1;
3426 #ifdef USE_MBEDTLS_FOR_ECDH
3427     // use test keypair from spec
3428     mbedtls_ecp_keypair_init(&le_keypair);
3429     mbedtls_ecp_group_load(&le_keypair.grp, MBEDTLS_ECP_DP_SECP256R1);
3430     mbedtls_mpi_read_string( &le_keypair.d,   16, "3f49f6d4a3c55f3874c9b3e3d2103f504aff607beb40b7995899b8a6cd3c1abd");
3431     mbedtls_mpi_read_string( &le_keypair.Q.X, 16, "20b003d2f297be2c5e2c83a7e9f9a5b9eff49111acf4fddbcc0301480e359de6");
3432     mbedtls_mpi_read_string( &le_keypair.Q.Y, 16, "dc809c49652aeb6d63329abf5a52155c766345c28fed3024741c8ed01589d28b");
3433     mbedtls_mpi_read_string( &le_keypair.Q.Z, 16, "1");
3434 #endif
3435 }
3436 
3437 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle){
3438     hci_connection_t * hci_con = hci_connection_for_handle(con_handle);
3439     if (!hci_con) return NULL;
3440     return &hci_con->sm_connection;
3441 }
3442 
3443 // @returns 0 if not encrypted, 7-16 otherwise
3444 int sm_encryption_key_size(hci_con_handle_t con_handle){
3445     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3446     if (!sm_conn) return 0;     // wrong connection
3447     if (!sm_conn->sm_connection_encrypted) return 0;
3448     return sm_conn->sm_actual_encryption_key_size;
3449 }
3450 
3451 int sm_authenticated(hci_con_handle_t con_handle){
3452     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3453     if (!sm_conn) return 0;     // wrong connection
3454     if (!sm_conn->sm_connection_encrypted) return 0; // unencrypted connection cannot be authenticated
3455     return sm_conn->sm_connection_authenticated;
3456 }
3457 
3458 authorization_state_t sm_authorization_state(hci_con_handle_t con_handle){
3459     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3460     if (!sm_conn) return AUTHORIZATION_UNKNOWN;     // wrong connection
3461     if (!sm_conn->sm_connection_encrypted)               return AUTHORIZATION_UNKNOWN; // unencrypted connection cannot be authorized
3462     if (!sm_conn->sm_connection_authenticated)           return AUTHORIZATION_UNKNOWN; // unauthenticatd connection cannot be authorized
3463     return sm_conn->sm_connection_authorization_state;
3464 }
3465 
3466 static void sm_send_security_request_for_connection(sm_connection_t * sm_conn){
3467     switch (sm_conn->sm_engine_state){
3468         case SM_GENERAL_IDLE:
3469         case SM_RESPONDER_IDLE:
3470             sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
3471             sm_run();
3472             break;
3473         default:
3474             break;
3475     }
3476 }
3477 
3478 /**
3479  * @brief Trigger Security Request
3480  */
3481 void sm_send_security_request(hci_con_handle_t con_handle){
3482     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3483     if (!sm_conn) return;
3484     sm_send_security_request_for_connection(sm_conn);
3485 }
3486 
3487 // request pairing
3488 void sm_request_pairing(hci_con_handle_t con_handle){
3489     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3490     if (!sm_conn) return;     // wrong connection
3491 
3492     log_info("sm_request_pairing in role %u, state %u", sm_conn->sm_role, sm_conn->sm_engine_state);
3493     if (sm_conn->sm_role){
3494         sm_send_security_request_for_connection(sm_conn);
3495     } else {
3496         // used as a trigger to start central/master/initiator security procedures
3497         uint16_t ediv;
3498         sm_key_t ltk;
3499         if (sm_conn->sm_engine_state == SM_INITIATOR_CONNECTED){
3500             switch (sm_conn->sm_irk_lookup_state){
3501                 case IRK_LOOKUP_FAILED:
3502                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3503                     break;
3504                 case IRK_LOOKUP_SUCCEEDED:
3505                         le_device_db_encryption_get(sm_conn->sm_le_db_index, &ediv, NULL, ltk, NULL, NULL, NULL);
3506                         if (!sm_is_null_key(ltk) || ediv){
3507                             log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3508                             sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3509                         } else {
3510                             sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3511                         }
3512                         break;
3513                 default:
3514                     sm_conn->sm_bonding_requested = 1;
3515                     break;
3516             }
3517         } else if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
3518             sm_conn->sm_bonding_requested = 1;
3519         }
3520     }
3521     sm_run();
3522 }
3523 
3524 // called by client app on authorization request
3525 void sm_authorization_decline(hci_con_handle_t con_handle){
3526     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3527     if (!sm_conn) return;     // wrong connection
3528     sm_conn->sm_connection_authorization_state = AUTHORIZATION_DECLINED;
3529     sm_notify_client_authorization(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 0);
3530 }
3531 
3532 void sm_authorization_grant(hci_con_handle_t con_handle){
3533     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3534     if (!sm_conn) return;     // wrong connection
3535     sm_conn->sm_connection_authorization_state = AUTHORIZATION_GRANTED;
3536     sm_notify_client_authorization(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 1);
3537 }
3538 
3539 // GAP Bonding API
3540 
3541 void sm_bonding_decline(hci_con_handle_t con_handle){
3542     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3543     if (!sm_conn) return;     // wrong connection
3544     setup->sm_user_response = SM_USER_RESPONSE_DECLINE;
3545 
3546     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3547         switch (setup->sm_stk_generation_method){
3548             case PK_RESP_INPUT:
3549             case PK_INIT_INPUT:
3550             case OK_BOTH_INPUT:
3551                 sm_pairing_error(sm_conn, SM_GENERAL_SEND_PAIRING_FAILED);
3552                 break;
3553             case NK_BOTH_INPUT:
3554                 sm_pairing_error(sm_conn, SM_REASON_NUMERIC_COMPARISON_FAILED);
3555                 break;
3556             case JUST_WORKS:
3557             case OOB:
3558                 sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
3559                 break;
3560         }
3561     }
3562     sm_run();
3563 }
3564 
3565 void sm_just_works_confirm(hci_con_handle_t con_handle){
3566     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3567     if (!sm_conn) return;     // wrong connection
3568     setup->sm_user_response = SM_USER_RESPONSE_CONFIRM;
3569     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3570         if (setup->sm_use_secure_connections){
3571             sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3572         } else {
3573             sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3574         }
3575     }
3576 
3577 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3578     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
3579         sm_sc_prepare_dhkey_check(sm_conn);
3580     }
3581 #endif
3582 
3583     sm_run();
3584 }
3585 
3586 void sm_numeric_comparison_confirm(hci_con_handle_t con_handle){
3587     // for now, it's the same
3588     sm_just_works_confirm(con_handle);
3589 }
3590 
3591 void sm_passkey_input(hci_con_handle_t con_handle, uint32_t passkey){
3592     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3593     if (!sm_conn) return;     // wrong connection
3594     sm_reset_tk();
3595     big_endian_store_32(setup->sm_tk, 12, passkey);
3596     setup->sm_user_response = SM_USER_RESPONSE_PASSKEY;
3597     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3598         sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3599     }
3600 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3601     memcpy(setup->sm_ra, setup->sm_tk, 16);
3602     memcpy(setup->sm_rb, setup->sm_tk, 16);
3603     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
3604         sm_sc_start_calculating_local_confirm(sm_conn);
3605     }
3606 #endif
3607     sm_run();
3608 }
3609 
3610 /**
3611  * @brief Identify device in LE Device DB
3612  * @param handle
3613  * @returns index from le_device_db or -1 if not found/identified
3614  */
3615 int sm_le_device_index(hci_con_handle_t con_handle ){
3616     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3617     if (!sm_conn) return -1;
3618     return sm_conn->sm_le_db_index;
3619 }
3620 
3621 // GAP LE API
3622 void gap_random_address_set_mode(gap_random_address_type_t random_address_type){
3623     gap_random_address_update_stop();
3624     gap_random_adress_type = random_address_type;
3625     if (random_address_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return;
3626     gap_random_address_update_start();
3627     gap_random_address_trigger();
3628 }
3629 
3630 gap_random_address_type_t gap_random_address_get_mode(void){
3631     return gap_random_adress_type;
3632 }
3633 
3634 void gap_random_address_set_update_period(int period_ms){
3635     gap_random_adress_update_period = period_ms;
3636     if (gap_random_adress_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return;
3637     gap_random_address_update_stop();
3638     gap_random_address_update_start();
3639 }
3640 
3641 void gap_random_address_set(bd_addr_t addr){
3642     gap_random_address_set_mode(GAP_RANDOM_ADDRESS_TYPE_OFF);
3643     memcpy(sm_random_address, addr, 6);
3644     rau_state = RAU_SET_ADDRESS;
3645     sm_run();
3646 }
3647 
3648 /*
3649  * @brief Set Advertisement Paramters
3650  * @param adv_int_min
3651  * @param adv_int_max
3652  * @param adv_type
3653  * @param direct_address_type
3654  * @param direct_address
3655  * @param channel_map
3656  * @param filter_policy
3657  *
3658  * @note own_address_type is used from gap_random_address_set_mode
3659  */
3660 void gap_advertisements_set_params(uint16_t adv_int_min, uint16_t adv_int_max, uint8_t adv_type,
3661     uint8_t direct_address_typ, bd_addr_t direct_address, uint8_t channel_map, uint8_t filter_policy){
3662     hci_le_advertisements_set_params(adv_int_min, adv_int_max, adv_type, gap_random_adress_type,
3663         direct_address_typ, direct_address, channel_map, filter_policy);
3664 }
3665 
3666