xref: /btstack/src/ble/sm.c (revision a83a05444bc74ea9e4b6042c8c16f535d3c8d3a5)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #include <stdio.h>
39 #include <string.h>
40 #include <inttypes.h>
41 
42 #include "ble/le_device_db.h"
43 #include "ble/core.h"
44 #include "ble/sm.h"
45 #include "btstack_debug.h"
46 #include "btstack_event.h"
47 #include "btstack_linked_list.h"
48 #include "btstack_memory.h"
49 #include "gap.h"
50 #include "hci.h"
51 #include "l2cap.h"
52 
53 #ifdef ENABLE_LE_SECURE_CONNECTIONS
54 #ifdef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
55 #error "Support for DHKEY Support in HCI Controller not implemented yet. Please use software implementation"
56 #else
57 #define USE_MBEDTLS_FOR_ECDH
58 #endif
59 #endif
60 
61 
62 // Software ECDH implementation provided by mbedtls
63 #ifdef USE_MBEDTLS_FOR_ECDH
64 #include "mbedtls/config.h"
65 #include "mbedtls/platform.h"
66 #include "mbedtls/ecp.h"
67 #include "sm_mbedtls_allocator.h"
68 #endif
69 
70 //
71 // SM internal types and globals
72 //
73 
74 typedef enum {
75     DKG_W4_WORKING,
76     DKG_CALC_IRK,
77     DKG_W4_IRK,
78     DKG_CALC_DHK,
79     DKG_W4_DHK,
80     DKG_READY
81 } derived_key_generation_t;
82 
83 typedef enum {
84     RAU_W4_WORKING,
85     RAU_IDLE,
86     RAU_GET_RANDOM,
87     RAU_W4_RANDOM,
88     RAU_GET_ENC,
89     RAU_W4_ENC,
90     RAU_SET_ADDRESS,
91 } random_address_update_t;
92 
93 typedef enum {
94     CMAC_IDLE,
95     CMAC_CALC_SUBKEYS,
96     CMAC_W4_SUBKEYS,
97     CMAC_CALC_MI,
98     CMAC_W4_MI,
99     CMAC_CALC_MLAST,
100     CMAC_W4_MLAST
101 } cmac_state_t;
102 
103 typedef enum {
104     JUST_WORKS,
105     PK_RESP_INPUT,  // Initiator displays PK, responder inputs PK
106     PK_INIT_INPUT,  // Responder displays PK, initiator inputs PK
107     OK_BOTH_INPUT,  // Only input on both, both input PK
108     NK_BOTH_INPUT,  // Only numerical compparison (yes/no) on on both sides
109     OOB             // OOB available on both sides
110 } stk_generation_method_t;
111 
112 typedef enum {
113     SM_USER_RESPONSE_IDLE,
114     SM_USER_RESPONSE_PENDING,
115     SM_USER_RESPONSE_CONFIRM,
116     SM_USER_RESPONSE_PASSKEY,
117     SM_USER_RESPONSE_DECLINE
118 } sm_user_response_t;
119 
120 typedef enum {
121     SM_AES128_IDLE,
122     SM_AES128_ACTIVE
123 } sm_aes128_state_t;
124 
125 typedef enum {
126     ADDRESS_RESOLUTION_IDLE,
127     ADDRESS_RESOLUTION_GENERAL,
128     ADDRESS_RESOLUTION_FOR_CONNECTION,
129 } address_resolution_mode_t;
130 
131 typedef enum {
132     ADDRESS_RESOLUTION_SUCEEDED,
133     ADDRESS_RESOLUTION_FAILED,
134 } address_resolution_event_t;
135 
136 typedef enum {
137     EC_KEY_GENERATION_IDLE,
138     EC_KEY_GENERATION_ACTIVE,
139     EC_KEY_GENERATION_DONE,
140 } ec_key_generation_state_t;
141 
142 typedef enum {
143     SM_STATE_VAR_DHKEY_COMMAND_RECEIVED = 1 << 0
144 } sm_state_var_t;
145 
146 //
147 // GLOBAL DATA
148 //
149 
150 static uint8_t test_use_fixed_local_csrk;
151 
152 // configuration
153 static uint8_t sm_accepted_stk_generation_methods;
154 static uint8_t sm_max_encryption_key_size;
155 static uint8_t sm_min_encryption_key_size;
156 static uint8_t sm_auth_req = 0;
157 static uint8_t sm_io_capabilities = IO_CAPABILITY_NO_INPUT_NO_OUTPUT;
158 static uint8_t sm_slave_request_security;
159 static uint8_t sm_have_ec_keypair;
160 
161 // Security Manager Master Keys, please use sm_set_er(er) and sm_set_ir(ir) with your own 128 bit random values
162 static sm_key_t sm_persistent_er;
163 static sm_key_t sm_persistent_ir;
164 
165 // derived from sm_persistent_ir
166 static sm_key_t sm_persistent_dhk;
167 static sm_key_t sm_persistent_irk;
168 static uint8_t  sm_persistent_irk_ready = 0;    // used for testing
169 static derived_key_generation_t dkg_state;
170 
171 // derived from sm_persistent_er
172 // ..
173 
174 // random address update
175 static random_address_update_t rau_state;
176 static bd_addr_t sm_random_address;
177 
178 // CMAC Calculation: General
179 static cmac_state_t sm_cmac_state;
180 static uint16_t     sm_cmac_message_len;
181 static sm_key_t     sm_cmac_k;
182 static sm_key_t     sm_cmac_x;
183 static sm_key_t     sm_cmac_m_last;
184 static uint8_t      sm_cmac_block_current;
185 static uint8_t      sm_cmac_block_count;
186 static uint8_t      (*sm_cmac_get_byte)(uint16_t offset);
187 static void         (*sm_cmac_done_handler)(uint8_t * hash);
188 
189 // CMAC for ATT Signed Writes
190 static uint8_t      sm_cmac_header[3];
191 static const uint8_t * sm_cmac_message;
192 static uint8_t      sm_cmac_sign_counter[4];
193 
194 // CMAC for Secure Connection functions
195 #ifdef ENABLE_LE_SECURE_CONNECTIONS
196 static sm_connection_t * sm_cmac_connection;
197 static uint8_t           sm_cmac_sc_buffer[80];
198 #endif
199 
200 // resolvable private address lookup / CSRK calculation
201 static int       sm_address_resolution_test;
202 static int       sm_address_resolution_ah_calculation_active;
203 static uint8_t   sm_address_resolution_addr_type;
204 static bd_addr_t sm_address_resolution_address;
205 static void *    sm_address_resolution_context;
206 static address_resolution_mode_t sm_address_resolution_mode;
207 static btstack_linked_list_t sm_address_resolution_general_queue;
208 
209 // aes128 crypto engine. store current sm_connection_t in sm_aes128_context
210 static sm_aes128_state_t  sm_aes128_state;
211 static void *             sm_aes128_context;
212 
213 // random engine. store context (ususally sm_connection_t)
214 static void * sm_random_context;
215 
216 // to receive hci events
217 static btstack_packet_callback_registration_t hci_event_callback_registration;
218 
219 /* to dispatch sm event */
220 static btstack_linked_list_t sm_event_handlers;
221 
222 
223 // Software ECDH implementation provided by mbedtls
224 #ifdef USE_MBEDTLS_FOR_ECDH
225 // group is always valid
226 static mbedtls_ecp_group   mbedtls_ec_group;
227 static ec_key_generation_state_t ec_key_generation_state;
228 static uint8_t ec_qx[32];
229 static uint8_t ec_qy[32];
230 static uint8_t ec_d[32];
231 #ifndef HAVE_MALLOC
232 // 4304 bytes with 73 allocations
233 #define MBEDTLS_ALLOC_BUFFER_SIZE (1300+23*sizeof(void *))
234 static uint8_t mbedtls_memory_buffer[MBEDTLS_ALLOC_BUFFER_SIZE];
235 #endif
236 #endif
237 
238 //
239 // Volume 3, Part H, Chapter 24
240 // "Security shall be initiated by the Security Manager in the device in the master role.
241 // The device in the slave role shall be the responding device."
242 // -> master := initiator, slave := responder
243 //
244 
245 // data needed for security setup
246 typedef struct sm_setup_context {
247 
248     btstack_timer_source_t sm_timeout;
249 
250     // used in all phases
251     uint8_t   sm_pairing_failed_reason;
252 
253     // user response, (Phase 1 and/or 2)
254     uint8_t   sm_user_response;
255 
256     // defines which keys will be send after connection is encrypted - calculated during Phase 1, used Phase 3
257     int       sm_key_distribution_send_set;
258     int       sm_key_distribution_received_set;
259 
260     // Phase 2 (Pairing over SMP)
261     stk_generation_method_t sm_stk_generation_method;
262     sm_key_t  sm_tk;
263     uint8_t   sm_use_secure_connections;
264 
265     sm_key_t  sm_c1_t3_value;   // c1 calculation
266     sm_pairing_packet_t sm_m_preq; // pairing request - needed only for c1
267     sm_pairing_packet_t sm_s_pres; // pairing response - needed only for c1
268     sm_key_t  sm_local_random;
269     sm_key_t  sm_local_confirm;
270     sm_key_t  sm_peer_random;
271     sm_key_t  sm_peer_confirm;
272     uint8_t   sm_m_addr_type;   // address and type can be removed
273     uint8_t   sm_s_addr_type;   //  ''
274     bd_addr_t sm_m_address;     //  ''
275     bd_addr_t sm_s_address;     //  ''
276     sm_key_t  sm_ltk;
277 
278     uint8_t   sm_state_vars;
279 #ifdef ENABLE_LE_SECURE_CONNECTIONS
280     uint8_t   sm_peer_qx[32];   // also stores random for EC key generation during init
281     uint8_t   sm_peer_qy[32];   //  ''
282     sm_key_t  sm_peer_nonce;    // might be combined with sm_peer_random
283     sm_key_t  sm_local_nonce;   // might be combined with sm_local_random
284     sm_key_t  sm_peer_dhkey_check;
285     sm_key_t  sm_local_dhkey_check;
286     sm_key_t  sm_ra;
287     sm_key_t  sm_rb;
288     sm_key_t  sm_t;             // used for f5
289     sm_key_t  sm_mackey;
290     uint8_t   sm_passkey_bit;   // also stores number of generated random bytes for EC key generation
291 #endif
292 
293     // Phase 3
294 
295     // key distribution, we generate
296     uint16_t  sm_local_y;
297     uint16_t  sm_local_div;
298     uint16_t  sm_local_ediv;
299     uint8_t   sm_local_rand[8];
300     sm_key_t  sm_local_ltk;
301     sm_key_t  sm_local_csrk;
302     sm_key_t  sm_local_irk;
303     // sm_local_address/addr_type not needed
304 
305     // key distribution, received from peer
306     uint16_t  sm_peer_y;
307     uint16_t  sm_peer_div;
308     uint16_t  sm_peer_ediv;
309     uint8_t   sm_peer_rand[8];
310     sm_key_t  sm_peer_ltk;
311     sm_key_t  sm_peer_irk;
312     sm_key_t  sm_peer_csrk;
313     uint8_t   sm_peer_addr_type;
314     bd_addr_t sm_peer_address;
315 
316 } sm_setup_context_t;
317 
318 //
319 static sm_setup_context_t the_setup;
320 static sm_setup_context_t * setup = &the_setup;
321 
322 // active connection - the one for which the_setup is used for
323 static uint16_t sm_active_connection = 0;
324 
325 // @returns 1 if oob data is available
326 // stores oob data in provided 16 byte buffer if not null
327 static int (*sm_get_oob_data)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data) = NULL;
328 
329 // used to notify applicationss that user interaction is neccessary, see sm_notify_t below
330 static btstack_packet_handler_t sm_client_packet_handler = NULL;
331 
332 // horizontal: initiator capabilities
333 // vertial:    responder capabilities
334 static const stk_generation_method_t stk_generation_method [5] [5] = {
335     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
336     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
337     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
338     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
339     { PK_RESP_INPUT,   PK_RESP_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
340 };
341 
342 // uses numeric comparison if one side has DisplayYesNo and KeyboardDisplay combinations
343 #ifdef ENABLE_LE_SECURE_CONNECTIONS
344 static const stk_generation_method_t stk_generation_method_with_secure_connection[5][5] = {
345     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
346     { JUST_WORKS,      NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
347     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
348     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
349     { PK_RESP_INPUT,   NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
350 };
351 #endif
352 
353 static void sm_run(void);
354 static void sm_done_for_handle(hci_con_handle_t con_handle);
355 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle);
356 static inline int sm_calc_actual_encryption_key_size(int other);
357 static int sm_validate_stk_generation_method(void);
358 static void sm_shift_left_by_one_bit_inplace(int len, uint8_t * data);
359 
360 static void log_info_hex16(const char * name, uint16_t value){
361     log_info("%-6s 0x%04x", name, value);
362 }
363 
364 // @returns 1 if all bytes are 0
365 static int sm_is_null(uint8_t * data, int size){
366     int i;
367     for (i=0; i < size ; i++){
368         if (data[i]) return 0;
369     }
370     return 1;
371 }
372 
373 static int sm_is_null_random(uint8_t random[8]){
374     return sm_is_null(random, 8);
375 }
376 
377 static int sm_is_null_key(uint8_t * key){
378     return sm_is_null(key, 16);
379 }
380 
381 // Key utils
382 static void sm_reset_tk(void){
383     int i;
384     for (i=0;i<16;i++){
385         setup->sm_tk[i] = 0;
386     }
387 }
388 
389 // "For example, if a 128-bit encryption key is 0x123456789ABCDEF0123456789ABCDEF0
390 // and it is reduced to 7 octets (56 bits), then the resulting key is 0x0000000000000000003456789ABCDEF0.""
391 static void sm_truncate_key(sm_key_t key, int max_encryption_size){
392     int i;
393     for (i = max_encryption_size ; i < 16 ; i++){
394         key[15-i] = 0;
395     }
396 }
397 
398 // SMP Timeout implementation
399 
400 // Upon transmission of the Pairing Request command or reception of the Pairing Request command,
401 // the Security Manager Timer shall be reset and started.
402 //
403 // The Security Manager Timer shall be reset when an L2CAP SMP command is queued for transmission.
404 //
405 // If the Security Manager Timer reaches 30 seconds, the procedure shall be considered to have failed,
406 // and the local higher layer shall be notified. No further SMP commands shall be sent over the L2CAP
407 // Security Manager Channel. A new SM procedure shall only be performed when a new physical link has been
408 // established.
409 
410 static void sm_timeout_handler(btstack_timer_source_t * timer){
411     log_info("SM timeout");
412     sm_connection_t * sm_conn = (sm_connection_t*) btstack_run_loop_get_timer_context(timer);
413     sm_conn->sm_engine_state = SM_GENERAL_TIMEOUT;
414     sm_done_for_handle(sm_conn->sm_handle);
415 
416     // trigger handling of next ready connection
417     sm_run();
418 }
419 static void sm_timeout_start(sm_connection_t * sm_conn){
420     btstack_run_loop_remove_timer(&setup->sm_timeout);
421     btstack_run_loop_set_timer_context(&setup->sm_timeout, sm_conn);
422     btstack_run_loop_set_timer_handler(&setup->sm_timeout, sm_timeout_handler);
423     btstack_run_loop_set_timer(&setup->sm_timeout, 30000); // 30 seconds sm timeout
424     btstack_run_loop_add_timer(&setup->sm_timeout);
425 }
426 static void sm_timeout_stop(void){
427     btstack_run_loop_remove_timer(&setup->sm_timeout);
428 }
429 static void sm_timeout_reset(sm_connection_t * sm_conn){
430     sm_timeout_stop();
431     sm_timeout_start(sm_conn);
432 }
433 
434 // end of sm timeout
435 
436 // GAP Random Address updates
437 static gap_random_address_type_t gap_random_adress_type;
438 static btstack_timer_source_t gap_random_address_update_timer;
439 static uint32_t gap_random_adress_update_period;
440 
441 static void gap_random_address_trigger(void){
442     if (rau_state != RAU_IDLE) return;
443     log_info("gap_random_address_trigger");
444     rau_state = RAU_GET_RANDOM;
445     sm_run();
446 }
447 
448 static void gap_random_address_update_handler(btstack_timer_source_t * timer){
449     log_info("GAP Random Address Update due");
450     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
451     btstack_run_loop_add_timer(&gap_random_address_update_timer);
452     gap_random_address_trigger();
453 }
454 
455 static void gap_random_address_update_start(void){
456     btstack_run_loop_set_timer_handler(&gap_random_address_update_timer, gap_random_address_update_handler);
457     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
458     btstack_run_loop_add_timer(&gap_random_address_update_timer);
459 }
460 
461 static void gap_random_address_update_stop(void){
462     btstack_run_loop_remove_timer(&gap_random_address_update_timer);
463 }
464 
465 
466 static void sm_random_start(void * context){
467     sm_random_context = context;
468     hci_send_cmd(&hci_le_rand);
469 }
470 
471 // pre: sm_aes128_state != SM_AES128_ACTIVE, hci_can_send_command == 1
472 // context is made availabe to aes128 result handler by this
473 static void sm_aes128_start(sm_key_t key, sm_key_t plaintext, void * context){
474     sm_aes128_state = SM_AES128_ACTIVE;
475     sm_key_t key_flipped, plaintext_flipped;
476     reverse_128(key, key_flipped);
477     reverse_128(plaintext, plaintext_flipped);
478     sm_aes128_context = context;
479     hci_send_cmd(&hci_le_encrypt, key_flipped, plaintext_flipped);
480 }
481 
482 // ah(k,r) helper
483 // r = padding || r
484 // r - 24 bit value
485 static void sm_ah_r_prime(uint8_t r[3], sm_key_t r_prime){
486     // r'= padding || r
487     memset(r_prime, 0, 16);
488     memcpy(&r_prime[13], r, 3);
489 }
490 
491 // d1 helper
492 // d' = padding || r || d
493 // d,r - 16 bit values
494 static void sm_d1_d_prime(uint16_t d, uint16_t r, sm_key_t d1_prime){
495     // d'= padding || r || d
496     memset(d1_prime, 0, 16);
497     big_endian_store_16(d1_prime, 12, r);
498     big_endian_store_16(d1_prime, 14, d);
499 }
500 
501 // dm helper
502 // r’ = padding || r
503 // r - 64 bit value
504 static void sm_dm_r_prime(uint8_t r[8], sm_key_t r_prime){
505     memset(r_prime, 0, 16);
506     memcpy(&r_prime[8], r, 8);
507 }
508 
509 // calculate arguments for first AES128 operation in C1 function
510 static void sm_c1_t1(sm_key_t r, uint8_t preq[7], uint8_t pres[7], uint8_t iat, uint8_t rat, sm_key_t t1){
511 
512     // p1 = pres || preq || rat’ || iat’
513     // "The octet of iat’ becomes the least significant octet of p1 and the most signifi-
514     // cant octet of pres becomes the most significant octet of p1.
515     // For example, if the 8-bit iat’ is 0x01, the 8-bit rat’ is 0x00, the 56-bit preq
516     // is 0x07071000000101 and the 56 bit pres is 0x05000800000302 then
517     // p1 is 0x05000800000302070710000001010001."
518 
519     sm_key_t p1;
520     reverse_56(pres, &p1[0]);
521     reverse_56(preq, &p1[7]);
522     p1[14] = rat;
523     p1[15] = iat;
524     log_info_key("p1", p1);
525     log_info_key("r", r);
526 
527     // t1 = r xor p1
528     int i;
529     for (i=0;i<16;i++){
530         t1[i] = r[i] ^ p1[i];
531     }
532     log_info_key("t1", t1);
533 }
534 
535 // calculate arguments for second AES128 operation in C1 function
536 static void sm_c1_t3(sm_key_t t2, bd_addr_t ia, bd_addr_t ra, sm_key_t t3){
537      // p2 = padding || ia || ra
538     // "The least significant octet of ra becomes the least significant octet of p2 and
539     // the most significant octet of padding becomes the most significant octet of p2.
540     // For example, if 48-bit ia is 0xA1A2A3A4A5A6 and the 48-bit ra is
541     // 0xB1B2B3B4B5B6 then p2 is 0x00000000A1A2A3A4A5A6B1B2B3B4B5B6.
542 
543     sm_key_t p2;
544     memset(p2, 0, 16);
545     memcpy(&p2[4],  ia, 6);
546     memcpy(&p2[10], ra, 6);
547     log_info_key("p2", p2);
548 
549     // c1 = e(k, t2_xor_p2)
550     int i;
551     for (i=0;i<16;i++){
552         t3[i] = t2[i] ^ p2[i];
553     }
554     log_info_key("t3", t3);
555 }
556 
557 static void sm_s1_r_prime(sm_key_t r1, sm_key_t r2, sm_key_t r_prime){
558     log_info_key("r1", r1);
559     log_info_key("r2", r2);
560     memcpy(&r_prime[8], &r2[8], 8);
561     memcpy(&r_prime[0], &r1[8], 8);
562 }
563 
564 #ifdef ENABLE_LE_SECURE_CONNECTIONS
565 // Software implementations of crypto toolbox for LE Secure Connection
566 // TODO: replace with code to use AES Engine of HCI Controller
567 typedef uint8_t sm_key24_t[3];
568 typedef uint8_t sm_key56_t[7];
569 typedef uint8_t sm_key256_t[32];
570 
571 #if 0
572 static void aes128_calc_cyphertext(const uint8_t key[16], const uint8_t plaintext[16], uint8_t cyphertext[16]){
573     uint32_t rk[RKLENGTH(KEYBITS)];
574     int nrounds = rijndaelSetupEncrypt(rk, &key[0], KEYBITS);
575     rijndaelEncrypt(rk, nrounds, plaintext, cyphertext);
576 }
577 
578 static void calc_subkeys(sm_key_t k0, sm_key_t k1, sm_key_t k2){
579     memcpy(k1, k0, 16);
580     sm_shift_left_by_one_bit_inplace(16, k1);
581     if (k0[0] & 0x80){
582         k1[15] ^= 0x87;
583     }
584     memcpy(k2, k1, 16);
585     sm_shift_left_by_one_bit_inplace(16, k2);
586     if (k1[0] & 0x80){
587         k2[15] ^= 0x87;
588     }
589 }
590 
591 static void aes_cmac(sm_key_t aes_cmac, const sm_key_t key, const uint8_t * data, int cmac_message_len){
592     sm_key_t k0, k1, k2, zero;
593     memset(zero, 0, 16);
594 
595     aes128_calc_cyphertext(key, zero, k0);
596     calc_subkeys(k0, k1, k2);
597 
598     int cmac_block_count = (cmac_message_len + 15) / 16;
599 
600     // step 3: ..
601     if (cmac_block_count==0){
602         cmac_block_count = 1;
603     }
604 
605     // step 4: set m_last
606     sm_key_t cmac_m_last;
607     int sm_cmac_last_block_complete = cmac_message_len != 0 && (cmac_message_len & 0x0f) == 0;
608     int i;
609     if (sm_cmac_last_block_complete){
610         for (i=0;i<16;i++){
611             cmac_m_last[i] = data[cmac_message_len - 16 + i] ^ k1[i];
612         }
613     } else {
614         int valid_octets_in_last_block = cmac_message_len & 0x0f;
615         for (i=0;i<16;i++){
616             if (i < valid_octets_in_last_block){
617                 cmac_m_last[i] = data[(cmac_message_len & 0xfff0) + i] ^ k2[i];
618                 continue;
619             }
620             if (i == valid_octets_in_last_block){
621                 cmac_m_last[i] = 0x80 ^ k2[i];
622                 continue;
623             }
624             cmac_m_last[i] = k2[i];
625         }
626     }
627 
628     // printf("sm_cmac_start: len %u, block count %u\n", cmac_message_len, cmac_block_count);
629     // LOG_KEY(cmac_m_last);
630 
631     // Step 5
632     sm_key_t cmac_x;
633     memset(cmac_x, 0, 16);
634 
635     // Step 6
636     sm_key_t sm_cmac_y;
637     for (int block = 0 ; block < cmac_block_count-1 ; block++){
638         for (i=0;i<16;i++){
639             sm_cmac_y[i] = cmac_x[i] ^ data[block * 16 + i];
640         }
641         aes128_calc_cyphertext(key, sm_cmac_y, cmac_x);
642     }
643     for (i=0;i<16;i++){
644         sm_cmac_y[i] = cmac_x[i] ^ cmac_m_last[i];
645     }
646 
647     // Step 7
648     aes128_calc_cyphertext(key, sm_cmac_y, aes_cmac);
649 }
650 #endif
651 
652 #if 0
653 //
654 // Link Key Conversion Function h6
655 //
656 // h6(W, keyID) = AES-CMACW(keyID)
657 // - W is 128 bits
658 // - keyID is 32 bits
659 static void h6(sm_key_t res, const sm_key_t w, const uint32_t key_id){
660     uint8_t key_id_buffer[4];
661     big_endian_store_32(key_id_buffer, 0, key_id);
662     aes_cmac(res, w, key_id_buffer, 4);
663 }
664 #endif
665 #endif
666 
667 static void sm_setup_event_base(uint8_t * event, int event_size, uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
668     event[0] = type;
669     event[1] = event_size - 2;
670     little_endian_store_16(event, 2, con_handle);
671     event[4] = addr_type;
672     reverse_bd_addr(address, &event[5]);
673 }
674 
675 static void sm_dispatch_event(uint8_t packet_type, uint16_t channel, uint8_t * packet, uint16_t size){
676     if (sm_client_packet_handler) {
677         sm_client_packet_handler(HCI_EVENT_PACKET, 0, packet, size);
678     }
679     // dispatch to all event handlers
680     btstack_linked_list_iterator_t it;
681     btstack_linked_list_iterator_init(&it, &sm_event_handlers);
682     while (btstack_linked_list_iterator_has_next(&it)){
683         btstack_packet_callback_registration_t * entry = (btstack_packet_callback_registration_t*) btstack_linked_list_iterator_next(&it);
684         entry->callback(packet_type, 0, packet, size);
685     }
686 }
687 
688 static void sm_notify_client_base(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
689     uint8_t event[11];
690     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
691     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
692 }
693 
694 static void sm_notify_client_passkey(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint32_t passkey){
695     uint8_t event[15];
696     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
697     little_endian_store_32(event, 11, passkey);
698     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
699 }
700 
701 static void sm_notify_client_index(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint16_t index){
702     uint8_t event[13];
703     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
704     little_endian_store_16(event, 11, index);
705     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
706 }
707 
708 static void sm_notify_client_authorization(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint8_t result){
709 
710     uint8_t event[18];
711     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
712     event[11] = result;
713     sm_dispatch_event(HCI_EVENT_PACKET, 0, (uint8_t*) &event, sizeof(event));
714 }
715 
716 // decide on stk generation based on
717 // - pairing request
718 // - io capabilities
719 // - OOB data availability
720 static void sm_setup_tk(void){
721 
722     // default: just works
723     setup->sm_stk_generation_method = JUST_WORKS;
724 
725 #ifdef ENABLE_LE_SECURE_CONNECTIONS
726     setup->sm_use_secure_connections = ( sm_pairing_packet_get_auth_req(setup->sm_m_preq)
727                                        & sm_pairing_packet_get_auth_req(setup->sm_s_pres)
728                                        & SM_AUTHREQ_SECURE_CONNECTION ) != 0;
729     memset(setup->sm_ra, 0, 16);
730     memset(setup->sm_rb, 0, 16);
731 #else
732     setup->sm_use_secure_connections = 0;
733 #endif
734 
735     // If both devices have not set the MITM option in the Authentication Requirements
736     // Flags, then the IO capabilities shall be ignored and the Just Works association
737     // model shall be used.
738     if (((sm_pairing_packet_get_auth_req(setup->sm_m_preq) & SM_AUTHREQ_MITM_PROTECTION) == 0)
739     &&  ((sm_pairing_packet_get_auth_req(setup->sm_s_pres) & SM_AUTHREQ_MITM_PROTECTION) == 0)){
740         log_info("SM: MITM not required by both -> JUST WORKS");
741         return;
742     }
743 
744     // TODO: with LE SC, OOB is used to transfer data OOB during pairing, single device with OOB is sufficient
745 
746     // If both devices have out of band authentication data, then the Authentication
747     // Requirements Flags shall be ignored when selecting the pairing method and the
748     // Out of Band pairing method shall be used.
749     if (sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq)
750     &&  sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres)){
751         log_info("SM: have OOB data");
752         log_info_key("OOB", setup->sm_tk);
753         setup->sm_stk_generation_method = OOB;
754         return;
755     }
756 
757     // Reset TK as it has been setup in sm_init_setup
758     sm_reset_tk();
759 
760     // Also use just works if unknown io capabilites
761     if ((sm_pairing_packet_get_io_capability(setup->sm_m_preq) > IO_CAPABILITY_KEYBOARD_DISPLAY) || (sm_pairing_packet_get_io_capability(setup->sm_s_pres) > IO_CAPABILITY_KEYBOARD_DISPLAY)){
762         return;
763     }
764 
765     // Otherwise the IO capabilities of the devices shall be used to determine the
766     // pairing method as defined in Table 2.4.
767     // see http://stackoverflow.com/a/1052837/393697 for how to specify pointer to 2-dimensional array
768     const stk_generation_method_t (*generation_method)[5] = stk_generation_method;
769 
770 #ifdef ENABLE_LE_SECURE_CONNECTIONS
771     // table not define by default
772     if (setup->sm_use_secure_connections){
773         generation_method = stk_generation_method_with_secure_connection;
774     }
775 #endif
776     setup->sm_stk_generation_method = generation_method[sm_pairing_packet_get_io_capability(setup->sm_s_pres)][sm_pairing_packet_get_io_capability(setup->sm_m_preq)];
777 
778     log_info("sm_setup_tk: master io cap: %u, slave io cap: %u -> method %u",
779         sm_pairing_packet_get_io_capability(setup->sm_m_preq), sm_pairing_packet_get_io_capability(setup->sm_s_pres), setup->sm_stk_generation_method);
780 }
781 
782 static int sm_key_distribution_flags_for_set(uint8_t key_set){
783     int flags = 0;
784     if (key_set & SM_KEYDIST_ENC_KEY){
785         flags |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
786         flags |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
787     }
788     if (key_set & SM_KEYDIST_ID_KEY){
789         flags |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
790         flags |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
791     }
792     if (key_set & SM_KEYDIST_SIGN){
793         flags |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
794     }
795     return flags;
796 }
797 
798 static void sm_setup_key_distribution(uint8_t key_set){
799     setup->sm_key_distribution_received_set = 0;
800     setup->sm_key_distribution_send_set = sm_key_distribution_flags_for_set(key_set);
801 }
802 
803 // CSRK Key Lookup
804 
805 
806 static int sm_address_resolution_idle(void){
807     return sm_address_resolution_mode == ADDRESS_RESOLUTION_IDLE;
808 }
809 
810 static void sm_address_resolution_start_lookup(uint8_t addr_type, hci_con_handle_t con_handle, bd_addr_t addr, address_resolution_mode_t mode, void * context){
811     memcpy(sm_address_resolution_address, addr, 6);
812     sm_address_resolution_addr_type = addr_type;
813     sm_address_resolution_test = 0;
814     sm_address_resolution_mode = mode;
815     sm_address_resolution_context = context;
816     sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_STARTED, con_handle, addr_type, addr);
817 }
818 
819 int sm_address_resolution_lookup(uint8_t address_type, bd_addr_t address){
820     // check if already in list
821     btstack_linked_list_iterator_t it;
822     sm_lookup_entry_t * entry;
823     btstack_linked_list_iterator_init(&it, &sm_address_resolution_general_queue);
824     while(btstack_linked_list_iterator_has_next(&it)){
825         entry = (sm_lookup_entry_t *) btstack_linked_list_iterator_next(&it);
826         if (entry->address_type != address_type) continue;
827         if (memcmp(entry->address, address, 6))  continue;
828         // already in list
829         return BTSTACK_BUSY;
830     }
831     entry = btstack_memory_sm_lookup_entry_get();
832     if (!entry) return BTSTACK_MEMORY_ALLOC_FAILED;
833     entry->address_type = (bd_addr_type_t) address_type;
834     memcpy(entry->address, address, 6);
835     btstack_linked_list_add(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
836     sm_run();
837     return 0;
838 }
839 
840 // CMAC Implementation using AES128 engine
841 static void sm_shift_left_by_one_bit_inplace(int len, uint8_t * data){
842     int i;
843     int carry = 0;
844     for (i=len-1; i >= 0 ; i--){
845         int new_carry = data[i] >> 7;
846         data[i] = data[i] << 1 | carry;
847         carry = new_carry;
848     }
849 }
850 
851 // while x_state++ for an enum is possible in C, it isn't in C++. we use this helpers to avoid compile errors for now
852 static inline void sm_next_responding_state(sm_connection_t * sm_conn){
853     sm_conn->sm_engine_state = (security_manager_state_t) (((int)sm_conn->sm_engine_state) + 1);
854 }
855 static inline void dkg_next_state(void){
856     dkg_state = (derived_key_generation_t) (((int)dkg_state) + 1);
857 }
858 static inline void rau_next_state(void){
859     rau_state = (random_address_update_t) (((int)rau_state) + 1);
860 }
861 
862 // CMAC calculation using AES Engine
863 
864 static inline void sm_cmac_next_state(void){
865     sm_cmac_state = (cmac_state_t) (((int)sm_cmac_state) + 1);
866 }
867 
868 static int sm_cmac_last_block_complete(void){
869     if (sm_cmac_message_len == 0) return 0;
870     return (sm_cmac_message_len & 0x0f) == 0;
871 }
872 
873 static inline uint8_t sm_cmac_message_get_byte(uint16_t offset){
874     if (offset >= sm_cmac_message_len) {
875         log_error("sm_cmac_message_get_byte. out of bounds, access %u, len %u", offset, sm_cmac_message_len);
876         return 0;
877     }
878 
879     offset = sm_cmac_message_len - 1 - offset;
880 
881     // sm_cmac_header[3] | message[] | sm_cmac_sign_counter[4]
882     if (offset < 3){
883         return sm_cmac_header[offset];
884     }
885     int actual_message_len_incl_header = sm_cmac_message_len - 4;
886     if (offset <  actual_message_len_incl_header){
887         return sm_cmac_message[offset - 3];
888     }
889     return sm_cmac_sign_counter[offset - actual_message_len_incl_header];
890 }
891 
892 // generic cmac calculation
893 void sm_cmac_general_start(const sm_key_t key, uint16_t message_len, uint8_t (*get_byte_callback)(uint16_t offset), void (*done_callback)(uint8_t hash[8])){
894     // Generalized CMAC
895     memcpy(sm_cmac_k, key, 16);
896     memset(sm_cmac_x, 0, 16);
897     sm_cmac_block_current = 0;
898     sm_cmac_message_len  = message_len;
899     sm_cmac_done_handler = done_callback;
900     sm_cmac_get_byte     = get_byte_callback;
901 
902     // step 2: n := ceil(len/const_Bsize);
903     sm_cmac_block_count = (sm_cmac_message_len + 15) / 16;
904 
905     // step 3: ..
906     if (sm_cmac_block_count==0){
907         sm_cmac_block_count = 1;
908     }
909     log_info("sm_cmac_general_start: len %u, block count %u", sm_cmac_message_len, sm_cmac_block_count);
910 
911     // first, we need to compute l for k1, k2, and m_last
912     sm_cmac_state = CMAC_CALC_SUBKEYS;
913 
914     // let's go
915     sm_run();
916 }
917 
918 // cmac for ATT Message signing
919 void sm_cmac_start(const sm_key_t k, uint8_t opcode, hci_con_handle_t con_handle, uint16_t message_len, const uint8_t * message, uint32_t sign_counter, void (*done_handler)(uint8_t * hash)){
920     // ATT Message Signing
921     sm_cmac_header[0] = opcode;
922     little_endian_store_16(sm_cmac_header, 1, con_handle);
923     little_endian_store_32(sm_cmac_sign_counter, 0, sign_counter);
924     uint16_t total_message_len = 3 + message_len + 4;  // incl. virtually prepended att opcode, handle and appended sign_counter in LE
925     sm_cmac_message = message;
926     sm_cmac_general_start(k, total_message_len, &sm_cmac_message_get_byte, done_handler);
927 }
928 
929 int sm_cmac_ready(void){
930     return sm_cmac_state == CMAC_IDLE;
931 }
932 
933 static void sm_cmac_handle_aes_engine_ready(void){
934     switch (sm_cmac_state){
935         case CMAC_CALC_SUBKEYS: {
936             sm_key_t const_zero;
937             memset(const_zero, 0, 16);
938             sm_cmac_next_state();
939             sm_aes128_start(sm_cmac_k, const_zero, NULL);
940             break;
941         }
942         case CMAC_CALC_MI: {
943             int j;
944             sm_key_t y;
945             for (j=0;j<16;j++){
946                 y[j] = sm_cmac_x[j] ^ sm_cmac_get_byte(sm_cmac_block_current*16 + j);
947             }
948             sm_cmac_block_current++;
949             sm_cmac_next_state();
950             sm_aes128_start(sm_cmac_k, y, NULL);
951             break;
952         }
953         case CMAC_CALC_MLAST: {
954             int i;
955             sm_key_t y;
956             for (i=0;i<16;i++){
957                 y[i] = sm_cmac_x[i] ^ sm_cmac_m_last[i];
958             }
959             log_info_key("Y", y);
960             sm_cmac_block_current++;
961             sm_cmac_next_state();
962             sm_aes128_start(sm_cmac_k, y, NULL);
963             break;
964         }
965         default:
966             log_info("sm_cmac_handle_aes_engine_ready called in state %u", sm_cmac_state);
967             break;
968     }
969 }
970 
971 static void sm_cmac_handle_encryption_result(sm_key_t data){
972     switch (sm_cmac_state){
973         case CMAC_W4_SUBKEYS: {
974             sm_key_t k1;
975             memcpy(k1, data, 16);
976             sm_shift_left_by_one_bit_inplace(16, k1);
977             if (data[0] & 0x80){
978                 k1[15] ^= 0x87;
979             }
980             sm_key_t k2;
981             memcpy(k2, k1, 16);
982             sm_shift_left_by_one_bit_inplace(16, k2);
983             if (k1[0] & 0x80){
984                 k2[15] ^= 0x87;
985             }
986 
987             log_info_key("k", sm_cmac_k);
988             log_info_key("k1", k1);
989             log_info_key("k2", k2);
990 
991             // step 4: set m_last
992             int i;
993             if (sm_cmac_last_block_complete()){
994                 for (i=0;i<16;i++){
995                     sm_cmac_m_last[i] = sm_cmac_get_byte(sm_cmac_message_len - 16 + i) ^ k1[i];
996                 }
997             } else {
998                 int valid_octets_in_last_block = sm_cmac_message_len & 0x0f;
999                 for (i=0;i<16;i++){
1000                     if (i < valid_octets_in_last_block){
1001                         sm_cmac_m_last[i] = sm_cmac_get_byte((sm_cmac_message_len & 0xfff0) + i) ^ k2[i];
1002                         continue;
1003                     }
1004                     if (i == valid_octets_in_last_block){
1005                         sm_cmac_m_last[i] = 0x80 ^ k2[i];
1006                         continue;
1007                     }
1008                     sm_cmac_m_last[i] = k2[i];
1009                 }
1010             }
1011 
1012             // next
1013             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
1014             break;
1015         }
1016         case CMAC_W4_MI:
1017             memcpy(sm_cmac_x, data, 16);
1018             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
1019             break;
1020         case CMAC_W4_MLAST:
1021             // done
1022             log_info("Setting CMAC Engine to IDLE");
1023             sm_cmac_state = CMAC_IDLE;
1024             log_info_key("CMAC", data);
1025             sm_cmac_done_handler(data);
1026             break;
1027         default:
1028             log_info("sm_cmac_handle_encryption_result called in state %u", sm_cmac_state);
1029             break;
1030     }
1031 }
1032 
1033 static void sm_trigger_user_response(sm_connection_t * sm_conn){
1034     // notify client for: JUST WORKS confirm, Numeric comparison confirm, PASSKEY display or input
1035     setup->sm_user_response = SM_USER_RESPONSE_IDLE;
1036     switch (setup->sm_stk_generation_method){
1037         case PK_RESP_INPUT:
1038             if (sm_conn->sm_role){
1039                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1040                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1041             } else {
1042                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1043             }
1044             break;
1045         case PK_INIT_INPUT:
1046             if (sm_conn->sm_role){
1047                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1048             } else {
1049                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1050                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1051             }
1052             break;
1053         case OK_BOTH_INPUT:
1054             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1055             sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1056             break;
1057         case NK_BOTH_INPUT:
1058             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1059             sm_notify_client_passkey(SM_EVENT_NUMERIC_COMPARISON_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1060             break;
1061         case JUST_WORKS:
1062             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1063             sm_notify_client_base(SM_EVENT_JUST_WORKS_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1064             break;
1065         case OOB:
1066             // client already provided OOB data, let's skip notification.
1067             break;
1068     }
1069 }
1070 
1071 static int sm_key_distribution_all_received(sm_connection_t * sm_conn){
1072     int recv_flags;
1073     if (sm_conn->sm_role){
1074         // slave / responder
1075         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres));
1076     } else {
1077         // master / initiator
1078         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
1079     }
1080     log_debug("sm_key_distribution_all_received: received 0x%02x, expecting 0x%02x", setup->sm_key_distribution_received_set, recv_flags);
1081     return recv_flags == setup->sm_key_distribution_received_set;
1082 }
1083 
1084 static void sm_done_for_handle(hci_con_handle_t con_handle){
1085     if (sm_active_connection == con_handle){
1086         sm_timeout_stop();
1087         sm_active_connection = 0;
1088         log_info("sm: connection 0x%x released setup context", con_handle);
1089     }
1090 }
1091 
1092 static int sm_key_distribution_flags_for_auth_req(void){
1093     int flags = SM_KEYDIST_ID_KEY | SM_KEYDIST_SIGN;
1094     if (sm_auth_req & SM_AUTHREQ_BONDING){
1095         // encryption information only if bonding requested
1096         flags |= SM_KEYDIST_ENC_KEY;
1097     }
1098     return flags;
1099 }
1100 
1101 static void sm_init_setup(sm_connection_t * sm_conn){
1102 
1103     // fill in sm setup
1104     setup->sm_state_vars = 0;
1105     sm_reset_tk();
1106     setup->sm_peer_addr_type = sm_conn->sm_peer_addr_type;
1107     memcpy(setup->sm_peer_address, sm_conn->sm_peer_address, 6);
1108 
1109     // query client for OOB data
1110     int have_oob_data = 0;
1111     if (sm_get_oob_data) {
1112         have_oob_data = (*sm_get_oob_data)(sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, setup->sm_tk);
1113     }
1114 
1115     sm_pairing_packet_t * local_packet;
1116     if (sm_conn->sm_role){
1117         // slave
1118         local_packet = &setup->sm_s_pres;
1119         gap_advertisements_get_address(&setup->sm_s_addr_type, setup->sm_s_address);
1120         setup->sm_m_addr_type = sm_conn->sm_peer_addr_type;
1121         memcpy(setup->sm_m_address, sm_conn->sm_peer_address, 6);
1122     } else {
1123         // master
1124         local_packet = &setup->sm_m_preq;
1125         gap_advertisements_get_address(&setup->sm_m_addr_type, setup->sm_m_address);
1126         setup->sm_s_addr_type = sm_conn->sm_peer_addr_type;
1127         memcpy(setup->sm_s_address, sm_conn->sm_peer_address, 6);
1128 
1129         int key_distribution_flags = sm_key_distribution_flags_for_auth_req();
1130         sm_pairing_packet_set_initiator_key_distribution(setup->sm_m_preq, key_distribution_flags);
1131         sm_pairing_packet_set_responder_key_distribution(setup->sm_m_preq, key_distribution_flags);
1132     }
1133 
1134     uint8_t auth_req = sm_auth_req;
1135     sm_pairing_packet_set_io_capability(*local_packet, sm_io_capabilities);
1136     sm_pairing_packet_set_oob_data_flag(*local_packet, have_oob_data);
1137     sm_pairing_packet_set_auth_req(*local_packet, auth_req);
1138     sm_pairing_packet_set_max_encryption_key_size(*local_packet, sm_max_encryption_key_size);
1139 }
1140 
1141 static int sm_stk_generation_init(sm_connection_t * sm_conn){
1142 
1143     sm_pairing_packet_t * remote_packet;
1144     int                   remote_key_request;
1145     if (sm_conn->sm_role){
1146         // slave / responder
1147         remote_packet      = &setup->sm_m_preq;
1148         remote_key_request = sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq);
1149     } else {
1150         // master / initiator
1151         remote_packet      = &setup->sm_s_pres;
1152         remote_key_request = sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres);
1153     }
1154 
1155     // check key size
1156     sm_conn->sm_actual_encryption_key_size = sm_calc_actual_encryption_key_size(sm_pairing_packet_get_max_encryption_key_size(*remote_packet));
1157     if (sm_conn->sm_actual_encryption_key_size == 0) return SM_REASON_ENCRYPTION_KEY_SIZE;
1158 
1159     // decide on STK generation method
1160     sm_setup_tk();
1161     log_info("SMP: generation method %u", setup->sm_stk_generation_method);
1162 
1163     // check if STK generation method is acceptable by client
1164     if (!sm_validate_stk_generation_method()) return SM_REASON_AUTHENTHICATION_REQUIREMENTS;
1165 
1166     // identical to responder
1167     sm_setup_key_distribution(remote_key_request);
1168 
1169     // JUST WORKS doens't provide authentication
1170     sm_conn->sm_connection_authenticated = setup->sm_stk_generation_method == JUST_WORKS ? 0 : 1;
1171 
1172     return 0;
1173 }
1174 
1175 static void sm_address_resolution_handle_event(address_resolution_event_t event){
1176 
1177     // cache and reset context
1178     int matched_device_id = sm_address_resolution_test;
1179     address_resolution_mode_t mode = sm_address_resolution_mode;
1180     void * context = sm_address_resolution_context;
1181 
1182     // reset context
1183     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
1184     sm_address_resolution_context = NULL;
1185     sm_address_resolution_test = -1;
1186     hci_con_handle_t con_handle = 0;
1187 
1188     sm_connection_t * sm_connection;
1189     uint16_t ediv;
1190     switch (mode){
1191         case ADDRESS_RESOLUTION_GENERAL:
1192             break;
1193         case ADDRESS_RESOLUTION_FOR_CONNECTION:
1194             sm_connection = (sm_connection_t *) context;
1195             con_handle = sm_connection->sm_handle;
1196             switch (event){
1197                 case ADDRESS_RESOLUTION_SUCEEDED:
1198                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_SUCCEEDED;
1199                     sm_connection->sm_le_db_index = matched_device_id;
1200                     log_info("ADDRESS_RESOLUTION_SUCEEDED, index %d", sm_connection->sm_le_db_index);
1201                     if (sm_connection->sm_role) break;
1202                     if (!sm_connection->sm_bonding_requested && !sm_connection->sm_security_request_received) break;
1203                     sm_connection->sm_security_request_received = 0;
1204                     sm_connection->sm_bonding_requested = 0;
1205                     le_device_db_encryption_get(sm_connection->sm_le_db_index, &ediv, NULL, NULL, NULL, NULL, NULL);
1206                     if (ediv){
1207                         sm_connection->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
1208                     } else {
1209                         sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1210                     }
1211                     break;
1212                 case ADDRESS_RESOLUTION_FAILED:
1213                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_FAILED;
1214                     if (sm_connection->sm_role) break;
1215                     if (!sm_connection->sm_bonding_requested && !sm_connection->sm_security_request_received) break;
1216                     sm_connection->sm_security_request_received = 0;
1217                     sm_connection->sm_bonding_requested = 0;
1218                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1219                     break;
1220             }
1221             break;
1222         default:
1223             break;
1224     }
1225 
1226     switch (event){
1227         case ADDRESS_RESOLUTION_SUCEEDED:
1228             sm_notify_client_index(SM_EVENT_IDENTITY_RESOLVING_SUCCEEDED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address, matched_device_id);
1229             break;
1230         case ADDRESS_RESOLUTION_FAILED:
1231             sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_FAILED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address);
1232             break;
1233     }
1234 }
1235 
1236 static void sm_key_distribution_handle_all_received(sm_connection_t * sm_conn){
1237 
1238     int le_db_index = -1;
1239 
1240     // lookup device based on IRK
1241     if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
1242         int i;
1243         for (i=0; i < le_device_db_count(); i++){
1244             sm_key_t irk;
1245             bd_addr_t address;
1246             int address_type;
1247             le_device_db_info(i, &address_type, address, irk);
1248             if (memcmp(irk, setup->sm_peer_irk, 16) == 0){
1249                 log_info("sm: device found for IRK, updating");
1250                 le_db_index = i;
1251                 break;
1252             }
1253         }
1254     }
1255 
1256     // if not found, lookup via public address if possible
1257     log_info("sm peer addr type %u, peer addres %s", setup->sm_peer_addr_type, bd_addr_to_str(setup->sm_peer_address));
1258     if (le_db_index < 0 && setup->sm_peer_addr_type == BD_ADDR_TYPE_LE_PUBLIC){
1259         int i;
1260         for (i=0; i < le_device_db_count(); i++){
1261             bd_addr_t address;
1262             int address_type;
1263             le_device_db_info(i, &address_type, address, NULL);
1264             log_info("device %u, sm peer addr type %u, peer addres %s", i, address_type, bd_addr_to_str(address));
1265             if (address_type == BD_ADDR_TYPE_LE_PUBLIC && memcmp(address, setup->sm_peer_address, 6) == 0){
1266                 log_info("sm: device found for public address, updating");
1267                 le_db_index = i;
1268                 break;
1269             }
1270         }
1271     }
1272 
1273     // if not found, add to db
1274     if (le_db_index < 0) {
1275         le_db_index = le_device_db_add(setup->sm_peer_addr_type, setup->sm_peer_address, setup->sm_peer_irk);
1276     }
1277 
1278     if (le_db_index >= 0){
1279         le_device_db_local_counter_set(le_db_index, 0);
1280 
1281         // store local CSRK
1282         if (setup->sm_key_distribution_send_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1283             log_info("sm: store local CSRK");
1284             le_device_db_local_csrk_set(le_db_index, setup->sm_local_csrk);
1285             le_device_db_local_counter_set(le_db_index, 0);
1286         }
1287 
1288         // store remote CSRK
1289         if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1290             log_info("sm: store remote CSRK");
1291             le_device_db_remote_csrk_set(le_db_index, setup->sm_peer_csrk);
1292             le_device_db_remote_counter_set(le_db_index, 0);
1293         }
1294 
1295         // store encryption information
1296         if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION
1297             && setup->sm_key_distribution_received_set &  SM_KEYDIST_FLAG_MASTER_IDENTIFICATION){
1298             log_info("sm: set encryption information (key size %u, authenticatd %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
1299             le_device_db_encryption_set(le_db_index, setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1300                 sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
1301         }
1302     }
1303 
1304     // keep le_db_index
1305     sm_conn->sm_le_db_index = le_db_index;
1306 }
1307 
1308 static void sm_pairing_error(sm_connection_t * sm_conn, uint8_t reason){
1309     setup->sm_pairing_failed_reason = reason;
1310     sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1311 }
1312 
1313 static inline void sm_pdu_received_in_wrong_state(sm_connection_t * sm_conn){
1314     sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
1315 }
1316 
1317 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1318 
1319 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn);
1320 static int sm_passkey_used(stk_generation_method_t method);
1321 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method);
1322 
1323 static void sm_log_ec_keypair(void){
1324     log_info("d: %s", ec_d);
1325     log_info("X: %s", ec_qx);
1326     log_info("Y: %s", ec_qy);
1327 }
1328 
1329 static void sm_sc_start_calculating_local_confirm(sm_connection_t * sm_conn){
1330     if (sm_passkey_used(setup->sm_stk_generation_method)){
1331         sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
1332     } else {
1333         sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
1334     }
1335 }
1336 
1337 static void sm_sc_state_after_receiving_random(sm_connection_t * sm_conn){
1338     if (sm_conn->sm_role){
1339         // Responder
1340         sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
1341     } else {
1342         // Initiator role
1343         switch (setup->sm_stk_generation_method){
1344             case JUST_WORKS:
1345                 sm_sc_prepare_dhkey_check(sm_conn);
1346                 break;
1347 
1348             case NK_BOTH_INPUT:
1349                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_G2;
1350                 break;
1351             case PK_INIT_INPUT:
1352             case PK_RESP_INPUT:
1353             case OK_BOTH_INPUT:
1354                 if (setup->sm_passkey_bit < 20) {
1355                     sm_sc_start_calculating_local_confirm(sm_conn);
1356                 } else {
1357                     sm_sc_prepare_dhkey_check(sm_conn);
1358                 }
1359                 break;
1360             case OOB:
1361                 // TODO: implement SC OOB
1362                 break;
1363         }
1364     }
1365 }
1366 
1367 static uint8_t sm_sc_cmac_get_byte(uint16_t offset){
1368     return sm_cmac_sc_buffer[offset];
1369 }
1370 
1371 static void sm_sc_cmac_done(uint8_t * hash){
1372     log_info("sm_sc_cmac_done: ");
1373     log_info_hexdump(hash, 16);
1374 
1375     sm_connection_t * sm_conn = sm_cmac_connection;
1376     sm_cmac_connection = NULL;
1377 
1378     switch (sm_conn->sm_engine_state){
1379         case SM_SC_W4_CMAC_FOR_CONFIRMATION:
1380             memcpy(setup->sm_local_confirm, hash, 16);
1381             sm_conn->sm_engine_state = SM_SC_SEND_CONFIRMATION;
1382             break;
1383         case SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION:
1384             // check
1385             if (0 != memcmp(hash, setup->sm_peer_confirm, 16)){
1386                 sm_pairing_error(sm_conn, SM_REASON_CONFIRM_VALUE_FAILED);
1387                 break;
1388             }
1389             sm_sc_state_after_receiving_random(sm_conn);
1390             break;
1391         case SM_SC_W4_CALCULATE_G2: {
1392             uint32_t vab = big_endian_read_32(hash, 12) % 1000000;
1393             big_endian_store_32(setup->sm_tk, 12, vab);
1394             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
1395             sm_trigger_user_response(sm_conn);
1396             break;
1397         }
1398         case SM_SC_W4_CALCULATE_F5_SALT:
1399             memcpy(setup->sm_t, hash, 16);
1400             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_MACKEY;
1401             break;
1402         case SM_SC_W4_CALCULATE_F5_MACKEY:
1403             memcpy(setup->sm_mackey, hash, 16);
1404             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_LTK;
1405             break;
1406         case SM_SC_W4_CALCULATE_F5_LTK:
1407             memcpy(setup->sm_ltk, hash, 16);
1408             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK;
1409             break;
1410         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
1411             memcpy(setup->sm_local_dhkey_check, hash, 16);
1412             if (sm_conn->sm_role){
1413                 // responder
1414                 if (setup->sm_state_vars & SM_STATE_VAR_DHKEY_COMMAND_RECEIVED){
1415                     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
1416                 } else {
1417                     sm_conn->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
1418                 }
1419             } else {
1420                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1421             }
1422             break;
1423         case SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
1424             if (0 != memcmp(hash, setup->sm_peer_dhkey_check, 16) ){
1425                 sm_pairing_error(sm_conn, SM_REASON_DHKEY_CHECK_FAILED);
1426                 break;
1427             }
1428             if (sm_conn->sm_role){
1429                 // responder
1430                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1431             } else {
1432                 // initiator
1433                 sm_conn->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
1434             }
1435             break;
1436         default:
1437             log_error("sm_sc_cmac_done in state %u", sm_conn->sm_engine_state);
1438             break;
1439     }
1440     sm_run();
1441 }
1442 
1443 static void f4_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, uint8_t z){
1444     const uint16_t message_len = 65;
1445     sm_cmac_connection = sm_conn;
1446     memcpy(sm_cmac_sc_buffer, u, 32);
1447     memcpy(sm_cmac_sc_buffer+32, v, 32);
1448     sm_cmac_sc_buffer[64] = z;
1449     log_info("f4 key");
1450     log_info_hexdump(x, 16);
1451     log_info("f4 message");
1452     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1453     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1454 }
1455 
1456 static const sm_key_t f5_salt = { 0x6C ,0x88, 0x83, 0x91, 0xAA, 0xF5, 0xA5, 0x38, 0x60, 0x37, 0x0B, 0xDB, 0x5A, 0x60, 0x83, 0xBE};
1457 static const uint8_t f5_key_id[] = { 0x62, 0x74, 0x6c, 0x65 };
1458 static const uint8_t f5_length[] = { 0x01, 0x00};
1459 
1460 static void sm_sc_calculate_dhkey(sm_key256_t dhkey){
1461 #ifdef USE_MBEDTLS_FOR_ECDH
1462     // da * Pb
1463     mbedtls_mpi d;
1464     mbedtls_ecp_point Q;
1465     mbedtls_ecp_point DH;
1466     mbedtls_mpi_init(&d);
1467     mbedtls_ecp_point_init(&Q);
1468     mbedtls_ecp_point_init(&DH);
1469     mbedtls_mpi_read_binary(&d, ec_d, 32);
1470     mbedtls_mpi_read_binary(&Q.X, setup->sm_peer_qx, 32);
1471     mbedtls_mpi_read_binary(&Q.Y, setup->sm_peer_qy, 32);
1472     mbedtls_mpi_read_string(&Q.Z, 16, "1" );
1473     mbedtls_ecp_mul(&mbedtls_ec_group, &DH, &d, &Q, NULL, NULL);
1474     mbedtls_mpi_write_binary(&DH.X, dhkey, 32);
1475     mbedtls_mpi_free(&d);
1476     mbedtls_ecp_point_free(&Q);
1477     mbedtls_ecp_point_free(&DH);
1478 #endif
1479     log_info("dhkey");
1480     log_info_hexdump(dhkey, 32);
1481 }
1482 
1483 static void f5_calculate_salt(sm_connection_t * sm_conn){
1484     // calculate DHKEY
1485     sm_key256_t dhkey;
1486     sm_sc_calculate_dhkey(dhkey);
1487 
1488     // calculate salt for f5
1489     const uint16_t message_len = 32;
1490     sm_cmac_connection = sm_conn;
1491     memcpy(sm_cmac_sc_buffer, dhkey, message_len);
1492     sm_cmac_general_start(f5_salt, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1493 }
1494 
1495 static inline void f5_mackkey(sm_connection_t * sm_conn, sm_key_t t, const sm_key_t n1, const sm_key_t n2, const sm_key56_t a1, const sm_key56_t a2){
1496     const uint16_t message_len = 53;
1497     sm_cmac_connection = sm_conn;
1498 
1499     // f5(W, N1, N2, A1, A2) = AES-CMACT (Counter = 0 || keyID || N1 || N2|| A1|| A2 || Length = 256) -- this is the MacKey
1500     sm_cmac_sc_buffer[0] = 0;
1501     memcpy(sm_cmac_sc_buffer+01, f5_key_id, 4);
1502     memcpy(sm_cmac_sc_buffer+05, n1, 16);
1503     memcpy(sm_cmac_sc_buffer+21, n2, 16);
1504     memcpy(sm_cmac_sc_buffer+37, a1, 7);
1505     memcpy(sm_cmac_sc_buffer+44, a2, 7);
1506     memcpy(sm_cmac_sc_buffer+51, f5_length, 2);
1507     log_info("f5 key");
1508     log_info_hexdump(t, 16);
1509     log_info("f5 message for MacKey");
1510     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1511     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1512 }
1513 
1514 static void f5_calculate_mackey(sm_connection_t * sm_conn){
1515     sm_key56_t bd_addr_master, bd_addr_slave;
1516     bd_addr_master[0] =  setup->sm_m_addr_type;
1517     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1518     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1519     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1520     if (sm_conn->sm_role){
1521         // responder
1522         f5_mackkey(sm_conn, setup->sm_t, setup->sm_peer_nonce, setup->sm_local_nonce, bd_addr_master, bd_addr_slave);
1523     } else {
1524         // initiator
1525         f5_mackkey(sm_conn, setup->sm_t, setup->sm_local_nonce, setup->sm_peer_nonce, bd_addr_master, bd_addr_slave);
1526     }
1527 }
1528 
1529 // note: must be called right after f5_mackey, as sm_cmac_buffer[1..52] will be reused
1530 static inline void f5_ltk(sm_connection_t * sm_conn, sm_key_t t){
1531     const uint16_t message_len = 53;
1532     sm_cmac_connection = sm_conn;
1533     sm_cmac_sc_buffer[0] = 1;
1534     // 1..52 setup before
1535     log_info("f5 key");
1536     log_info_hexdump(t, 16);
1537     log_info("f5 message for LTK");
1538     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1539     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1540 }
1541 
1542 static void f5_calculate_ltk(sm_connection_t * sm_conn){
1543     f5_ltk(sm_conn, setup->sm_t);
1544 }
1545 
1546 static void f6_engine(sm_connection_t * sm_conn, const sm_key_t w, const sm_key_t n1, const sm_key_t n2, const sm_key_t r, const sm_key24_t io_cap, const sm_key56_t a1, const sm_key56_t a2){
1547     const uint16_t message_len = 65;
1548     sm_cmac_connection = sm_conn;
1549     memcpy(sm_cmac_sc_buffer, n1, 16);
1550     memcpy(sm_cmac_sc_buffer+16, n2, 16);
1551     memcpy(sm_cmac_sc_buffer+32, r, 16);
1552     memcpy(sm_cmac_sc_buffer+48, io_cap, 3);
1553     memcpy(sm_cmac_sc_buffer+51, a1, 7);
1554     memcpy(sm_cmac_sc_buffer+58, a2, 7);
1555     log_info("f6 key");
1556     log_info_hexdump(w, 16);
1557     log_info("f6 message");
1558     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1559     sm_cmac_general_start(w, 65, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1560 }
1561 
1562 // g2(U, V, X, Y) = AES-CMACX(U || V || Y) mod 2^32
1563 // - U is 256 bits
1564 // - V is 256 bits
1565 // - X is 128 bits
1566 // - Y is 128 bits
1567 static void g2_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, const sm_key_t y){
1568     const uint16_t message_len = 80;
1569     sm_cmac_connection = sm_conn;
1570     memcpy(sm_cmac_sc_buffer, u, 32);
1571     memcpy(sm_cmac_sc_buffer+32, v, 32);
1572     memcpy(sm_cmac_sc_buffer+64, y, 16);
1573     log_info("g2 key");
1574     log_info_hexdump(x, 16);
1575     log_info("g2 message");
1576     log_info_hexdump(sm_cmac_sc_buffer, sizeof(sm_cmac_sc_buffer));
1577     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1578 }
1579 
1580 static void g2_calculate(sm_connection_t * sm_conn) {
1581     // calc Va if numeric comparison
1582     if (sm_conn->sm_role){
1583         // responder
1584         g2_engine(sm_conn, setup->sm_peer_qx, ec_qx, setup->sm_peer_nonce, setup->sm_local_nonce);;
1585     } else {
1586         // initiator
1587         g2_engine(sm_conn, ec_qx, setup->sm_peer_qx, setup->sm_local_nonce, setup->sm_peer_nonce);
1588     }
1589 }
1590 
1591 static void sm_sc_calculate_local_confirm(sm_connection_t * sm_conn){
1592     uint8_t z = 0;
1593     if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT){
1594         // some form of passkey
1595         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1596         z = 0x80 | ((pk >> setup->sm_passkey_bit) & 1);
1597         setup->sm_passkey_bit++;
1598     }
1599     f4_engine(sm_conn, ec_qx, setup->sm_peer_qx, setup->sm_local_nonce, z);
1600 }
1601 
1602 static void sm_sc_calculate_remote_confirm(sm_connection_t * sm_conn){
1603     uint8_t z = 0;
1604     if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT){
1605         // some form of passkey
1606         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1607         // sm_passkey_bit was increased before sending confirm value
1608         z = 0x80 | ((pk >> (setup->sm_passkey_bit-1)) & 1);
1609     }
1610     f4_engine(sm_conn, setup->sm_peer_qx, ec_qx, setup->sm_peer_nonce, z);
1611 }
1612 
1613 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn){
1614     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_SALT;
1615 }
1616 
1617 static void sm_sc_calculate_f6_for_dhkey_check(sm_connection_t * sm_conn){
1618     // calculate DHKCheck
1619     sm_key56_t bd_addr_master, bd_addr_slave;
1620     bd_addr_master[0] =  setup->sm_m_addr_type;
1621     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1622     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1623     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1624     uint8_t iocap_a[3];
1625     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1626     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1627     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1628     uint8_t iocap_b[3];
1629     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1630     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1631     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1632     if (sm_conn->sm_role){
1633         // responder
1634         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1635     } else {
1636         // initiator
1637         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1638     }
1639 }
1640 
1641 static void sm_sc_calculate_f6_to_verify_dhkey_check(sm_connection_t * sm_conn){
1642     // validate E = f6()
1643     sm_key56_t bd_addr_master, bd_addr_slave;
1644     bd_addr_master[0] =  setup->sm_m_addr_type;
1645     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1646     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1647     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1648 
1649     uint8_t iocap_a[3];
1650     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1651     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1652     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1653     uint8_t iocap_b[3];
1654     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1655     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1656     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1657     if (sm_conn->sm_role){
1658         // responder
1659         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1660     } else {
1661         // initiator
1662         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1663     }
1664 }
1665 #endif
1666 
1667 static void sm_load_security_info(sm_connection_t * sm_connection){
1668     int encryption_key_size;
1669     int authenticated;
1670     int authorized;
1671 
1672     // fetch data from device db - incl. authenticated/authorized/key size. Note all sm_connection_X require encryption enabled
1673     le_device_db_encryption_get(sm_connection->sm_le_db_index, &setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1674                                 &encryption_key_size, &authenticated, &authorized);
1675     log_info("db index %u, key size %u, authenticated %u, authorized %u", sm_connection->sm_le_db_index, encryption_key_size, authenticated, authorized);
1676     sm_connection->sm_actual_encryption_key_size = encryption_key_size;
1677     sm_connection->sm_connection_authenticated = authenticated;
1678     sm_connection->sm_connection_authorization_state = authorized ? AUTHORIZATION_GRANTED : AUTHORIZATION_UNKNOWN;
1679 }
1680 
1681 static void sm_run(void){
1682 
1683     btstack_linked_list_iterator_t it;
1684 
1685     // assert that we can send at least commands
1686     if (!hci_can_send_command_packet_now()) return;
1687 
1688     //
1689     // non-connection related behaviour
1690     //
1691 
1692     // distributed key generation
1693     switch (dkg_state){
1694         case DKG_CALC_IRK:
1695             // already busy?
1696             if (sm_aes128_state == SM_AES128_IDLE) {
1697                 // IRK = d1(IR, 1, 0)
1698                 sm_key_t d1_prime;
1699                 sm_d1_d_prime(1, 0, d1_prime);  // plaintext
1700                 dkg_next_state();
1701                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
1702                 return;
1703             }
1704             break;
1705         case DKG_CALC_DHK:
1706             // already busy?
1707             if (sm_aes128_state == SM_AES128_IDLE) {
1708                 // DHK = d1(IR, 3, 0)
1709                 sm_key_t d1_prime;
1710                 sm_d1_d_prime(3, 0, d1_prime);  // plaintext
1711                 dkg_next_state();
1712                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
1713                 return;
1714             }
1715             break;
1716         default:
1717             break;
1718     }
1719 
1720 #ifdef USE_MBEDTLS_FOR_ECDH
1721     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
1722         sm_random_start(NULL);
1723         return;
1724     }
1725 #endif
1726 
1727     // random address updates
1728     switch (rau_state){
1729         case RAU_GET_RANDOM:
1730             rau_next_state();
1731             sm_random_start(NULL);
1732             return;
1733         case RAU_GET_ENC:
1734             // already busy?
1735             if (sm_aes128_state == SM_AES128_IDLE) {
1736                 sm_key_t r_prime;
1737                 sm_ah_r_prime(sm_random_address, r_prime);
1738                 rau_next_state();
1739                 sm_aes128_start(sm_persistent_irk, r_prime, NULL);
1740                 return;
1741             }
1742             break;
1743         case RAU_SET_ADDRESS:
1744             log_info("New random address: %s", bd_addr_to_str(sm_random_address));
1745             rau_state = RAU_IDLE;
1746             hci_send_cmd(&hci_le_set_random_address, sm_random_address);
1747             return;
1748         default:
1749             break;
1750     }
1751 
1752     // CMAC
1753     switch (sm_cmac_state){
1754         case CMAC_CALC_SUBKEYS:
1755         case CMAC_CALC_MI:
1756         case CMAC_CALC_MLAST:
1757             // already busy?
1758             if (sm_aes128_state == SM_AES128_ACTIVE) break;
1759             sm_cmac_handle_aes_engine_ready();
1760             return;
1761         default:
1762             break;
1763     }
1764 
1765     // CSRK Lookup
1766     // -- if csrk lookup ready, find connection that require csrk lookup
1767     if (sm_address_resolution_idle()){
1768         hci_connections_get_iterator(&it);
1769         while(btstack_linked_list_iterator_has_next(&it)){
1770             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1771             sm_connection_t  * sm_connection  = &hci_connection->sm_connection;
1772             if (sm_connection->sm_irk_lookup_state == IRK_LOOKUP_W4_READY){
1773                 // and start lookup
1774                 sm_address_resolution_start_lookup(sm_connection->sm_peer_addr_type, sm_connection->sm_handle, sm_connection->sm_peer_address, ADDRESS_RESOLUTION_FOR_CONNECTION, sm_connection);
1775                 sm_connection->sm_irk_lookup_state = IRK_LOOKUP_STARTED;
1776                 break;
1777             }
1778         }
1779     }
1780 
1781     // -- if csrk lookup ready, resolved addresses for received addresses
1782     if (sm_address_resolution_idle()) {
1783         if (!btstack_linked_list_empty(&sm_address_resolution_general_queue)){
1784             sm_lookup_entry_t * entry = (sm_lookup_entry_t *) sm_address_resolution_general_queue;
1785             btstack_linked_list_remove(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
1786             sm_address_resolution_start_lookup(entry->address_type, 0, entry->address, ADDRESS_RESOLUTION_GENERAL, NULL);
1787             btstack_memory_sm_lookup_entry_free(entry);
1788         }
1789     }
1790 
1791     // -- Continue with CSRK device lookup by public or resolvable private address
1792     if (!sm_address_resolution_idle()){
1793         log_info("LE Device Lookup: device %u/%u", sm_address_resolution_test, le_device_db_count());
1794         while (sm_address_resolution_test < le_device_db_count()){
1795             int addr_type;
1796             bd_addr_t addr;
1797             sm_key_t irk;
1798             le_device_db_info(sm_address_resolution_test, &addr_type, addr, irk);
1799             log_info("device type %u, addr: %s", addr_type, bd_addr_to_str(addr));
1800 
1801             if (sm_address_resolution_addr_type == addr_type && memcmp(addr, sm_address_resolution_address, 6) == 0){
1802                 log_info("LE Device Lookup: found CSRK by { addr_type, address} ");
1803                 sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
1804                 break;
1805             }
1806 
1807             if (sm_address_resolution_addr_type == 0){
1808                 sm_address_resolution_test++;
1809                 continue;
1810             }
1811 
1812             if (sm_aes128_state == SM_AES128_ACTIVE) break;
1813 
1814             log_info("LE Device Lookup: calculate AH");
1815             log_info_key("IRK", irk);
1816 
1817             sm_key_t r_prime;
1818             sm_ah_r_prime(sm_address_resolution_address, r_prime);
1819             sm_address_resolution_ah_calculation_active = 1;
1820             sm_aes128_start(irk, r_prime, sm_address_resolution_context);   // keep context
1821             return;
1822         }
1823 
1824         if (sm_address_resolution_test >= le_device_db_count()){
1825             log_info("LE Device Lookup: not found");
1826             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_FAILED);
1827         }
1828     }
1829 
1830 
1831     //
1832     // active connection handling
1833     // -- use loop to handle next connection if lock on setup context is released
1834 
1835     while (1) {
1836 
1837         // Find connections that requires setup context and make active if no other is locked
1838         hci_connections_get_iterator(&it);
1839         while(!sm_active_connection && btstack_linked_list_iterator_has_next(&it)){
1840             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1841             sm_connection_t  * sm_connection = &hci_connection->sm_connection;
1842             // - if no connection locked and we're ready/waiting for setup context, fetch it and start
1843             int done = 1;
1844             int err;
1845             switch (sm_connection->sm_engine_state) {
1846                 case SM_RESPONDER_SEND_SECURITY_REQUEST:
1847                     // send packet if possible,
1848                     if (l2cap_can_send_fixed_channel_packet_now(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)){
1849                         const uint8_t buffer[2] = { SM_CODE_SECURITY_REQUEST, SM_AUTHREQ_BONDING};
1850                         sm_connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_REQUEST;
1851                         l2cap_send_connectionless(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
1852                     } else {
1853                         l2cap_request_can_send_fix_channel_now_event(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
1854                     }
1855                     // don't lock sxetup context yet
1856                     done = 0;
1857                     break;
1858                 case SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED:
1859                     sm_init_setup(sm_connection);
1860                     // recover pairing request
1861                     memcpy(&setup->sm_m_preq, &sm_connection->sm_m_preq, sizeof(sm_pairing_packet_t));
1862                     err = sm_stk_generation_init(sm_connection);
1863                     if (err){
1864                         setup->sm_pairing_failed_reason = err;
1865                         sm_connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1866                         break;
1867                     }
1868                     sm_timeout_start(sm_connection);
1869                     // generate random number first, if we need to show passkey
1870                     if (setup->sm_stk_generation_method == PK_INIT_INPUT){
1871                         sm_connection->sm_engine_state = SM_PH2_GET_RANDOM_TK;
1872                         break;
1873                     }
1874                     sm_connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
1875                     break;
1876                 case SM_INITIATOR_PH0_HAS_LTK:
1877                     sm_load_security_info(sm_connection);
1878                     sm_connection->sm_engine_state = SM_INITIATOR_PH0_SEND_START_ENCRYPTION;
1879                     break;
1880                 case SM_RESPONDER_PH0_RECEIVED_LTK:
1881                     switch (sm_connection->sm_irk_lookup_state){
1882                         case IRK_LOOKUP_SUCCEEDED:{
1883                                 sm_load_security_info(sm_connection);
1884                                 sm_connection->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
1885                                 break;
1886                             }
1887                         case IRK_LOOKUP_FAILED:
1888                             // assume that we don't have a LTK for ediv == 0 and random == null
1889                             if (sm_connection->sm_local_ediv == 0 && sm_is_null_random(sm_connection->sm_local_rand)){
1890                                 log_info("LTK Request: ediv & random are empty");
1891                                 sm_connection->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
1892                                 // TODO: no need to lock context yet -> done = 0;
1893                                 break;
1894                             }
1895                             // re-establish previously used LTK using Rand and EDIV
1896                             memcpy(setup->sm_local_rand, sm_connection->sm_local_rand, 8);
1897                             setup->sm_local_ediv = sm_connection->sm_local_ediv;
1898                             // re-establish used key encryption size
1899                             // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
1900                             sm_connection->sm_actual_encryption_key_size = (setup->sm_local_rand[7] & 0x0f) + 1;
1901                             // no db for authenticated flag hack: flag is stored in bit 4 of LSB
1902                             sm_connection->sm_connection_authenticated = (setup->sm_local_rand[7] & 0x10) >> 4;
1903                             log_info("sm: received ltk request with key size %u, authenticated %u",
1904                                     sm_connection->sm_actual_encryption_key_size, sm_connection->sm_connection_authenticated);
1905                             sm_connection->sm_engine_state = SM_RESPONDER_PH4_Y_GET_ENC;
1906                             break;
1907                         default:
1908                             // just wait until IRK lookup is completed
1909                             // don't lock sxetup context yet
1910                             done = 0;
1911                             break;
1912                     }
1913                     break;
1914                 case SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST:
1915                     sm_init_setup(sm_connection);
1916                     sm_timeout_start(sm_connection);
1917                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_SEND_PAIRING_REQUEST;
1918                     break;
1919                 default:
1920                     done = 0;
1921                     break;
1922             }
1923             if (done){
1924                 sm_active_connection = sm_connection->sm_handle;
1925                 log_info("sm: connection 0x%04x locked setup context as %s", sm_active_connection, sm_connection->sm_role ? "responder" : "initiator");
1926             }
1927         }
1928 
1929         //
1930         // active connection handling
1931         //
1932 
1933         if (sm_active_connection == 0) return;
1934 
1935         // assert that we could send a SM PDU - not needed for all of the following
1936         if (!l2cap_can_send_fixed_channel_packet_now(sm_active_connection, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)) {
1937             l2cap_request_can_send_fix_channel_now_event(sm_active_connection, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
1938             return;
1939         }
1940 
1941         sm_connection_t * connection = sm_get_connection_for_handle(sm_active_connection);
1942         if (!connection) return;
1943 
1944         sm_key_t plaintext;
1945         int key_distribution_flags;
1946 
1947         log_info("sm_run: state %u", connection->sm_engine_state);
1948 
1949         // responding state
1950         switch (connection->sm_engine_state){
1951 
1952             // general
1953             case SM_GENERAL_SEND_PAIRING_FAILED: {
1954                 uint8_t buffer[2];
1955                 buffer[0] = SM_CODE_PAIRING_FAILED;
1956                 buffer[1] = setup->sm_pairing_failed_reason;
1957                 connection->sm_engine_state = connection->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
1958                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
1959                 sm_done_for_handle(connection->sm_handle);
1960                 break;
1961             }
1962 
1963 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1964             case SM_SC_W2_GET_RANDOM_A:
1965                 sm_random_start(connection);
1966                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_A;
1967                 break;
1968             case SM_SC_W2_GET_RANDOM_B:
1969                 sm_random_start(connection);
1970                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_B;
1971                 break;
1972             case SM_SC_W2_CMAC_FOR_CONFIRMATION:
1973                 if (!sm_cmac_ready()) break;
1974                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CONFIRMATION;
1975                 sm_sc_calculate_local_confirm(connection);
1976                 break;
1977             case SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION:
1978                 if (!sm_cmac_ready()) break;
1979                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION;
1980                 sm_sc_calculate_remote_confirm(connection);
1981                 break;
1982             case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
1983                 if (!sm_cmac_ready()) break;
1984                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK;
1985                 sm_sc_calculate_f6_for_dhkey_check(connection);
1986                 break;
1987             case SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
1988                 if (!sm_cmac_ready()) break;
1989                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
1990                 sm_sc_calculate_f6_to_verify_dhkey_check(connection);
1991                 break;
1992             case SM_SC_W2_CALCULATE_F5_SALT:
1993                 if (!sm_cmac_ready()) break;
1994                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_SALT;
1995                 f5_calculate_salt(connection);
1996                 break;
1997             case SM_SC_W2_CALCULATE_F5_MACKEY:
1998                 if (!sm_cmac_ready()) break;
1999                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_MACKEY;
2000                 f5_calculate_mackey(connection);
2001                 break;
2002             case SM_SC_W2_CALCULATE_F5_LTK:
2003                 if (!sm_cmac_ready()) break;
2004                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_LTK;
2005                 f5_calculate_ltk(connection);
2006                 break;
2007             case SM_SC_W2_CALCULATE_G2:
2008                 if (!sm_cmac_ready()) break;
2009                 connection->sm_engine_state = SM_SC_W4_CALCULATE_G2;
2010                 g2_calculate(connection);
2011                 break;
2012 
2013 #endif
2014             // initiator side
2015             case SM_INITIATOR_PH0_SEND_START_ENCRYPTION: {
2016                 sm_key_t peer_ltk_flipped;
2017                 reverse_128(setup->sm_peer_ltk, peer_ltk_flipped);
2018                 connection->sm_engine_state = SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED;
2019                 log_info("sm: hci_le_start_encryption ediv 0x%04x", setup->sm_peer_ediv);
2020                 uint32_t rand_high = big_endian_read_32(setup->sm_peer_rand, 0);
2021                 uint32_t rand_low  = big_endian_read_32(setup->sm_peer_rand, 4);
2022                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle,rand_low, rand_high, setup->sm_peer_ediv, peer_ltk_flipped);
2023                 return;
2024             }
2025 
2026             case SM_INITIATOR_PH1_SEND_PAIRING_REQUEST:
2027                 sm_pairing_packet_set_code(setup->sm_m_preq, SM_CODE_PAIRING_REQUEST);
2028                 connection->sm_engine_state = SM_INITIATOR_PH1_W4_PAIRING_RESPONSE;
2029                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_m_preq, sizeof(sm_pairing_packet_t));
2030                 sm_timeout_reset(connection);
2031                 break;
2032 
2033             // responder side
2034             case SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY:
2035                 connection->sm_engine_state = SM_RESPONDER_IDLE;
2036                 hci_send_cmd(&hci_le_long_term_key_negative_reply, connection->sm_handle);
2037                 sm_done_for_handle(connection->sm_handle);
2038                 return;
2039 
2040 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2041             case SM_SC_SEND_PUBLIC_KEY_COMMAND: {
2042                 uint8_t buffer[65];
2043                 buffer[0] = SM_CODE_PAIRING_PUBLIC_KEY;
2044                 //
2045                 reverse_256(ec_qx, &buffer[1]);
2046                 reverse_256(ec_qy, &buffer[33]);
2047 
2048                 // stk generation method
2049                 // passkey entry: notify app to show passkey or to request passkey
2050                 switch (setup->sm_stk_generation_method){
2051                     case JUST_WORKS:
2052                     case NK_BOTH_INPUT:
2053                         if (connection->sm_role){
2054                             // responder
2055                             sm_sc_start_calculating_local_confirm(connection);
2056                         } else {
2057                             // initiator
2058                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2059                         }
2060                         break;
2061                     case PK_INIT_INPUT:
2062                     case PK_RESP_INPUT:
2063                     case OK_BOTH_INPUT:
2064                         // use random TK for display
2065                         memcpy(setup->sm_ra, setup->sm_tk, 16);
2066                         memcpy(setup->sm_rb, setup->sm_tk, 16);
2067                         setup->sm_passkey_bit = 0;
2068 
2069                         if (connection->sm_role){
2070                             // responder
2071                             connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2072                         } else {
2073                             // initiator
2074                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2075                         }
2076                         sm_trigger_user_response(connection);
2077                         break;
2078                     case OOB:
2079                         // TODO: implement SC OOB
2080                         break;
2081                 }
2082 
2083                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2084                 sm_timeout_reset(connection);
2085                 break;
2086             }
2087             case SM_SC_SEND_CONFIRMATION: {
2088                 uint8_t buffer[17];
2089                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2090                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2091                 if (connection->sm_role){
2092                     connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2093                 } else {
2094                     connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2095                 }
2096                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2097                 sm_timeout_reset(connection);
2098                 break;
2099             }
2100             case SM_SC_SEND_PAIRING_RANDOM: {
2101                 uint8_t buffer[17];
2102                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2103                 reverse_128(setup->sm_local_nonce, &buffer[1]);
2104                 if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT && setup->sm_passkey_bit < 20){
2105                     if (connection->sm_role){
2106                         // responder
2107                         connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2108                     } else {
2109                         // initiator
2110                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2111                     }
2112                 } else {
2113                     if (connection->sm_role){
2114                         // responder
2115                         if (setup->sm_stk_generation_method == NK_BOTH_INPUT){
2116                             connection->sm_engine_state = SM_SC_W2_CALCULATE_G2;
2117                         } else {
2118                             sm_sc_prepare_dhkey_check(connection);
2119                         }
2120                     } else {
2121                         // initiator
2122                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2123                     }
2124                 }
2125                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2126                 sm_timeout_reset(connection);
2127                 break;
2128             }
2129             case SM_SC_SEND_DHKEY_CHECK_COMMAND: {
2130                 uint8_t buffer[17];
2131                 buffer[0] = SM_CODE_PAIRING_DHKEY_CHECK;
2132                 reverse_128(setup->sm_local_dhkey_check, &buffer[1]);
2133 
2134                 if (connection->sm_role){
2135                     connection->sm_engine_state = SM_SC_W4_LTK_REQUEST_SC;
2136                 } else {
2137                     connection->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
2138                 }
2139 
2140                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2141                 sm_timeout_reset(connection);
2142                 break;
2143             }
2144 
2145 #endif
2146             case SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE:
2147                 // echo initiator for now
2148                 sm_pairing_packet_set_code(setup->sm_s_pres,SM_CODE_PAIRING_RESPONSE);
2149                 key_distribution_flags = sm_key_distribution_flags_for_auth_req();
2150 
2151                 connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_CONFIRM;
2152 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2153                 if (setup->sm_use_secure_connections){
2154                     connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2155                     // skip LTK/EDIV for SC
2156                     log_info("sm: dropping encryption information flag");
2157                     key_distribution_flags &= ~SM_KEYDIST_ENC_KEY;
2158                 }
2159 #endif
2160                 sm_pairing_packet_set_initiator_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_initiator_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2161                 sm_pairing_packet_set_responder_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2162                 // update key distribution after ENC was dropped
2163                 sm_setup_key_distribution(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
2164 
2165                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_s_pres, sizeof(sm_pairing_packet_t));
2166                 sm_timeout_reset(connection);
2167                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
2168                 if (setup->sm_stk_generation_method == JUST_WORKS){
2169                     sm_trigger_user_response(connection);
2170                 }
2171                 return;
2172 
2173             case SM_PH2_SEND_PAIRING_RANDOM: {
2174                 uint8_t buffer[17];
2175                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2176                 reverse_128(setup->sm_local_random, &buffer[1]);
2177                 if (connection->sm_role){
2178                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_LTK_REQUEST;
2179                 } else {
2180                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_RANDOM;
2181                 }
2182                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2183                 sm_timeout_reset(connection);
2184                 break;
2185             }
2186 
2187             case SM_PH2_GET_RANDOM_TK:
2188             case SM_PH2_C1_GET_RANDOM_A:
2189             case SM_PH2_C1_GET_RANDOM_B:
2190             case SM_PH3_GET_RANDOM:
2191             case SM_PH3_GET_DIV:
2192                 sm_next_responding_state(connection);
2193                 sm_random_start(connection);
2194                 return;
2195 
2196             case SM_PH2_C1_GET_ENC_B:
2197             case SM_PH2_C1_GET_ENC_D:
2198                 // already busy?
2199                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2200                 sm_next_responding_state(connection);
2201                 sm_aes128_start(setup->sm_tk, setup->sm_c1_t3_value, connection);
2202                 return;
2203 
2204             case SM_PH3_LTK_GET_ENC:
2205             case SM_RESPONDER_PH4_LTK_GET_ENC:
2206                 // already busy?
2207                 if (sm_aes128_state == SM_AES128_IDLE) {
2208                     sm_key_t d_prime;
2209                     sm_d1_d_prime(setup->sm_local_div, 0, d_prime);
2210                     sm_next_responding_state(connection);
2211                     sm_aes128_start(sm_persistent_er, d_prime, connection);
2212                     return;
2213                 }
2214                 break;
2215 
2216             case SM_PH3_CSRK_GET_ENC:
2217                 // already busy?
2218                 if (sm_aes128_state == SM_AES128_IDLE) {
2219                     sm_key_t d_prime;
2220                     sm_d1_d_prime(setup->sm_local_div, 1, d_prime);
2221                     sm_next_responding_state(connection);
2222                     sm_aes128_start(sm_persistent_er, d_prime, connection);
2223                     return;
2224                 }
2225                 break;
2226 
2227             case SM_PH2_C1_GET_ENC_C:
2228                 // already busy?
2229                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2230                 // calculate m_confirm using aes128 engine - step 1
2231                 sm_c1_t1(setup->sm_peer_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
2232                 sm_next_responding_state(connection);
2233                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2234                 break;
2235             case SM_PH2_C1_GET_ENC_A:
2236                 // already busy?
2237                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2238                 // calculate confirm using aes128 engine - step 1
2239                 sm_c1_t1(setup->sm_local_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
2240                 sm_next_responding_state(connection);
2241                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2242                 break;
2243             case SM_PH2_CALC_STK:
2244                 // already busy?
2245                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2246                 // calculate STK
2247                 if (connection->sm_role){
2248                     sm_s1_r_prime(setup->sm_local_random, setup->sm_peer_random, plaintext);
2249                 } else {
2250                     sm_s1_r_prime(setup->sm_peer_random, setup->sm_local_random, plaintext);
2251                 }
2252                 sm_next_responding_state(connection);
2253                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2254                 break;
2255             case SM_PH3_Y_GET_ENC:
2256                 // already busy?
2257                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2258                 // PH3B2 - calculate Y from      - enc
2259                 // Y = dm(DHK, Rand)
2260                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
2261                 sm_next_responding_state(connection);
2262                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
2263                 return;
2264             case SM_PH2_C1_SEND_PAIRING_CONFIRM: {
2265                 uint8_t buffer[17];
2266                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2267                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2268                 if (connection->sm_role){
2269                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_PAIRING_RANDOM;
2270                 } else {
2271                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_CONFIRM;
2272                 }
2273                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2274                 sm_timeout_reset(connection);
2275                 return;
2276             }
2277             case SM_RESPONDER_PH2_SEND_LTK_REPLY: {
2278                 sm_key_t stk_flipped;
2279                 reverse_128(setup->sm_ltk, stk_flipped);
2280                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2281                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, stk_flipped);
2282                 return;
2283             }
2284             case SM_INITIATOR_PH3_SEND_START_ENCRYPTION: {
2285                 sm_key_t stk_flipped;
2286                 reverse_128(setup->sm_ltk, stk_flipped);
2287                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2288                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle, 0, 0, 0, stk_flipped);
2289                 return;
2290             }
2291             case SM_RESPONDER_PH4_SEND_LTK: {
2292                 sm_key_t ltk_flipped;
2293                 reverse_128(setup->sm_ltk, ltk_flipped);
2294                 connection->sm_engine_state = SM_RESPONDER_IDLE;
2295                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, ltk_flipped);
2296                 return;
2297             }
2298             case SM_RESPONDER_PH4_Y_GET_ENC:
2299                 // already busy?
2300                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2301                 log_info("LTK Request: recalculating with ediv 0x%04x", setup->sm_local_ediv);
2302                 // Y = dm(DHK, Rand)
2303                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
2304                 sm_next_responding_state(connection);
2305                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
2306                 return;
2307 
2308             case SM_PH3_DISTRIBUTE_KEYS:
2309                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION){
2310                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
2311                     uint8_t buffer[17];
2312                     buffer[0] = SM_CODE_ENCRYPTION_INFORMATION;
2313                     reverse_128(setup->sm_ltk, &buffer[1]);
2314                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2315                     sm_timeout_reset(connection);
2316                     return;
2317                 }
2318                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_MASTER_IDENTIFICATION){
2319                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
2320                     uint8_t buffer[11];
2321                     buffer[0] = SM_CODE_MASTER_IDENTIFICATION;
2322                     little_endian_store_16(buffer, 1, setup->sm_local_ediv);
2323                     reverse_64(setup->sm_local_rand, &buffer[3]);
2324                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2325                     sm_timeout_reset(connection);
2326                     return;
2327                 }
2328                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
2329                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
2330                     uint8_t buffer[17];
2331                     buffer[0] = SM_CODE_IDENTITY_INFORMATION;
2332                     reverse_128(sm_persistent_irk, &buffer[1]);
2333                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2334                     sm_timeout_reset(connection);
2335                     return;
2336                 }
2337                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION){
2338                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
2339                     bd_addr_t local_address;
2340                     uint8_t buffer[8];
2341                     buffer[0] = SM_CODE_IDENTITY_ADDRESS_INFORMATION;
2342                     gap_advertisements_get_address(&buffer[1], local_address);
2343                     reverse_bd_addr(local_address, &buffer[2]);
2344                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2345                     sm_timeout_reset(connection);
2346                     return;
2347                 }
2348                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
2349                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
2350 
2351                     // hack to reproduce test runs
2352                     if (test_use_fixed_local_csrk){
2353                         memset(setup->sm_local_csrk, 0xcc, 16);
2354                     }
2355 
2356                     uint8_t buffer[17];
2357                     buffer[0] = SM_CODE_SIGNING_INFORMATION;
2358                     reverse_128(setup->sm_local_csrk, &buffer[1]);
2359                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2360                     sm_timeout_reset(connection);
2361                     return;
2362                 }
2363 
2364                 // keys are sent
2365                 if (connection->sm_role){
2366                     // slave -> receive master keys if any
2367                     if (sm_key_distribution_all_received(connection)){
2368                         sm_key_distribution_handle_all_received(connection);
2369                         connection->sm_engine_state = SM_RESPONDER_IDLE;
2370                         sm_done_for_handle(connection->sm_handle);
2371                     } else {
2372                         connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2373                     }
2374                 } else {
2375                     // master -> all done
2376                     connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2377                     sm_done_for_handle(connection->sm_handle);
2378                 }
2379                 break;
2380 
2381             default:
2382                 break;
2383         }
2384 
2385         // check again if active connection was released
2386         if (sm_active_connection) break;
2387     }
2388 }
2389 
2390 // note: aes engine is ready as we just got the aes result
2391 static void sm_handle_encryption_result(uint8_t * data){
2392 
2393     sm_aes128_state = SM_AES128_IDLE;
2394 
2395     if (sm_address_resolution_ah_calculation_active){
2396         sm_address_resolution_ah_calculation_active = 0;
2397         // compare calulated address against connecting device
2398         uint8_t hash[3];
2399         reverse_24(data, hash);
2400         if (memcmp(&sm_address_resolution_address[3], hash, 3) == 0){
2401             log_info("LE Device Lookup: matched resolvable private address");
2402             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
2403             return;
2404         }
2405         // no match, try next
2406         sm_address_resolution_test++;
2407         return;
2408     }
2409 
2410     switch (dkg_state){
2411         case DKG_W4_IRK:
2412             reverse_128(data, sm_persistent_irk);
2413             log_info_key("irk", sm_persistent_irk);
2414             dkg_next_state();
2415             return;
2416         case DKG_W4_DHK:
2417             reverse_128(data, sm_persistent_dhk);
2418             log_info_key("dhk", sm_persistent_dhk);
2419             dkg_next_state();
2420             // SM Init Finished
2421             return;
2422         default:
2423             break;
2424     }
2425 
2426     switch (rau_state){
2427         case RAU_W4_ENC:
2428             reverse_24(data, &sm_random_address[3]);
2429             rau_next_state();
2430             return;
2431         default:
2432             break;
2433     }
2434 
2435     switch (sm_cmac_state){
2436         case CMAC_W4_SUBKEYS:
2437         case CMAC_W4_MI:
2438         case CMAC_W4_MLAST:
2439             {
2440             sm_key_t t;
2441             reverse_128(data, t);
2442             sm_cmac_handle_encryption_result(t);
2443             }
2444             return;
2445         default:
2446             break;
2447     }
2448 
2449     // retrieve sm_connection provided to sm_aes128_start_encryption
2450     sm_connection_t * connection = (sm_connection_t*) sm_aes128_context;
2451     if (!connection) return;
2452     switch (connection->sm_engine_state){
2453         case SM_PH2_C1_W4_ENC_A:
2454         case SM_PH2_C1_W4_ENC_C:
2455             {
2456             sm_key_t t2;
2457             reverse_128(data, t2);
2458             sm_c1_t3(t2, setup->sm_m_address, setup->sm_s_address, setup->sm_c1_t3_value);
2459             }
2460             sm_next_responding_state(connection);
2461             return;
2462         case SM_PH2_C1_W4_ENC_B:
2463             reverse_128(data, setup->sm_local_confirm);
2464             log_info_key("c1!", setup->sm_local_confirm);
2465             connection->sm_engine_state = SM_PH2_C1_SEND_PAIRING_CONFIRM;
2466             return;
2467         case SM_PH2_C1_W4_ENC_D:
2468             {
2469             sm_key_t peer_confirm_test;
2470             reverse_128(data, peer_confirm_test);
2471             log_info_key("c1!", peer_confirm_test);
2472             if (memcmp(setup->sm_peer_confirm, peer_confirm_test, 16) != 0){
2473                 setup->sm_pairing_failed_reason = SM_REASON_CONFIRM_VALUE_FAILED;
2474                 connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
2475                 return;
2476             }
2477             if (connection->sm_role){
2478                 connection->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
2479             } else {
2480                 connection->sm_engine_state = SM_PH2_CALC_STK;
2481             }
2482             }
2483             return;
2484         case SM_PH2_W4_STK:
2485             reverse_128(data, setup->sm_ltk);
2486             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2487             log_info_key("stk", setup->sm_ltk);
2488             if (connection->sm_role){
2489                 connection->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2490             } else {
2491                 connection->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
2492             }
2493             return;
2494         case SM_PH3_Y_W4_ENC:{
2495             sm_key_t y128;
2496             reverse_128(data, y128);
2497             setup->sm_local_y = big_endian_read_16(y128, 14);
2498             log_info_hex16("y", setup->sm_local_y);
2499             // PH3B3 - calculate EDIV
2500             setup->sm_local_ediv = setup->sm_local_y ^ setup->sm_local_div;
2501             log_info_hex16("ediv", setup->sm_local_ediv);
2502             // PH3B4 - calculate LTK         - enc
2503             // LTK = d1(ER, DIV, 0))
2504             connection->sm_engine_state = SM_PH3_LTK_GET_ENC;
2505             return;
2506         }
2507         case SM_RESPONDER_PH4_Y_W4_ENC:{
2508             sm_key_t y128;
2509             reverse_128(data, y128);
2510             setup->sm_local_y = big_endian_read_16(y128, 14);
2511             log_info_hex16("y", setup->sm_local_y);
2512 
2513             // PH3B3 - calculate DIV
2514             setup->sm_local_div = setup->sm_local_y ^ setup->sm_local_ediv;
2515             log_info_hex16("ediv", setup->sm_local_ediv);
2516             // PH3B4 - calculate LTK         - enc
2517             // LTK = d1(ER, DIV, 0))
2518             connection->sm_engine_state = SM_RESPONDER_PH4_LTK_GET_ENC;
2519             return;
2520         }
2521         case SM_PH3_LTK_W4_ENC:
2522             reverse_128(data, setup->sm_ltk);
2523             log_info_key("ltk", setup->sm_ltk);
2524             // calc CSRK next
2525             connection->sm_engine_state = SM_PH3_CSRK_GET_ENC;
2526             return;
2527         case SM_PH3_CSRK_W4_ENC:
2528             reverse_128(data, setup->sm_local_csrk);
2529             log_info_key("csrk", setup->sm_local_csrk);
2530             if (setup->sm_key_distribution_send_set){
2531                 connection->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
2532             } else {
2533                 // no keys to send, just continue
2534                 if (connection->sm_role){
2535                     // slave -> receive master keys
2536                     connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2537                 } else {
2538                     // master -> all done
2539                     connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2540                     sm_done_for_handle(connection->sm_handle);
2541                 }
2542             }
2543             return;
2544         case SM_RESPONDER_PH4_LTK_W4_ENC:
2545             reverse_128(data, setup->sm_ltk);
2546             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2547             log_info_key("ltk", setup->sm_ltk);
2548             connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK;
2549             return;
2550         default:
2551             break;
2552     }
2553 }
2554 
2555 #ifdef USE_MBEDTLS_FOR_ECDH
2556 
2557 static int sm_generate_f_rng(void * context, unsigned char * buffer, size_t size){
2558     int offset = setup->sm_passkey_bit;
2559     log_info("sm_generate_f_rng: size %u - offset %u", (int) size, offset);
2560     while (size) {
2561         if (offset < 32){
2562             *buffer++ = setup->sm_peer_qx[offset++];
2563         } else {
2564             *buffer++ = setup->sm_peer_qx[offset++ - 32];
2565         }
2566         size--;
2567     }
2568     setup->sm_passkey_bit = offset;
2569     return 0;
2570 }
2571 #endif
2572 
2573 // note: random generator is ready. this doesn NOT imply that aes engine is unused!
2574 static void sm_handle_random_result(uint8_t * data){
2575 
2576 #ifdef USE_MBEDTLS_FOR_ECDH
2577     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
2578         int num_bytes = setup->sm_passkey_bit;
2579         if (num_bytes < 32){
2580             memcpy(&setup->sm_peer_qx[num_bytes], data, 8);
2581         } else {
2582             memcpy(&setup->sm_peer_qx[num_bytes-32], data, 8);
2583         }
2584         num_bytes += 8;
2585         setup->sm_passkey_bit = num_bytes;
2586 
2587         if (num_bytes >= 64){
2588             // generate EC key
2589             setup->sm_passkey_bit = 0;
2590             mbedtls_mpi d;
2591             mbedtls_ecp_point P;
2592             mbedtls_mpi_init(&d);
2593             mbedtls_ecp_point_init(&P);
2594             mbedtls_ecp_gen_keypair(&mbedtls_ec_group, &d, &P, &sm_generate_f_rng, NULL);
2595             mbedtls_mpi_write_binary(&P.X, ec_qx, 16);
2596             mbedtls_mpi_write_binary(&P.Y, ec_qy, 16);
2597             mbedtls_mpi_write_binary(&d, ec_d, 16);
2598             sm_log_ec_keypair();
2599             mbedtls_ecp_point_free(&P);
2600             mbedtls_mpi_free(&d);
2601             ec_key_generation_state = EC_KEY_GENERATION_DONE;
2602 
2603 #if 1
2604             printf("test dhkey check\n");
2605             sm_key256_t dhkey;
2606             memcpy(setup->sm_peer_qx, ec_qx, 32);
2607             memcpy(setup->sm_peer_qy, ec_qy, 32);
2608             sm_sc_calculate_dhkey(dhkey);
2609 #endif
2610 
2611         }
2612     }
2613 #endif
2614 
2615     switch (rau_state){
2616         case RAU_W4_RANDOM:
2617             // non-resolvable vs. resolvable
2618             switch (gap_random_adress_type){
2619                 case GAP_RANDOM_ADDRESS_RESOLVABLE:
2620                     // resolvable: use random as prand and calc address hash
2621                     // "The two most significant bits of prand shall be equal to ‘0’ and ‘1"
2622                     memcpy(sm_random_address, data, 3);
2623                     sm_random_address[0] &= 0x3f;
2624                     sm_random_address[0] |= 0x40;
2625                     rau_state = RAU_GET_ENC;
2626                     break;
2627                 case GAP_RANDOM_ADDRESS_NON_RESOLVABLE:
2628                 default:
2629                     // "The two most significant bits of the address shall be equal to ‘0’""
2630                     memcpy(sm_random_address, data, 6);
2631                     sm_random_address[0] &= 0x3f;
2632                     rau_state = RAU_SET_ADDRESS;
2633                     break;
2634             }
2635             return;
2636         default:
2637             break;
2638     }
2639 
2640     // retrieve sm_connection provided to sm_random_start
2641     sm_connection_t * connection = (sm_connection_t *) sm_random_context;
2642     if (!connection) return;
2643     switch (connection->sm_engine_state){
2644 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2645         case SM_SC_W4_GET_RANDOM_A:
2646             memcpy(&setup->sm_local_nonce[0], data, 8);
2647             connection->sm_engine_state = SM_SC_W2_GET_RANDOM_B;
2648             break;
2649         case SM_SC_W4_GET_RANDOM_B:
2650             memcpy(&setup->sm_local_nonce[8], data, 8);
2651             // initiator & jw/nc -> send pairing random
2652             if (connection->sm_role == 0 && sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
2653                 connection->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
2654                 break;
2655             } else {
2656                 connection->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
2657             }
2658             break;
2659 #endif
2660 
2661         case SM_PH2_W4_RANDOM_TK:
2662         {
2663             // map random to 0-999999 without speding much cycles on a modulus operation
2664             uint32_t tk = little_endian_read_32(data,0);
2665             tk = tk & 0xfffff;  // 1048575
2666             if (tk >= 999999){
2667                 tk = tk - 999999;
2668             }
2669             sm_reset_tk();
2670             big_endian_store_32(setup->sm_tk, 12, tk);
2671             if (connection->sm_role){
2672                 connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
2673             } else {
2674                 connection->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
2675                 sm_trigger_user_response(connection);
2676                 // response_idle == nothing <--> sm_trigger_user_response() did not require response
2677                 if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
2678                     connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
2679                 }
2680             }
2681             return;
2682         }
2683         case SM_PH2_C1_W4_RANDOM_A:
2684             memcpy(&setup->sm_local_random[0], data, 8); // random endinaness
2685             connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_B;
2686             return;
2687         case SM_PH2_C1_W4_RANDOM_B:
2688             memcpy(&setup->sm_local_random[8], data, 8); // random endinaness
2689             connection->sm_engine_state = SM_PH2_C1_GET_ENC_A;
2690             return;
2691         case SM_PH3_W4_RANDOM:
2692             reverse_64(data, setup->sm_local_rand);
2693             // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
2694             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xf0) + (connection->sm_actual_encryption_key_size - 1);
2695             // no db for authenticated flag hack: store flag in bit 4 of LSB
2696             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xef) + (connection->sm_connection_authenticated << 4);
2697             connection->sm_engine_state = SM_PH3_GET_DIV;
2698             return;
2699         case SM_PH3_W4_DIV:
2700             // use 16 bit from random value as div
2701             setup->sm_local_div = big_endian_read_16(data, 0);
2702             log_info_hex16("div", setup->sm_local_div);
2703             connection->sm_engine_state = SM_PH3_Y_GET_ENC;
2704             return;
2705         default:
2706             break;
2707     }
2708 }
2709 
2710 static void sm_event_packet_handler (uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
2711 
2712     sm_connection_t  * sm_conn;
2713     hci_con_handle_t con_handle;
2714 
2715     switch (packet_type) {
2716 
2717 		case HCI_EVENT_PACKET:
2718 			switch (hci_event_packet_get_type(packet)) {
2719 
2720                 case BTSTACK_EVENT_STATE:
2721 					// bt stack activated, get started
2722 					if (btstack_event_state_get_state(packet) == HCI_STATE_WORKING){
2723                         log_info("HCI Working!");
2724                         dkg_state = sm_persistent_irk_ready ? DKG_CALC_DHK : DKG_CALC_IRK;
2725                         rau_state = RAU_IDLE;
2726 #ifdef USE_MBEDTLS_FOR_ECDH
2727                         if (!sm_have_ec_keypair){
2728                             setup->sm_passkey_bit = 0;
2729                             ec_key_generation_state = EC_KEY_GENERATION_ACTIVE;
2730                         }
2731 #endif
2732                         sm_run();
2733 					}
2734 					break;
2735 
2736                 case HCI_EVENT_LE_META:
2737                     switch (packet[2]) {
2738                         case HCI_SUBEVENT_LE_CONNECTION_COMPLETE:
2739 
2740                             log_info("sm: connected");
2741 
2742                             if (packet[3]) return; // connection failed
2743 
2744                             con_handle = little_endian_read_16(packet, 4);
2745                             sm_conn = sm_get_connection_for_handle(con_handle);
2746                             if (!sm_conn) break;
2747 
2748                             sm_conn->sm_handle = con_handle;
2749                             sm_conn->sm_role = packet[6];
2750                             sm_conn->sm_peer_addr_type = packet[7];
2751                             reverse_bd_addr(&packet[8],
2752                                             sm_conn->sm_peer_address);
2753 
2754                             log_info("New sm_conn, role %s", sm_conn->sm_role ? "slave" : "master");
2755 
2756                             // reset security properties
2757                             sm_conn->sm_connection_encrypted = 0;
2758                             sm_conn->sm_connection_authenticated = 0;
2759                             sm_conn->sm_connection_authorization_state = AUTHORIZATION_UNKNOWN;
2760                             sm_conn->sm_le_db_index = -1;
2761 
2762                             // prepare CSRK lookup (does not involve setup)
2763                             sm_conn->sm_irk_lookup_state = IRK_LOOKUP_W4_READY;
2764 
2765                             // just connected -> everything else happens in sm_run()
2766                             if (sm_conn->sm_role){
2767                                 // slave - state already could be SM_RESPONDER_SEND_SECURITY_REQUEST instead
2768                                 if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
2769                                     if (sm_slave_request_security) {
2770                                         // request security if requested by app
2771                                         sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
2772                                     } else {
2773                                         // otherwise, wait for pairing request
2774                                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
2775                                     }
2776                                 }
2777                                 break;
2778                             } else {
2779                                 // master
2780                                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2781                             }
2782                             break;
2783 
2784                         case HCI_SUBEVENT_LE_LONG_TERM_KEY_REQUEST:
2785                             con_handle = little_endian_read_16(packet, 3);
2786                             sm_conn = sm_get_connection_for_handle(con_handle);
2787                             if (!sm_conn) break;
2788 
2789                             log_info("LTK Request: state %u", sm_conn->sm_engine_state);
2790                             if (sm_conn->sm_engine_state == SM_RESPONDER_PH2_W4_LTK_REQUEST){
2791                                 sm_conn->sm_engine_state = SM_PH2_CALC_STK;
2792                                 break;
2793                             }
2794                             if (sm_conn->sm_engine_state == SM_SC_W4_LTK_REQUEST_SC){
2795                                 sm_conn->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2796                                 break;
2797                             }
2798 
2799                             // store rand and ediv
2800                             reverse_64(&packet[5], sm_conn->sm_local_rand);
2801                             sm_conn->sm_local_ediv   = little_endian_read_16(packet, 13);
2802                             sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK;
2803                             break;
2804 
2805                         default:
2806                             break;
2807                     }
2808                     break;
2809 
2810                 case HCI_EVENT_ENCRYPTION_CHANGE:
2811                     con_handle = little_endian_read_16(packet, 3);
2812                     sm_conn = sm_get_connection_for_handle(con_handle);
2813                     if (!sm_conn) break;
2814 
2815                     sm_conn->sm_connection_encrypted = packet[5];
2816                     log_info("Encryption state change: %u, key size %u", sm_conn->sm_connection_encrypted,
2817                         sm_conn->sm_actual_encryption_key_size);
2818                     log_info("event handler, state %u", sm_conn->sm_engine_state);
2819                     if (!sm_conn->sm_connection_encrypted) break;
2820                     // continue if part of initial pairing
2821                     switch (sm_conn->sm_engine_state){
2822                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
2823                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2824                             sm_done_for_handle(sm_conn->sm_handle);
2825                             break;
2826                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
2827                             if (sm_conn->sm_role){
2828                                 // slave
2829                                 if (setup->sm_use_secure_connections){
2830                                     sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
2831                                 } else {
2832                                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
2833                                 }
2834                             } else {
2835                                 // master
2836                                 if (sm_key_distribution_all_received(sm_conn)){
2837                                     // skip receiving keys as there are none
2838                                     sm_key_distribution_handle_all_received(sm_conn);
2839                                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
2840                                 } else {
2841                                     sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2842                                 }
2843                             }
2844                             break;
2845                         default:
2846                             break;
2847                     }
2848                     break;
2849 
2850                 case HCI_EVENT_ENCRYPTION_KEY_REFRESH_COMPLETE:
2851                     con_handle = little_endian_read_16(packet, 3);
2852                     sm_conn = sm_get_connection_for_handle(con_handle);
2853                     if (!sm_conn) break;
2854 
2855                     log_info("Encryption key refresh complete, key size %u", sm_conn->sm_actual_encryption_key_size);
2856                     log_info("event handler, state %u", sm_conn->sm_engine_state);
2857                     // continue if part of initial pairing
2858                     switch (sm_conn->sm_engine_state){
2859                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
2860                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2861                             sm_done_for_handle(sm_conn->sm_handle);
2862                             break;
2863                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
2864                             if (sm_conn->sm_role){
2865                                 // slave
2866                                 sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
2867                             } else {
2868                                 // master
2869                                 sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2870                             }
2871                             break;
2872                         default:
2873                             break;
2874                     }
2875                     break;
2876 
2877 
2878                 case HCI_EVENT_DISCONNECTION_COMPLETE:
2879                     con_handle = little_endian_read_16(packet, 3);
2880                     sm_done_for_handle(con_handle);
2881                     sm_conn = sm_get_connection_for_handle(con_handle);
2882                     if (!sm_conn) break;
2883 
2884                     // delete stored bonding on disconnect with authentication failure in ph0
2885                     if (sm_conn->sm_role == 0
2886                         && sm_conn->sm_engine_state == SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED
2887                         && packet[2] == ERROR_CODE_AUTHENTICATION_FAILURE){
2888                         le_device_db_remove(sm_conn->sm_le_db_index);
2889                     }
2890 
2891                     sm_conn->sm_engine_state = SM_GENERAL_IDLE;
2892                     sm_conn->sm_handle = 0;
2893                     break;
2894 
2895 				case HCI_EVENT_COMMAND_COMPLETE:
2896                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_encrypt)){
2897                         sm_handle_encryption_result(&packet[6]);
2898                         break;
2899                     }
2900                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_rand)){
2901                         sm_handle_random_result(&packet[6]);
2902                         break;
2903                     }
2904                     break;
2905                 default:
2906                     break;
2907 			}
2908             break;
2909         default:
2910             break;
2911 	}
2912 
2913     sm_run();
2914 }
2915 
2916 static inline int sm_calc_actual_encryption_key_size(int other){
2917     if (other < sm_min_encryption_key_size) return 0;
2918     if (other < sm_max_encryption_key_size) return other;
2919     return sm_max_encryption_key_size;
2920 }
2921 
2922 
2923 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method){
2924     switch (method){
2925         case JUST_WORKS:
2926         case NK_BOTH_INPUT:
2927             return 1;
2928         default:
2929             return 0;
2930     }
2931 }
2932 // responder
2933 
2934 static int sm_passkey_used(stk_generation_method_t method){
2935     switch (method){
2936         case PK_RESP_INPUT:
2937             return 1;
2938         default:
2939             return 0;
2940     }
2941 }
2942 
2943 /**
2944  * @return ok
2945  */
2946 static int sm_validate_stk_generation_method(void){
2947     // check if STK generation method is acceptable by client
2948     switch (setup->sm_stk_generation_method){
2949         case JUST_WORKS:
2950             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_JUST_WORKS) != 0;
2951         case PK_RESP_INPUT:
2952         case PK_INIT_INPUT:
2953         case OK_BOTH_INPUT:
2954             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_PASSKEY) != 0;
2955         case OOB:
2956             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_OOB) != 0;
2957         case NK_BOTH_INPUT:
2958             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON) != 0;
2959             return 1;
2960         default:
2961             return 0;
2962     }
2963 }
2964 
2965 static void sm_pdu_handler(uint8_t packet_type, hci_con_handle_t con_handle, uint8_t *packet, uint16_t size){
2966 
2967     if (packet_type == HCI_EVENT_PACKET && packet[0] == L2CAP_EVENT_CAN_SEND_NOW){
2968         sm_run();
2969     }
2970 
2971     if (packet_type != SM_DATA_PACKET) return;
2972 
2973     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
2974     if (!sm_conn) return;
2975 
2976     if (packet[0] == SM_CODE_PAIRING_FAILED){
2977         sm_conn->sm_engine_state = sm_conn->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
2978         return;
2979     }
2980 
2981     log_debug("sm_pdu_handler: state %u, pdu 0x%02x", sm_conn->sm_engine_state, packet[0]);
2982 
2983     int err;
2984 
2985     switch (sm_conn->sm_engine_state){
2986 
2987         // a sm timeout requries a new physical connection
2988         case SM_GENERAL_TIMEOUT:
2989             return;
2990 
2991         // Initiator
2992         case SM_INITIATOR_CONNECTED:
2993             if ((packet[0] != SM_CODE_SECURITY_REQUEST) || (sm_conn->sm_role)){
2994                 sm_pdu_received_in_wrong_state(sm_conn);
2995                 break;
2996             }
2997             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_FAILED){
2998                 sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
2999                 break;
3000             }
3001             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_SUCCEEDED){
3002                 uint16_t ediv;
3003                 sm_key_t ltk;
3004                 le_device_db_encryption_get(sm_conn->sm_le_db_index, &ediv, NULL, ltk, NULL, NULL, NULL);
3005                 if (!sm_is_null_key(ltk) || ediv){
3006                     log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3007                     sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3008                 } else {
3009                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3010                 }
3011                 break;
3012             }
3013             // otherwise, store security request
3014             sm_conn->sm_security_request_received = 1;
3015             break;
3016 
3017         case SM_INITIATOR_PH1_W4_PAIRING_RESPONSE:
3018             if (packet[0] != SM_CODE_PAIRING_RESPONSE){
3019                 sm_pdu_received_in_wrong_state(sm_conn);
3020                 break;
3021             }
3022             // store pairing request
3023             memcpy(&setup->sm_s_pres, packet, sizeof(sm_pairing_packet_t));
3024             err = sm_stk_generation_init(sm_conn);
3025             if (err){
3026                 setup->sm_pairing_failed_reason = err;
3027                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3028                 break;
3029             }
3030 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3031             if (setup->sm_use_secure_connections){
3032                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
3033                 if (setup->sm_stk_generation_method == JUST_WORKS){
3034                     sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3035                     sm_trigger_user_response(sm_conn);
3036                     if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3037                         sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3038                     }
3039                 } else {
3040                     sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3041                 }
3042                 break;
3043             }
3044 #endif
3045             // generate random number first, if we need to show passkey
3046             if (setup->sm_stk_generation_method == PK_RESP_INPUT){
3047                 sm_conn->sm_engine_state = SM_PH2_GET_RANDOM_TK;
3048                 break;
3049             }
3050             sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3051             sm_trigger_user_response(sm_conn);
3052             // response_idle == nothing <--> sm_trigger_user_response() did not require response
3053             if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3054                 sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3055             }
3056             break;
3057 
3058         case SM_INITIATOR_PH2_W4_PAIRING_CONFIRM:
3059             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3060                 sm_pdu_received_in_wrong_state(sm_conn);
3061                 break;
3062             }
3063 
3064             // store s_confirm
3065             reverse_128(&packet[1], setup->sm_peer_confirm);
3066             sm_conn->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
3067             break;
3068 
3069         case SM_INITIATOR_PH2_W4_PAIRING_RANDOM:
3070             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3071                 sm_pdu_received_in_wrong_state(sm_conn);
3072                 break;;
3073             }
3074 
3075             // received random value
3076             reverse_128(&packet[1], setup->sm_peer_random);
3077             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3078             break;
3079 
3080         // Responder
3081         case SM_RESPONDER_IDLE:
3082         case SM_RESPONDER_SEND_SECURITY_REQUEST:
3083         case SM_RESPONDER_PH1_W4_PAIRING_REQUEST:
3084             if (packet[0] != SM_CODE_PAIRING_REQUEST){
3085                 sm_pdu_received_in_wrong_state(sm_conn);
3086                 break;;
3087             }
3088 
3089             // store pairing request
3090             memcpy(&sm_conn->sm_m_preq, packet, sizeof(sm_pairing_packet_t));
3091             sm_conn->sm_engine_state = SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED;
3092             break;
3093 
3094 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3095         case SM_SC_W4_PUBLIC_KEY_COMMAND:
3096             if (packet[0] != SM_CODE_PAIRING_PUBLIC_KEY){
3097                 sm_pdu_received_in_wrong_state(sm_conn);
3098                 break;
3099             }
3100 
3101             // store public key for DH Key calculation
3102             reverse_256(&packet[01], setup->sm_peer_qx);
3103             reverse_256(&packet[33], setup->sm_peer_qy);
3104 
3105 #ifdef USE_MBEDTLS_FOR_ECDH
3106             // validate public key
3107             mbedtls_ecp_point Q;
3108             mbedtls_ecp_point_init( &Q );
3109             mbedtls_mpi_read_binary(&Q.X, setup->sm_peer_qx, 32);
3110             mbedtls_mpi_read_binary(&Q.Y, setup->sm_peer_qy, 32);
3111             mbedtls_mpi_read_string(&Q.Z, 16, "1" );
3112             err = mbedtls_ecp_check_pubkey(&mbedtls_ec_group, &Q);
3113             mbedtls_ecp_point_free( & Q);
3114             if (err){
3115                 log_error("sm: peer public key invalid %x", err);
3116                 // uses "unspecified reason", there is no "public key invalid" error code
3117                 sm_pdu_received_in_wrong_state(sm_conn);
3118                 break;
3119             }
3120 
3121 #endif
3122             if (sm_conn->sm_role){
3123                 // responder
3124                 sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3125             } else {
3126                 // initiator
3127                 // stk generation method
3128                 // passkey entry: notify app to show passkey or to request passkey
3129                 switch (setup->sm_stk_generation_method){
3130                     case JUST_WORKS:
3131                     case NK_BOTH_INPUT:
3132                         sm_conn->sm_engine_state = SM_SC_W4_CONFIRMATION;
3133                         break;
3134                     case PK_RESP_INPUT:
3135                         sm_sc_start_calculating_local_confirm(sm_conn);
3136                         break;
3137                     case PK_INIT_INPUT:
3138                     case OK_BOTH_INPUT:
3139                         if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3140                             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3141                             break;
3142                         }
3143                         sm_sc_start_calculating_local_confirm(sm_conn);
3144                         break;
3145                     case OOB:
3146                         // TODO: implement SC OOB
3147                         break;
3148                 }
3149             }
3150             break;
3151 
3152         case SM_SC_W4_CONFIRMATION:
3153             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3154                 sm_pdu_received_in_wrong_state(sm_conn);
3155                 break;
3156             }
3157             // received confirm value
3158             reverse_128(&packet[1], setup->sm_peer_confirm);
3159 
3160             if (sm_conn->sm_role){
3161                 // responder
3162                 if (sm_passkey_used(setup->sm_stk_generation_method)){
3163                     if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3164                         // still waiting for passkey
3165                         sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3166                         break;
3167                     }
3168                 }
3169                 sm_sc_start_calculating_local_confirm(sm_conn);
3170             } else {
3171                 // initiator
3172                 if (sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
3173                     sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
3174                 } else {
3175                     sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
3176                 }
3177             }
3178             break;
3179 
3180         case SM_SC_W4_PAIRING_RANDOM:
3181             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3182                 sm_pdu_received_in_wrong_state(sm_conn);
3183                 break;
3184             }
3185 
3186             // received random value
3187             reverse_128(&packet[1], setup->sm_peer_nonce);
3188 
3189             // validate confirm value if Cb = f4(Pkb, Pka, Nb, z)
3190             // only check for JUST WORK/NC in initiator role AND passkey entry
3191             int passkey_entry = sm_passkey_used(setup->sm_stk_generation_method);
3192             if (sm_conn->sm_role || passkey_entry) {
3193                  sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION;
3194             }
3195 
3196             sm_sc_state_after_receiving_random(sm_conn);
3197             break;
3198 
3199         case SM_SC_W2_CALCULATE_G2:
3200         case SM_SC_W4_CALCULATE_G2:
3201         case SM_SC_W2_CALCULATE_F5_SALT:
3202         case SM_SC_W4_CALCULATE_F5_SALT:
3203         case SM_SC_W2_CALCULATE_F5_MACKEY:
3204         case SM_SC_W4_CALCULATE_F5_MACKEY:
3205         case SM_SC_W2_CALCULATE_F5_LTK:
3206         case SM_SC_W4_CALCULATE_F5_LTK:
3207         case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
3208         case SM_SC_W4_DHKEY_CHECK_COMMAND:
3209         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
3210             if (packet[0] != SM_CODE_PAIRING_DHKEY_CHECK){
3211                 sm_pdu_received_in_wrong_state(sm_conn);
3212                 break;
3213             }
3214             // store DHKey Check
3215             setup->sm_state_vars |= SM_STATE_VAR_DHKEY_COMMAND_RECEIVED;
3216             reverse_128(&packet[01], setup->sm_peer_dhkey_check);
3217 
3218             // have we been only waiting for dhkey check command?
3219             if (sm_conn->sm_engine_state == SM_SC_W4_DHKEY_CHECK_COMMAND){
3220                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
3221             }
3222             break;
3223 #endif
3224 
3225         case SM_RESPONDER_PH1_W4_PAIRING_CONFIRM:
3226             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3227                 sm_pdu_received_in_wrong_state(sm_conn);
3228                 break;
3229             }
3230 
3231             // received confirm value
3232             reverse_128(&packet[1], setup->sm_peer_confirm);
3233 
3234             // notify client to hide shown passkey
3235             if (setup->sm_stk_generation_method == PK_INIT_INPUT){
3236                 sm_notify_client_base(SM_EVENT_PASSKEY_DISPLAY_CANCEL, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
3237             }
3238 
3239             // handle user cancel pairing?
3240             if (setup->sm_user_response == SM_USER_RESPONSE_DECLINE){
3241                 setup->sm_pairing_failed_reason = SM_REASON_PASSKEYT_ENTRY_FAILED;
3242                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3243                 break;
3244             }
3245 
3246             // wait for user action?
3247             if (setup->sm_user_response == SM_USER_RESPONSE_PENDING){
3248                 sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3249                 break;
3250             }
3251 
3252             // calculate and send local_confirm
3253             sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3254             break;
3255 
3256         case SM_RESPONDER_PH2_W4_PAIRING_RANDOM:
3257             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3258                 sm_pdu_received_in_wrong_state(sm_conn);
3259                 break;;
3260             }
3261 
3262             // received random value
3263             reverse_128(&packet[1], setup->sm_peer_random);
3264             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3265             break;
3266 
3267         case SM_PH3_RECEIVE_KEYS:
3268             switch(packet[0]){
3269                 case SM_CODE_ENCRYPTION_INFORMATION:
3270                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
3271                     reverse_128(&packet[1], setup->sm_peer_ltk);
3272                     break;
3273 
3274                 case SM_CODE_MASTER_IDENTIFICATION:
3275                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
3276                     setup->sm_peer_ediv = little_endian_read_16(packet, 1);
3277                     reverse_64(&packet[3], setup->sm_peer_rand);
3278                     break;
3279 
3280                 case SM_CODE_IDENTITY_INFORMATION:
3281                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
3282                     reverse_128(&packet[1], setup->sm_peer_irk);
3283                     break;
3284 
3285                 case SM_CODE_IDENTITY_ADDRESS_INFORMATION:
3286                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
3287                     setup->sm_peer_addr_type = packet[1];
3288                     reverse_bd_addr(&packet[2], setup->sm_peer_address);
3289                     break;
3290 
3291                 case SM_CODE_SIGNING_INFORMATION:
3292                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
3293                     reverse_128(&packet[1], setup->sm_peer_csrk);
3294                     break;
3295                 default:
3296                     // Unexpected PDU
3297                     log_info("Unexpected PDU %u in SM_PH3_RECEIVE_KEYS", packet[0]);
3298                     break;
3299             }
3300             // done with key distribution?
3301             if (sm_key_distribution_all_received(sm_conn)){
3302 
3303                 sm_key_distribution_handle_all_received(sm_conn);
3304 
3305                 if (sm_conn->sm_role){
3306                     sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
3307                     sm_done_for_handle(sm_conn->sm_handle);
3308                 } else {
3309                     if (setup->sm_use_secure_connections){
3310                         sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
3311                     } else {
3312                         sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3313                     }
3314                 }
3315             }
3316             break;
3317         default:
3318             // Unexpected PDU
3319             log_info("Unexpected PDU %u in state %u", packet[0], sm_conn->sm_engine_state);
3320             break;
3321     }
3322 
3323     // try to send preparared packet
3324     sm_run();
3325 }
3326 
3327 // Security Manager Client API
3328 void sm_register_oob_data_callback( int (*get_oob_data_callback)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data)){
3329     sm_get_oob_data = get_oob_data_callback;
3330 }
3331 
3332 void sm_add_event_handler(btstack_packet_callback_registration_t * callback_handler){
3333     btstack_linked_list_add_tail(&sm_event_handlers, (btstack_linked_item_t*) callback_handler);
3334 }
3335 
3336 void sm_set_accepted_stk_generation_methods(uint8_t accepted_stk_generation_methods){
3337     sm_accepted_stk_generation_methods = accepted_stk_generation_methods;
3338 }
3339 
3340 void sm_set_encryption_key_size_range(uint8_t min_size, uint8_t max_size){
3341 	sm_min_encryption_key_size = min_size;
3342 	sm_max_encryption_key_size = max_size;
3343 }
3344 
3345 void sm_set_authentication_requirements(uint8_t auth_req){
3346     sm_auth_req = auth_req;
3347 }
3348 
3349 void sm_set_io_capabilities(io_capability_t io_capability){
3350     sm_io_capabilities = io_capability;
3351 }
3352 
3353 void sm_set_request_security(int enable){
3354     sm_slave_request_security = enable;
3355 }
3356 
3357 void sm_set_er(sm_key_t er){
3358     memcpy(sm_persistent_er, er, 16);
3359 }
3360 
3361 void sm_set_ir(sm_key_t ir){
3362     memcpy(sm_persistent_ir, ir, 16);
3363 }
3364 
3365 // Testing support only
3366 void sm_test_set_irk(sm_key_t irk){
3367     memcpy(sm_persistent_irk, irk, 16);
3368     sm_persistent_irk_ready = 1;
3369 }
3370 
3371 void sm_test_use_fixed_local_csrk(void){
3372     test_use_fixed_local_csrk = 1;
3373 }
3374 
3375 void sm_init(void){
3376     // set some (BTstack default) ER and IR
3377     int i;
3378     sm_key_t er;
3379     sm_key_t ir;
3380     for (i=0;i<16;i++){
3381         er[i] = 0x30 + i;
3382         ir[i] = 0x90 + i;
3383     }
3384     sm_set_er(er);
3385     sm_set_ir(ir);
3386     // defaults
3387     sm_accepted_stk_generation_methods = SM_STK_GENERATION_METHOD_JUST_WORKS
3388                                        | SM_STK_GENERATION_METHOD_OOB
3389                                        | SM_STK_GENERATION_METHOD_PASSKEY
3390                                        | SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON;
3391 
3392     sm_max_encryption_key_size = 16;
3393     sm_min_encryption_key_size = 7;
3394 
3395     sm_cmac_state  = CMAC_IDLE;
3396     dkg_state = DKG_W4_WORKING;
3397     rau_state = RAU_W4_WORKING;
3398     sm_aes128_state = SM_AES128_IDLE;
3399     sm_address_resolution_test = -1;    // no private address to resolve yet
3400     sm_address_resolution_ah_calculation_active = 0;
3401     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
3402     sm_address_resolution_general_queue = NULL;
3403 
3404     gap_random_adress_update_period = 15 * 60 * 1000L;
3405 
3406     sm_active_connection = 0;
3407 
3408     test_use_fixed_local_csrk = 0;
3409 
3410     // register for HCI Events from HCI
3411     hci_event_callback_registration.callback = &sm_event_packet_handler;
3412     hci_add_event_handler(&hci_event_callback_registration);
3413 
3414     // and L2CAP PDUs + L2CAP_EVENT_CAN_SEND_NOW
3415     l2cap_register_fixed_channel(sm_pdu_handler, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
3416 
3417 #ifdef USE_MBEDTLS_FOR_ECDH
3418     ec_key_generation_state = EC_KEY_GENERATION_IDLE;
3419 
3420 #ifndef HAVE_MALLOC
3421     sm_mbedtls_allocator_init(mbedtls_memory_buffer, sizeof(mbedtls_memory_buffer));
3422 #endif
3423     mbedtls_ecp_group_init(&mbedtls_ec_group);
3424     mbedtls_ecp_group_load(&mbedtls_ec_group, MBEDTLS_ECP_DP_SECP256R1);
3425 
3426 #if 0
3427     // test
3428     sm_test_use_fixed_ec_keypair();
3429     if (sm_have_ec_keypair){
3430         printf("test dhkey check\n");
3431         sm_key256_t dhkey;
3432         memcpy(setup->sm_peer_qx, ec_qx, 32);
3433         memcpy(setup->sm_peer_qy, ec_qy, 32);
3434         sm_sc_calculate_dhkey(dhkey);
3435     }
3436 #endif
3437 #endif
3438 }
3439 
3440 void sm_use_fixed_ec_keypair(uint8_t * qx, uint8_t * qy, uint8_t * d){
3441     memcpy(ec_qx, qx, 32);
3442     memcpy(ec_qy, qy, 32);
3443     memcpy(ec_d, d, 32);
3444     sm_have_ec_keypair = 1;
3445     ec_key_generation_state = EC_KEY_GENERATION_DONE;
3446 }
3447 
3448 void sm_test_use_fixed_ec_keypair(void){
3449 #ifdef USE_MBEDTLS_FOR_ECDH
3450     // use test keypair from spec
3451     mbedtls_mpi x;
3452     mbedtls_mpi_init(&x);
3453     mbedtls_mpi_read_string( &x, 16, "3f49f6d4a3c55f3874c9b3e3d2103f504aff607beb40b7995899b8a6cd3c1abd");
3454     mbedtls_mpi_write_binary(&x, ec_d, 32);
3455     mbedtls_mpi_read_string( &x, 16, "20b003d2f297be2c5e2c83a7e9f9a5b9eff49111acf4fddbcc0301480e359de6");
3456     mbedtls_mpi_write_binary(&x, ec_qx, 32);
3457     mbedtls_mpi_read_string( &x, 16, "dc809c49652aeb6d63329abf5a52155c766345c28fed3024741c8ed01589d28b");
3458     mbedtls_mpi_write_binary(&x, ec_qy, 32);
3459     mbedtls_mpi_free(&x);
3460 #endif
3461     sm_have_ec_keypair = 1;
3462     ec_key_generation_state = EC_KEY_GENERATION_DONE;
3463 }
3464 
3465 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle){
3466     hci_connection_t * hci_con = hci_connection_for_handle(con_handle);
3467     if (!hci_con) return NULL;
3468     return &hci_con->sm_connection;
3469 }
3470 
3471 // @returns 0 if not encrypted, 7-16 otherwise
3472 int sm_encryption_key_size(hci_con_handle_t con_handle){
3473     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3474     if (!sm_conn) return 0;     // wrong connection
3475     if (!sm_conn->sm_connection_encrypted) return 0;
3476     return sm_conn->sm_actual_encryption_key_size;
3477 }
3478 
3479 int sm_authenticated(hci_con_handle_t con_handle){
3480     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3481     if (!sm_conn) return 0;     // wrong connection
3482     if (!sm_conn->sm_connection_encrypted) return 0; // unencrypted connection cannot be authenticated
3483     return sm_conn->sm_connection_authenticated;
3484 }
3485 
3486 authorization_state_t sm_authorization_state(hci_con_handle_t con_handle){
3487     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3488     if (!sm_conn) return AUTHORIZATION_UNKNOWN;     // wrong connection
3489     if (!sm_conn->sm_connection_encrypted)               return AUTHORIZATION_UNKNOWN; // unencrypted connection cannot be authorized
3490     if (!sm_conn->sm_connection_authenticated)           return AUTHORIZATION_UNKNOWN; // unauthenticatd connection cannot be authorized
3491     return sm_conn->sm_connection_authorization_state;
3492 }
3493 
3494 static void sm_send_security_request_for_connection(sm_connection_t * sm_conn){
3495     switch (sm_conn->sm_engine_state){
3496         case SM_GENERAL_IDLE:
3497         case SM_RESPONDER_IDLE:
3498             sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
3499             sm_run();
3500             break;
3501         default:
3502             break;
3503     }
3504 }
3505 
3506 /**
3507  * @brief Trigger Security Request
3508  */
3509 void sm_send_security_request(hci_con_handle_t con_handle){
3510     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3511     if (!sm_conn) return;
3512     sm_send_security_request_for_connection(sm_conn);
3513 }
3514 
3515 // request pairing
3516 void sm_request_pairing(hci_con_handle_t con_handle){
3517     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3518     if (!sm_conn) return;     // wrong connection
3519 
3520     log_info("sm_request_pairing in role %u, state %u", sm_conn->sm_role, sm_conn->sm_engine_state);
3521     if (sm_conn->sm_role){
3522         sm_send_security_request_for_connection(sm_conn);
3523     } else {
3524         // used as a trigger to start central/master/initiator security procedures
3525         uint16_t ediv;
3526         sm_key_t ltk;
3527         if (sm_conn->sm_engine_state == SM_INITIATOR_CONNECTED){
3528             switch (sm_conn->sm_irk_lookup_state){
3529                 case IRK_LOOKUP_FAILED:
3530                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3531                     break;
3532                 case IRK_LOOKUP_SUCCEEDED:
3533                         le_device_db_encryption_get(sm_conn->sm_le_db_index, &ediv, NULL, ltk, NULL, NULL, NULL);
3534                         if (!sm_is_null_key(ltk) || ediv){
3535                             log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3536                             sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3537                         } else {
3538                             sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3539                         }
3540                         break;
3541                 default:
3542                     sm_conn->sm_bonding_requested = 1;
3543                     break;
3544             }
3545         } else if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
3546             sm_conn->sm_bonding_requested = 1;
3547         }
3548     }
3549     sm_run();
3550 }
3551 
3552 // called by client app on authorization request
3553 void sm_authorization_decline(hci_con_handle_t con_handle){
3554     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3555     if (!sm_conn) return;     // wrong connection
3556     sm_conn->sm_connection_authorization_state = AUTHORIZATION_DECLINED;
3557     sm_notify_client_authorization(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 0);
3558 }
3559 
3560 void sm_authorization_grant(hci_con_handle_t con_handle){
3561     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3562     if (!sm_conn) return;     // wrong connection
3563     sm_conn->sm_connection_authorization_state = AUTHORIZATION_GRANTED;
3564     sm_notify_client_authorization(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 1);
3565 }
3566 
3567 // GAP Bonding API
3568 
3569 void sm_bonding_decline(hci_con_handle_t con_handle){
3570     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3571     if (!sm_conn) return;     // wrong connection
3572     setup->sm_user_response = SM_USER_RESPONSE_DECLINE;
3573 
3574     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3575         switch (setup->sm_stk_generation_method){
3576             case PK_RESP_INPUT:
3577             case PK_INIT_INPUT:
3578             case OK_BOTH_INPUT:
3579                 sm_pairing_error(sm_conn, SM_GENERAL_SEND_PAIRING_FAILED);
3580                 break;
3581             case NK_BOTH_INPUT:
3582                 sm_pairing_error(sm_conn, SM_REASON_NUMERIC_COMPARISON_FAILED);
3583                 break;
3584             case JUST_WORKS:
3585             case OOB:
3586                 sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
3587                 break;
3588         }
3589     }
3590     sm_run();
3591 }
3592 
3593 void sm_just_works_confirm(hci_con_handle_t con_handle){
3594     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3595     if (!sm_conn) return;     // wrong connection
3596     setup->sm_user_response = SM_USER_RESPONSE_CONFIRM;
3597     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3598         if (setup->sm_use_secure_connections){
3599             sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3600         } else {
3601             sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3602         }
3603     }
3604 
3605 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3606     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
3607         sm_sc_prepare_dhkey_check(sm_conn);
3608     }
3609 #endif
3610 
3611     sm_run();
3612 }
3613 
3614 void sm_numeric_comparison_confirm(hci_con_handle_t con_handle){
3615     // for now, it's the same
3616     sm_just_works_confirm(con_handle);
3617 }
3618 
3619 void sm_passkey_input(hci_con_handle_t con_handle, uint32_t passkey){
3620     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3621     if (!sm_conn) return;     // wrong connection
3622     sm_reset_tk();
3623     big_endian_store_32(setup->sm_tk, 12, passkey);
3624     setup->sm_user_response = SM_USER_RESPONSE_PASSKEY;
3625     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3626         sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3627     }
3628 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3629     memcpy(setup->sm_ra, setup->sm_tk, 16);
3630     memcpy(setup->sm_rb, setup->sm_tk, 16);
3631     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
3632         sm_sc_start_calculating_local_confirm(sm_conn);
3633     }
3634 #endif
3635     sm_run();
3636 }
3637 
3638 /**
3639  * @brief Identify device in LE Device DB
3640  * @param handle
3641  * @returns index from le_device_db or -1 if not found/identified
3642  */
3643 int sm_le_device_index(hci_con_handle_t con_handle ){
3644     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3645     if (!sm_conn) return -1;
3646     return sm_conn->sm_le_db_index;
3647 }
3648 
3649 // GAP LE API
3650 void gap_random_address_set_mode(gap_random_address_type_t random_address_type){
3651     gap_random_address_update_stop();
3652     gap_random_adress_type = random_address_type;
3653     if (random_address_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return;
3654     gap_random_address_update_start();
3655     gap_random_address_trigger();
3656 }
3657 
3658 gap_random_address_type_t gap_random_address_get_mode(void){
3659     return gap_random_adress_type;
3660 }
3661 
3662 void gap_random_address_set_update_period(int period_ms){
3663     gap_random_adress_update_period = period_ms;
3664     if (gap_random_adress_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return;
3665     gap_random_address_update_stop();
3666     gap_random_address_update_start();
3667 }
3668 
3669 void gap_random_address_set(bd_addr_t addr){
3670     gap_random_address_set_mode(GAP_RANDOM_ADDRESS_TYPE_OFF);
3671     memcpy(sm_random_address, addr, 6);
3672     rau_state = RAU_SET_ADDRESS;
3673     sm_run();
3674 }
3675 
3676 /*
3677  * @brief Set Advertisement Paramters
3678  * @param adv_int_min
3679  * @param adv_int_max
3680  * @param adv_type
3681  * @param direct_address_type
3682  * @param direct_address
3683  * @param channel_map
3684  * @param filter_policy
3685  *
3686  * @note own_address_type is used from gap_random_address_set_mode
3687  */
3688 void gap_advertisements_set_params(uint16_t adv_int_min, uint16_t adv_int_max, uint8_t adv_type,
3689     uint8_t direct_address_typ, bd_addr_t direct_address, uint8_t channel_map, uint8_t filter_policy){
3690     hci_le_advertisements_set_params(adv_int_min, adv_int_max, adv_type, gap_random_adress_type,
3691         direct_address_typ, direct_address, channel_map, filter_policy);
3692 }
3693 
3694