xref: /btstack/src/ble/sm.c (revision cfd5ff742760e23d02c9b2a3ab5954091cab7fe0)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #include <stdio.h>
39 #include <string.h>
40 #include <inttypes.h>
41 
42 #include "ble/le_device_db.h"
43 #include "ble/core.h"
44 #include "ble/sm.h"
45 #include "btstack_debug.h"
46 #include "btstack_event.h"
47 #include "btstack_linked_list.h"
48 #include "btstack_memory.h"
49 #include "gap.h"
50 #include "hci.h"
51 #include "l2cap.h"
52 
53 #ifdef ENABLE_LE_SECURE_CONNECTIONS
54 // TODO: remove software AES
55 #include "rijndael.h"
56 #endif
57 
58 #if defined(ENABLE_LE_SECURE_CONNECTIONS) && !defined(HAVE_HCI_CONTROLLER_DHKEY_SUPPORT)
59 #define USE_MBEDTLS_FOR_ECDH
60 #endif
61 
62 #ifdef ENABLE_LE_SECURE_CONNECTIONS
63 #ifdef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
64 #error "Support for DHKEY Support in HCI Controller not implemented yet. Please use software implementation"
65 #else
66 #define USE_MBEDTLS_FOR_ECDH
67 #endif
68 #endif
69 
70 
71 // Software ECDH implementation provided by mbedtls
72 #ifdef USE_MBEDTLS_FOR_ECDH
73 #if !defined(MBEDTLS_CONFIG_FILE)
74 #include "mbedtls/config.h"
75 #else
76 #include MBEDTLS_CONFIG_FILE
77 #endif
78 #if defined(MBEDTLS_PLATFORM_C)
79 #include "mbedtls/platform.h"
80 #else
81 #include <stdio.h>
82 #define mbedtls_printf     printf
83 #endif
84 #include "mbedtls/ecp.h"
85 #endif
86 
87 //
88 // SM internal types and globals
89 //
90 
91 typedef enum {
92     DKG_W4_WORKING,
93     DKG_CALC_IRK,
94     DKG_W4_IRK,
95     DKG_CALC_DHK,
96     DKG_W4_DHK,
97     DKG_READY
98 } derived_key_generation_t;
99 
100 typedef enum {
101     RAU_W4_WORKING,
102     RAU_IDLE,
103     RAU_GET_RANDOM,
104     RAU_W4_RANDOM,
105     RAU_GET_ENC,
106     RAU_W4_ENC,
107     RAU_SET_ADDRESS,
108 } random_address_update_t;
109 
110 typedef enum {
111     CMAC_IDLE,
112     CMAC_CALC_SUBKEYS,
113     CMAC_W4_SUBKEYS,
114     CMAC_CALC_MI,
115     CMAC_W4_MI,
116     CMAC_CALC_MLAST,
117     CMAC_W4_MLAST
118 } cmac_state_t;
119 
120 typedef enum {
121     JUST_WORKS,
122     PK_RESP_INPUT,  // Initiator displays PK, responder inputs PK
123     PK_INIT_INPUT,  // Responder displays PK, initiator inputs PK
124     OK_BOTH_INPUT,  // Only input on both, both input PK
125     NK_BOTH_INPUT,  // Only numerical compparison (yes/no) on on both sides
126     OOB             // OOB available on both sides
127 } stk_generation_method_t;
128 
129 typedef enum {
130     SM_USER_RESPONSE_IDLE,
131     SM_USER_RESPONSE_PENDING,
132     SM_USER_RESPONSE_CONFIRM,
133     SM_USER_RESPONSE_PASSKEY,
134     SM_USER_RESPONSE_DECLINE
135 } sm_user_response_t;
136 
137 typedef enum {
138     SM_AES128_IDLE,
139     SM_AES128_ACTIVE
140 } sm_aes128_state_t;
141 
142 typedef enum {
143     ADDRESS_RESOLUTION_IDLE,
144     ADDRESS_RESOLUTION_GENERAL,
145     ADDRESS_RESOLUTION_FOR_CONNECTION,
146 } address_resolution_mode_t;
147 
148 typedef enum {
149     ADDRESS_RESOLUTION_SUCEEDED,
150     ADDRESS_RESOLUTION_FAILED,
151 } address_resolution_event_t;
152 
153 typedef enum {
154     EC_KEY_GENERATION_IDLE,
155     EC_KEY_GENERATION_ACTIVE,
156     EC_KEY_GENERATION_DONE,
157 } ec_key_generation_state_t;
158 
159 typedef enum {
160     SM_STATE_VAR_DHKEY_COMMAND_RECEIVED = 1 << 0
161 } sm_state_var_t;
162 
163 //
164 // GLOBAL DATA
165 //
166 
167 static uint8_t test_use_fixed_local_csrk;
168 static uint8_t test_use_fixed_ec_keypair;
169 
170 // configuration
171 static uint8_t sm_accepted_stk_generation_methods;
172 static uint8_t sm_max_encryption_key_size;
173 static uint8_t sm_min_encryption_key_size;
174 static uint8_t sm_auth_req = 0;
175 static uint8_t sm_io_capabilities = IO_CAPABILITY_NO_INPUT_NO_OUTPUT;
176 static uint8_t sm_slave_request_security;
177 
178 // Security Manager Master Keys, please use sm_set_er(er) and sm_set_ir(ir) with your own 128 bit random values
179 static sm_key_t sm_persistent_er;
180 static sm_key_t sm_persistent_ir;
181 
182 // derived from sm_persistent_ir
183 static sm_key_t sm_persistent_dhk;
184 static sm_key_t sm_persistent_irk;
185 static uint8_t  sm_persistent_irk_ready = 0;    // used for testing
186 static derived_key_generation_t dkg_state;
187 
188 // derived from sm_persistent_er
189 // ..
190 
191 // random address update
192 static random_address_update_t rau_state;
193 static bd_addr_t sm_random_address;
194 
195 // CMAC Calculation: General
196 static cmac_state_t sm_cmac_state;
197 static uint16_t     sm_cmac_message_len;
198 static sm_key_t     sm_cmac_k;
199 static sm_key_t     sm_cmac_x;
200 static sm_key_t     sm_cmac_m_last;
201 static uint8_t      sm_cmac_block_current;
202 static uint8_t      sm_cmac_block_count;
203 static uint8_t      (*sm_cmac_get_byte)(uint16_t offset);
204 static void         (*sm_cmac_done_handler)(uint8_t * hash);
205 
206 // CMAC for ATT Signed Writes
207 static uint8_t      sm_cmac_header[3];
208 static const uint8_t * sm_cmac_message;
209 static uint8_t      sm_cmac_sign_counter[4];
210 
211 // CMAC for Secure Connection functions
212 #ifdef ENABLE_LE_SECURE_CONNECTIONS
213 static sm_connection_t * sm_cmac_connection;
214 static uint8_t           sm_cmac_sc_buffer[80];
215 #endif
216 
217 // resolvable private address lookup / CSRK calculation
218 static int       sm_address_resolution_test;
219 static int       sm_address_resolution_ah_calculation_active;
220 static uint8_t   sm_address_resolution_addr_type;
221 static bd_addr_t sm_address_resolution_address;
222 static void *    sm_address_resolution_context;
223 static address_resolution_mode_t sm_address_resolution_mode;
224 static btstack_linked_list_t sm_address_resolution_general_queue;
225 
226 // aes128 crypto engine. store current sm_connection_t in sm_aes128_context
227 static sm_aes128_state_t  sm_aes128_state;
228 static void *             sm_aes128_context;
229 
230 // random engine. store context (ususally sm_connection_t)
231 static void * sm_random_context;
232 
233 // to receive hci events
234 static btstack_packet_callback_registration_t hci_event_callback_registration;
235 
236 /* to dispatch sm event */
237 static btstack_linked_list_t sm_event_handlers;
238 
239 // Software ECDH implementation provided by mbedtls
240 #ifdef USE_MBEDTLS_FOR_ECDH
241 static mbedtls_ecp_keypair le_keypair;
242 static ec_key_generation_state_t ec_key_generation_state;
243 #endif
244 
245 //
246 // Volume 3, Part H, Chapter 24
247 // "Security shall be initiated by the Security Manager in the device in the master role.
248 // The device in the slave role shall be the responding device."
249 // -> master := initiator, slave := responder
250 //
251 
252 // data needed for security setup
253 typedef struct sm_setup_context {
254 
255     btstack_timer_source_t sm_timeout;
256 
257     // used in all phases
258     uint8_t   sm_pairing_failed_reason;
259 
260     // user response, (Phase 1 and/or 2)
261     uint8_t   sm_user_response;
262 
263     // defines which keys will be send after connection is encrypted - calculated during Phase 1, used Phase 3
264     int       sm_key_distribution_send_set;
265     int       sm_key_distribution_received_set;
266 
267     // Phase 2 (Pairing over SMP)
268     stk_generation_method_t sm_stk_generation_method;
269     sm_key_t  sm_tk;
270     uint8_t   sm_use_secure_connections;
271 
272     sm_key_t  sm_c1_t3_value;   // c1 calculation
273     sm_pairing_packet_t sm_m_preq; // pairing request - needed only for c1
274     sm_pairing_packet_t sm_s_pres; // pairing response - needed only for c1
275     sm_key_t  sm_local_random;
276     sm_key_t  sm_local_confirm;
277     sm_key_t  sm_peer_random;
278     sm_key_t  sm_peer_confirm;
279     uint8_t   sm_m_addr_type;   // address and type can be removed
280     uint8_t   sm_s_addr_type;   //  ''
281     bd_addr_t sm_m_address;     //  ''
282     bd_addr_t sm_s_address;     //  ''
283     sm_key_t  sm_ltk;
284 
285 #ifdef ENABLE_LE_SECURE_CONNECTIONS
286     uint8_t   sm_peer_qx[32];   // also stores random for EC key generation during init
287     uint8_t   sm_peer_qy[32];   //  ''
288     sm_key_t  sm_peer_nonce;    // might be combined with sm_peer_random
289     sm_key_t  sm_local_nonce;   // might be combined with sm_local_random
290     sm_key_t  sm_peer_dhkey_check;
291     sm_key_t  sm_local_dhkey_check;
292     sm_key_t  sm_ra;
293     sm_key_t  sm_rb;
294     sm_key_t  sm_t;             // used for f5
295     sm_key_t  sm_mackey;
296     uint8_t   sm_passkey_bit;   // also stores number of generated random bytes for EC key generation
297     uint8_t   sm_state_vars;
298 #endif
299 
300     // Phase 3
301 
302     // key distribution, we generate
303     uint16_t  sm_local_y;
304     uint16_t  sm_local_div;
305     uint16_t  sm_local_ediv;
306     uint8_t   sm_local_rand[8];
307     sm_key_t  sm_local_ltk;
308     sm_key_t  sm_local_csrk;
309     sm_key_t  sm_local_irk;
310     // sm_local_address/addr_type not needed
311 
312     // key distribution, received from peer
313     uint16_t  sm_peer_y;
314     uint16_t  sm_peer_div;
315     uint16_t  sm_peer_ediv;
316     uint8_t   sm_peer_rand[8];
317     sm_key_t  sm_peer_ltk;
318     sm_key_t  sm_peer_irk;
319     sm_key_t  sm_peer_csrk;
320     uint8_t   sm_peer_addr_type;
321     bd_addr_t sm_peer_address;
322 
323 } sm_setup_context_t;
324 
325 //
326 static sm_setup_context_t the_setup;
327 static sm_setup_context_t * setup = &the_setup;
328 
329 // active connection - the one for which the_setup is used for
330 static uint16_t sm_active_connection = 0;
331 
332 // @returns 1 if oob data is available
333 // stores oob data in provided 16 byte buffer if not null
334 static int (*sm_get_oob_data)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data) = NULL;
335 
336 // used to notify applicationss that user interaction is neccessary, see sm_notify_t below
337 static btstack_packet_handler_t sm_client_packet_handler = NULL;
338 
339 // horizontal: initiator capabilities
340 // vertial:    responder capabilities
341 static const stk_generation_method_t stk_generation_method [5] [5] = {
342     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
343     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
344     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
345     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
346     { PK_RESP_INPUT,   PK_RESP_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
347 };
348 
349 // uses numeric comparison if one side has DisplayYesNo and KeyboardDisplay combinations
350 #ifdef ENABLE_LE_SECURE_CONNECTIONS
351 static const stk_generation_method_t stk_generation_method_with_secure_connection[5][5] = {
352     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
353     { JUST_WORKS,      NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
354     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
355     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
356     { PK_RESP_INPUT,   NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
357 };
358 #endif
359 
360 static void sm_run(void);
361 static void sm_done_for_handle(hci_con_handle_t con_handle);
362 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle);
363 static inline int sm_calc_actual_encryption_key_size(int other);
364 static int sm_validate_stk_generation_method(void);
365 static void sm_shift_left_by_one_bit_inplace(int len, uint8_t * data);
366 
367 static void log_info_hex16(const char * name, uint16_t value){
368     log_info("%-6s 0x%04x", name, value);
369 }
370 
371 // @returns 1 if all bytes are 0
372 static int sm_is_null_random(uint8_t random[8]){
373     int i;
374     for (i=0; i < 8 ; i++){
375         if (random[i]) return 0;
376     }
377     return 1;
378 }
379 
380 // Key utils
381 static void sm_reset_tk(void){
382     int i;
383     for (i=0;i<16;i++){
384         setup->sm_tk[i] = 0;
385     }
386 }
387 
388 // "For example, if a 128-bit encryption key is 0x123456789ABCDEF0123456789ABCDEF0
389 // and it is reduced to 7 octets (56 bits), then the resulting key is 0x0000000000000000003456789ABCDEF0.""
390 static void sm_truncate_key(sm_key_t key, int max_encryption_size){
391     int i;
392     for (i = max_encryption_size ; i < 16 ; i++){
393         key[15-i] = 0;
394     }
395 }
396 
397 // SMP Timeout implementation
398 
399 // Upon transmission of the Pairing Request command or reception of the Pairing Request command,
400 // the Security Manager Timer shall be reset and started.
401 //
402 // The Security Manager Timer shall be reset when an L2CAP SMP command is queued for transmission.
403 //
404 // If the Security Manager Timer reaches 30 seconds, the procedure shall be considered to have failed,
405 // and the local higher layer shall be notified. No further SMP commands shall be sent over the L2CAP
406 // Security Manager Channel. A new SM procedure shall only be performed when a new physical link has been
407 // established.
408 
409 static void sm_timeout_handler(btstack_timer_source_t * timer){
410     log_info("SM timeout");
411     sm_connection_t * sm_conn = (sm_connection_t*) btstack_run_loop_get_timer_context(timer);
412     sm_conn->sm_engine_state = SM_GENERAL_TIMEOUT;
413     sm_done_for_handle(sm_conn->sm_handle);
414 
415     // trigger handling of next ready connection
416     sm_run();
417 }
418 static void sm_timeout_start(sm_connection_t * sm_conn){
419     btstack_run_loop_remove_timer(&setup->sm_timeout);
420     btstack_run_loop_set_timer_context(&setup->sm_timeout, sm_conn);
421     btstack_run_loop_set_timer_handler(&setup->sm_timeout, sm_timeout_handler);
422     btstack_run_loop_set_timer(&setup->sm_timeout, 30000); // 30 seconds sm timeout
423     btstack_run_loop_add_timer(&setup->sm_timeout);
424 }
425 static void sm_timeout_stop(void){
426     btstack_run_loop_remove_timer(&setup->sm_timeout);
427 }
428 static void sm_timeout_reset(sm_connection_t * sm_conn){
429     sm_timeout_stop();
430     sm_timeout_start(sm_conn);
431 }
432 
433 // end of sm timeout
434 
435 // GAP Random Address updates
436 static gap_random_address_type_t gap_random_adress_type;
437 static btstack_timer_source_t gap_random_address_update_timer;
438 static uint32_t gap_random_adress_update_period;
439 
440 static void gap_random_address_trigger(void){
441     if (rau_state != RAU_IDLE) return;
442     log_info("gap_random_address_trigger");
443     rau_state = RAU_GET_RANDOM;
444     sm_run();
445 }
446 
447 static void gap_random_address_update_handler(btstack_timer_source_t * timer){
448     log_info("GAP Random Address Update due");
449     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
450     btstack_run_loop_add_timer(&gap_random_address_update_timer);
451     gap_random_address_trigger();
452 }
453 
454 static void gap_random_address_update_start(void){
455     btstack_run_loop_set_timer_handler(&gap_random_address_update_timer, gap_random_address_update_handler);
456     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
457     btstack_run_loop_add_timer(&gap_random_address_update_timer);
458 }
459 
460 static void gap_random_address_update_stop(void){
461     btstack_run_loop_remove_timer(&gap_random_address_update_timer);
462 }
463 
464 
465 static void sm_random_start(void * context){
466     sm_random_context = context;
467     hci_send_cmd(&hci_le_rand);
468 }
469 
470 // pre: sm_aes128_state != SM_AES128_ACTIVE, hci_can_send_command == 1
471 // context is made availabe to aes128 result handler by this
472 static void sm_aes128_start(sm_key_t key, sm_key_t plaintext, void * context){
473     sm_aes128_state = SM_AES128_ACTIVE;
474     sm_key_t key_flipped, plaintext_flipped;
475     reverse_128(key, key_flipped);
476     reverse_128(plaintext, plaintext_flipped);
477     sm_aes128_context = context;
478     hci_send_cmd(&hci_le_encrypt, key_flipped, plaintext_flipped);
479 }
480 
481 // ah(k,r) helper
482 // r = padding || r
483 // r - 24 bit value
484 static void sm_ah_r_prime(uint8_t r[3], sm_key_t r_prime){
485     // r'= padding || r
486     memset(r_prime, 0, 16);
487     memcpy(&r_prime[13], r, 3);
488 }
489 
490 // d1 helper
491 // d' = padding || r || d
492 // d,r - 16 bit values
493 static void sm_d1_d_prime(uint16_t d, uint16_t r, sm_key_t d1_prime){
494     // d'= padding || r || d
495     memset(d1_prime, 0, 16);
496     big_endian_store_16(d1_prime, 12, r);
497     big_endian_store_16(d1_prime, 14, d);
498 }
499 
500 // dm helper
501 // r’ = padding || r
502 // r - 64 bit value
503 static void sm_dm_r_prime(uint8_t r[8], sm_key_t r_prime){
504     memset(r_prime, 0, 16);
505     memcpy(&r_prime[8], r, 8);
506 }
507 
508 // calculate arguments for first AES128 operation in C1 function
509 static void sm_c1_t1(sm_key_t r, uint8_t preq[7], uint8_t pres[7], uint8_t iat, uint8_t rat, sm_key_t t1){
510 
511     // p1 = pres || preq || rat’ || iat’
512     // "The octet of iat’ becomes the least significant octet of p1 and the most signifi-
513     // cant octet of pres becomes the most significant octet of p1.
514     // For example, if the 8-bit iat’ is 0x01, the 8-bit rat’ is 0x00, the 56-bit preq
515     // is 0x07071000000101 and the 56 bit pres is 0x05000800000302 then
516     // p1 is 0x05000800000302070710000001010001."
517 
518     sm_key_t p1;
519     reverse_56(pres, &p1[0]);
520     reverse_56(preq, &p1[7]);
521     p1[14] = rat;
522     p1[15] = iat;
523     log_info_key("p1", p1);
524     log_info_key("r", r);
525 
526     // t1 = r xor p1
527     int i;
528     for (i=0;i<16;i++){
529         t1[i] = r[i] ^ p1[i];
530     }
531     log_info_key("t1", t1);
532 }
533 
534 // calculate arguments for second AES128 operation in C1 function
535 static void sm_c1_t3(sm_key_t t2, bd_addr_t ia, bd_addr_t ra, sm_key_t t3){
536      // p2 = padding || ia || ra
537     // "The least significant octet of ra becomes the least significant octet of p2 and
538     // the most significant octet of padding becomes the most significant octet of p2.
539     // For example, if 48-bit ia is 0xA1A2A3A4A5A6 and the 48-bit ra is
540     // 0xB1B2B3B4B5B6 then p2 is 0x00000000A1A2A3A4A5A6B1B2B3B4B5B6.
541 
542     sm_key_t p2;
543     memset(p2, 0, 16);
544     memcpy(&p2[4],  ia, 6);
545     memcpy(&p2[10], ra, 6);
546     log_info_key("p2", p2);
547 
548     // c1 = e(k, t2_xor_p2)
549     int i;
550     for (i=0;i<16;i++){
551         t3[i] = t2[i] ^ p2[i];
552     }
553     log_info_key("t3", t3);
554 }
555 
556 static void sm_s1_r_prime(sm_key_t r1, sm_key_t r2, sm_key_t r_prime){
557     log_info_key("r1", r1);
558     log_info_key("r2", r2);
559     memcpy(&r_prime[8], &r2[8], 8);
560     memcpy(&r_prime[0], &r1[8], 8);
561 }
562 
563 #ifdef ENABLE_LE_SECURE_CONNECTIONS
564 // Software implementations of crypto toolbox for LE Secure Connection
565 // TODO: replace with code to use AES Engine of HCI Controller
566 typedef uint8_t sm_key24_t[3];
567 typedef uint8_t sm_key56_t[7];
568 typedef uint8_t sm_key256_t[32];
569 
570 #if 0
571 static void aes128_calc_cyphertext(const uint8_t key[16], const uint8_t plaintext[16], uint8_t cyphertext[16]){
572     uint32_t rk[RKLENGTH(KEYBITS)];
573     int nrounds = rijndaelSetupEncrypt(rk, &key[0], KEYBITS);
574     rijndaelEncrypt(rk, nrounds, plaintext, cyphertext);
575 }
576 
577 static void calc_subkeys(sm_key_t k0, sm_key_t k1, sm_key_t k2){
578     memcpy(k1, k0, 16);
579     sm_shift_left_by_one_bit_inplace(16, k1);
580     if (k0[0] & 0x80){
581         k1[15] ^= 0x87;
582     }
583     memcpy(k2, k1, 16);
584     sm_shift_left_by_one_bit_inplace(16, k2);
585     if (k1[0] & 0x80){
586         k2[15] ^= 0x87;
587     }
588 }
589 
590 static void aes_cmac(sm_key_t aes_cmac, const sm_key_t key, const uint8_t * data, int cmac_message_len){
591     sm_key_t k0, k1, k2, zero;
592     memset(zero, 0, 16);
593 
594     aes128_calc_cyphertext(key, zero, k0);
595     calc_subkeys(k0, k1, k2);
596 
597     int cmac_block_count = (cmac_message_len + 15) / 16;
598 
599     // step 3: ..
600     if (cmac_block_count==0){
601         cmac_block_count = 1;
602     }
603 
604     // step 4: set m_last
605     sm_key_t cmac_m_last;
606     int sm_cmac_last_block_complete = cmac_message_len != 0 && (cmac_message_len & 0x0f) == 0;
607     int i;
608     if (sm_cmac_last_block_complete){
609         for (i=0;i<16;i++){
610             cmac_m_last[i] = data[cmac_message_len - 16 + i] ^ k1[i];
611         }
612     } else {
613         int valid_octets_in_last_block = cmac_message_len & 0x0f;
614         for (i=0;i<16;i++){
615             if (i < valid_octets_in_last_block){
616                 cmac_m_last[i] = data[(cmac_message_len & 0xfff0) + i] ^ k2[i];
617                 continue;
618             }
619             if (i == valid_octets_in_last_block){
620                 cmac_m_last[i] = 0x80 ^ k2[i];
621                 continue;
622             }
623             cmac_m_last[i] = k2[i];
624         }
625     }
626 
627     // printf("sm_cmac_start: len %u, block count %u\n", cmac_message_len, cmac_block_count);
628     // LOG_KEY(cmac_m_last);
629 
630     // Step 5
631     sm_key_t cmac_x;
632     memset(cmac_x, 0, 16);
633 
634     // Step 6
635     sm_key_t sm_cmac_y;
636     for (int block = 0 ; block < cmac_block_count-1 ; block++){
637         for (i=0;i<16;i++){
638             sm_cmac_y[i] = cmac_x[i] ^ data[block * 16 + i];
639         }
640         aes128_calc_cyphertext(key, sm_cmac_y, cmac_x);
641     }
642     for (i=0;i<16;i++){
643         sm_cmac_y[i] = cmac_x[i] ^ cmac_m_last[i];
644     }
645 
646     // Step 7
647     aes128_calc_cyphertext(key, sm_cmac_y, aes_cmac);
648 }
649 #endif
650 
651 #if 0
652 //
653 // Link Key Conversion Function h6
654 //
655 // h6(W, keyID) = AES-CMACW(keyID)
656 // - W is 128 bits
657 // - keyID is 32 bits
658 static void h6(sm_key_t res, const sm_key_t w, const uint32_t key_id){
659     uint8_t key_id_buffer[4];
660     big_endian_store_32(key_id_buffer, 0, key_id);
661     aes_cmac(res, w, key_id_buffer, 4);
662 }
663 #endif
664 #endif
665 
666 static void sm_setup_event_base(uint8_t * event, int event_size, uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
667     event[0] = type;
668     event[1] = event_size - 2;
669     little_endian_store_16(event, 2, con_handle);
670     event[4] = addr_type;
671     reverse_bd_addr(address, &event[5]);
672 }
673 
674 static void sm_dispatch_event(uint8_t packet_type, uint16_t channel, uint8_t * packet, uint16_t size){
675     if (sm_client_packet_handler) {
676         sm_client_packet_handler(HCI_EVENT_PACKET, 0, packet, size);
677     }
678     // dispatch to all event handlers
679     btstack_linked_list_iterator_t it;
680     btstack_linked_list_iterator_init(&it, &sm_event_handlers);
681     while (btstack_linked_list_iterator_has_next(&it)){
682         btstack_packet_callback_registration_t * entry = (btstack_packet_callback_registration_t*) btstack_linked_list_iterator_next(&it);
683         entry->callback(packet_type, 0, packet, size);
684     }
685 }
686 
687 static void sm_notify_client_base(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
688     uint8_t event[11];
689     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
690     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
691 }
692 
693 static void sm_notify_client_passkey(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint32_t passkey){
694     uint8_t event[15];
695     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
696     little_endian_store_32(event, 11, passkey);
697     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
698 }
699 
700 static void sm_notify_client_index(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint16_t index){
701     uint8_t event[13];
702     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
703     little_endian_store_16(event, 11, index);
704     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
705 }
706 
707 static void sm_notify_client_authorization(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint8_t result){
708 
709     uint8_t event[18];
710     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
711     event[11] = result;
712     sm_dispatch_event(HCI_EVENT_PACKET, 0, (uint8_t*) &event, sizeof(event));
713 }
714 
715 // decide on stk generation based on
716 // - pairing request
717 // - io capabilities
718 // - OOB data availability
719 static void sm_setup_tk(void){
720 
721     // default: just works
722     setup->sm_stk_generation_method = JUST_WORKS;
723 
724 #ifdef ENABLE_LE_SECURE_CONNECTIONS
725     setup->sm_use_secure_connections = ( sm_pairing_packet_get_auth_req(setup->sm_m_preq)
726                                        & sm_pairing_packet_get_auth_req(setup->sm_s_pres)
727                                        & SM_AUTHREQ_SECURE_CONNECTION ) != 0;
728     memset(setup->sm_ra, 0, 16);
729     memset(setup->sm_rb, 0, 16);
730 #else
731     setup->sm_use_secure_connections = 0;
732 #endif
733 
734     // If both devices have not set the MITM option in the Authentication Requirements
735     // Flags, then the IO capabilities shall be ignored and the Just Works association
736     // model shall be used.
737     if (((sm_pairing_packet_get_auth_req(setup->sm_m_preq) & SM_AUTHREQ_MITM_PROTECTION) == 0)
738     &&  ((sm_pairing_packet_get_auth_req(setup->sm_s_pres) & SM_AUTHREQ_MITM_PROTECTION) == 0)){
739         log_info("SM: MITM not required by both -> JUST WORKS");
740         return;
741     }
742 
743     // TODO: with LE SC, OOB is used to transfer data OOB during pairing, single device with OOB is sufficient
744 
745     // If both devices have out of band authentication data, then the Authentication
746     // Requirements Flags shall be ignored when selecting the pairing method and the
747     // Out of Band pairing method shall be used.
748     if (sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq)
749     &&  sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres)){
750         log_info("SM: have OOB data");
751         log_info_key("OOB", setup->sm_tk);
752         setup->sm_stk_generation_method = OOB;
753         return;
754     }
755 
756     // Reset TK as it has been setup in sm_init_setup
757     sm_reset_tk();
758 
759     // Also use just works if unknown io capabilites
760     if ((sm_pairing_packet_get_io_capability(setup->sm_m_preq) > IO_CAPABILITY_KEYBOARD_DISPLAY) || (sm_pairing_packet_get_io_capability(setup->sm_s_pres) > IO_CAPABILITY_KEYBOARD_DISPLAY)){
761         return;
762     }
763 
764     // Otherwise the IO capabilities of the devices shall be used to determine the
765     // pairing method as defined in Table 2.4.
766     // see http://stackoverflow.com/a/1052837/393697 for how to specify pointer to 2-dimensional array
767     const stk_generation_method_t (*generation_method)[5] = stk_generation_method;
768 
769 #ifdef ENABLE_LE_SECURE_CONNECTIONS
770     // table not define by default
771     if (setup->sm_use_secure_connections){
772         generation_method = stk_generation_method_with_secure_connection;
773     }
774 #endif
775     setup->sm_stk_generation_method = generation_method[sm_pairing_packet_get_io_capability(setup->sm_s_pres)][sm_pairing_packet_get_io_capability(setup->sm_m_preq)];
776 
777     log_info("sm_setup_tk: master io cap: %u, slave io cap: %u -> method %u",
778         sm_pairing_packet_get_io_capability(setup->sm_m_preq), sm_pairing_packet_get_io_capability(setup->sm_s_pres), setup->sm_stk_generation_method);
779 }
780 
781 static int sm_key_distribution_flags_for_set(uint8_t key_set){
782     int flags = 0;
783     if (key_set & SM_KEYDIST_ENC_KEY){
784         flags |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
785         flags |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
786     }
787     if (key_set & SM_KEYDIST_ID_KEY){
788         flags |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
789         flags |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
790     }
791     if (key_set & SM_KEYDIST_SIGN){
792         flags |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
793     }
794     return flags;
795 }
796 
797 static void sm_setup_key_distribution(uint8_t key_set){
798     setup->sm_key_distribution_received_set = 0;
799     setup->sm_key_distribution_send_set = sm_key_distribution_flags_for_set(key_set);
800 }
801 
802 // CSRK Key Lookup
803 
804 
805 static int sm_address_resolution_idle(void){
806     return sm_address_resolution_mode == ADDRESS_RESOLUTION_IDLE;
807 }
808 
809 static void sm_address_resolution_start_lookup(uint8_t addr_type, hci_con_handle_t con_handle, bd_addr_t addr, address_resolution_mode_t mode, void * context){
810     memcpy(sm_address_resolution_address, addr, 6);
811     sm_address_resolution_addr_type = addr_type;
812     sm_address_resolution_test = 0;
813     sm_address_resolution_mode = mode;
814     sm_address_resolution_context = context;
815     sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_STARTED, con_handle, addr_type, addr);
816 }
817 
818 int sm_address_resolution_lookup(uint8_t address_type, bd_addr_t address){
819     // check if already in list
820     btstack_linked_list_iterator_t it;
821     sm_lookup_entry_t * entry;
822     btstack_linked_list_iterator_init(&it, &sm_address_resolution_general_queue);
823     while(btstack_linked_list_iterator_has_next(&it)){
824         entry = (sm_lookup_entry_t *) btstack_linked_list_iterator_next(&it);
825         if (entry->address_type != address_type) continue;
826         if (memcmp(entry->address, address, 6))  continue;
827         // already in list
828         return BTSTACK_BUSY;
829     }
830     entry = btstack_memory_sm_lookup_entry_get();
831     if (!entry) return BTSTACK_MEMORY_ALLOC_FAILED;
832     entry->address_type = (bd_addr_type_t) address_type;
833     memcpy(entry->address, address, 6);
834     btstack_linked_list_add(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
835     sm_run();
836     return 0;
837 }
838 
839 // CMAC Implementation using AES128 engine
840 static void sm_shift_left_by_one_bit_inplace(int len, uint8_t * data){
841     int i;
842     int carry = 0;
843     for (i=len-1; i >= 0 ; i--){
844         int new_carry = data[i] >> 7;
845         data[i] = data[i] << 1 | carry;
846         carry = new_carry;
847     }
848 }
849 
850 // while x_state++ for an enum is possible in C, it isn't in C++. we use this helpers to avoid compile errors for now
851 static inline void sm_next_responding_state(sm_connection_t * sm_conn){
852     sm_conn->sm_engine_state = (security_manager_state_t) (((int)sm_conn->sm_engine_state) + 1);
853 }
854 static inline void dkg_next_state(void){
855     dkg_state = (derived_key_generation_t) (((int)dkg_state) + 1);
856 }
857 static inline void rau_next_state(void){
858     rau_state = (random_address_update_t) (((int)rau_state) + 1);
859 }
860 
861 // CMAC calculation using AES Engine
862 
863 static inline void sm_cmac_next_state(void){
864     sm_cmac_state = (cmac_state_t) (((int)sm_cmac_state) + 1);
865 }
866 
867 static int sm_cmac_last_block_complete(void){
868     if (sm_cmac_message_len == 0) return 0;
869     return (sm_cmac_message_len & 0x0f) == 0;
870 }
871 
872 static inline uint8_t sm_cmac_message_get_byte(uint16_t offset){
873     if (offset >= sm_cmac_message_len) {
874         log_error("sm_cmac_message_get_byte. out of bounds, access %u, len %u", offset, sm_cmac_message_len);
875         return 0;
876     }
877 
878     offset = sm_cmac_message_len - 1 - offset;
879 
880     // sm_cmac_header[3] | message[] | sm_cmac_sign_counter[4]
881     if (offset < 3){
882         return sm_cmac_header[offset];
883     }
884     int actual_message_len_incl_header = sm_cmac_message_len - 4;
885     if (offset <  actual_message_len_incl_header){
886         return sm_cmac_message[offset - 3];
887     }
888     return sm_cmac_sign_counter[offset - actual_message_len_incl_header];
889 }
890 
891 // generic cmac calculation
892 void sm_cmac_general_start(const sm_key_t key, uint16_t message_len, uint8_t (*get_byte_callback)(uint16_t offset), void (*done_callback)(uint8_t hash[8])){
893     // Generalized CMAC
894     memcpy(sm_cmac_k, key, 16);
895     memset(sm_cmac_x, 0, 16);
896     sm_cmac_block_current = 0;
897     sm_cmac_message_len  = message_len;
898     sm_cmac_done_handler = done_callback;
899     sm_cmac_get_byte     = get_byte_callback;
900 
901     // step 2: n := ceil(len/const_Bsize);
902     sm_cmac_block_count = (sm_cmac_message_len + 15) / 16;
903 
904     // step 3: ..
905     if (sm_cmac_block_count==0){
906         sm_cmac_block_count = 1;
907     }
908     log_info("sm_cmac_connection %p", sm_cmac_connection);
909     log_info("sm_cmac_general_start: len %u, block count %u", sm_cmac_message_len, sm_cmac_block_count);
910 
911     // first, we need to compute l for k1, k2, and m_last
912     sm_cmac_state = CMAC_CALC_SUBKEYS;
913 
914     // let's go
915     sm_run();
916 }
917 
918 // cmac for ATT Message signing
919 void sm_cmac_start(const sm_key_t k, uint8_t opcode, hci_con_handle_t con_handle, uint16_t message_len, const uint8_t * message, uint32_t sign_counter, void (*done_handler)(uint8_t * hash)){
920     // ATT Message Signing
921     sm_cmac_header[0] = opcode;
922     little_endian_store_16(sm_cmac_header, 1, con_handle);
923     little_endian_store_32(sm_cmac_sign_counter, 0, sign_counter);
924     uint16_t total_message_len = 3 + message_len + 4;  // incl. virtually prepended att opcode, handle and appended sign_counter in LE
925     sm_cmac_message = message;
926     sm_cmac_general_start(k, total_message_len, &sm_cmac_message_get_byte, done_handler);
927 }
928 
929 int sm_cmac_ready(void){
930     return sm_cmac_state == CMAC_IDLE;
931 }
932 
933 static void sm_cmac_handle_aes_engine_ready(void){
934     switch (sm_cmac_state){
935         case CMAC_CALC_SUBKEYS: {
936             sm_key_t const_zero;
937             memset(const_zero, 0, 16);
938             sm_cmac_next_state();
939             sm_aes128_start(sm_cmac_k, const_zero, NULL);
940             break;
941         }
942         case CMAC_CALC_MI: {
943             int j;
944             sm_key_t y;
945             for (j=0;j<16;j++){
946                 y[j] = sm_cmac_x[j] ^ sm_cmac_get_byte(sm_cmac_block_current*16 + j);
947             }
948             sm_cmac_block_current++;
949             sm_cmac_next_state();
950             sm_aes128_start(sm_cmac_k, y, NULL);
951             break;
952         }
953         case CMAC_CALC_MLAST: {
954             int i;
955             sm_key_t y;
956             for (i=0;i<16;i++){
957                 y[i] = sm_cmac_x[i] ^ sm_cmac_m_last[i];
958             }
959             log_info_key("Y", y);
960             sm_cmac_block_current++;
961             sm_cmac_next_state();
962             sm_aes128_start(sm_cmac_k, y, NULL);
963             break;
964         }
965         default:
966             log_info("sm_cmac_handle_aes_engine_ready called in state %u", sm_cmac_state);
967             break;
968     }
969 }
970 
971 static void sm_cmac_handle_encryption_result(sm_key_t data){
972     switch (sm_cmac_state){
973         case CMAC_W4_SUBKEYS: {
974             sm_key_t k1;
975             memcpy(k1, data, 16);
976             sm_shift_left_by_one_bit_inplace(16, k1);
977             if (data[0] & 0x80){
978                 k1[15] ^= 0x87;
979             }
980             sm_key_t k2;
981             memcpy(k2, k1, 16);
982             sm_shift_left_by_one_bit_inplace(16, k2);
983             if (k1[0] & 0x80){
984                 k2[15] ^= 0x87;
985             }
986 
987             log_info_key("k", sm_cmac_k);
988             log_info_key("k1", k1);
989             log_info_key("k2", k2);
990 
991             // step 4: set m_last
992             int i;
993             if (sm_cmac_last_block_complete()){
994                 for (i=0;i<16;i++){
995                     sm_cmac_m_last[i] = sm_cmac_get_byte(sm_cmac_message_len - 16 + i) ^ k1[i];
996                 }
997             } else {
998                 int valid_octets_in_last_block = sm_cmac_message_len & 0x0f;
999                 for (i=0;i<16;i++){
1000                     if (i < valid_octets_in_last_block){
1001                         sm_cmac_m_last[i] = sm_cmac_get_byte((sm_cmac_message_len & 0xfff0) + i) ^ k2[i];
1002                         continue;
1003                     }
1004                     if (i == valid_octets_in_last_block){
1005                         sm_cmac_m_last[i] = 0x80 ^ k2[i];
1006                         continue;
1007                     }
1008                     sm_cmac_m_last[i] = k2[i];
1009                 }
1010             }
1011 
1012             // next
1013             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
1014             break;
1015         }
1016         case CMAC_W4_MI:
1017             memcpy(sm_cmac_x, data, 16);
1018             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
1019             break;
1020         case CMAC_W4_MLAST:
1021             // done
1022             log_info("Setting CMAC Engine to IDLE");
1023             sm_cmac_state = CMAC_IDLE;
1024             log_info_key("CMAC", data);
1025             sm_cmac_done_handler(data);
1026             break;
1027         default:
1028             log_info("sm_cmac_handle_encryption_result called in state %u", sm_cmac_state);
1029             break;
1030     }
1031 }
1032 
1033 static void sm_trigger_user_response(sm_connection_t * sm_conn){
1034     // notify client for: JUST WORKS confirm, Numeric comparison confirm, PASSKEY display or input
1035     setup->sm_user_response = SM_USER_RESPONSE_IDLE;
1036     switch (setup->sm_stk_generation_method){
1037         case PK_RESP_INPUT:
1038             if (sm_conn->sm_role){
1039                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1040                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1041             } else {
1042                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1043             }
1044             break;
1045         case PK_INIT_INPUT:
1046             if (sm_conn->sm_role){
1047                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1048             } else {
1049                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1050                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1051             }
1052             break;
1053         case OK_BOTH_INPUT:
1054             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1055             sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1056             break;
1057         case NK_BOTH_INPUT:
1058             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1059             sm_notify_client_passkey(SM_EVENT_NUMERIC_COMPARISON_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1060             break;
1061         case JUST_WORKS:
1062             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1063             sm_notify_client_base(SM_EVENT_JUST_WORKS_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1064             break;
1065         case OOB:
1066             // client already provided OOB data, let's skip notification.
1067             break;
1068     }
1069 }
1070 
1071 static int sm_key_distribution_all_received(sm_connection_t * sm_conn){
1072     int recv_flags;
1073     if (sm_conn->sm_role){
1074         // slave / responder
1075         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres));
1076     } else {
1077         // master / initiator
1078         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
1079     }
1080     log_debug("sm_key_distribution_all_received: received 0x%02x, expecting 0x%02x", setup->sm_key_distribution_received_set, recv_flags);
1081     return recv_flags == setup->sm_key_distribution_received_set;
1082 }
1083 
1084 static void sm_done_for_handle(hci_con_handle_t con_handle){
1085     if (sm_active_connection == con_handle){
1086         sm_timeout_stop();
1087         sm_active_connection = 0;
1088         log_info("sm: connection 0x%x released setup context", con_handle);
1089     }
1090 }
1091 
1092 static int sm_key_distribution_flags_for_auth_req(void){
1093     int flags = SM_KEYDIST_ID_KEY | SM_KEYDIST_SIGN;
1094     if (sm_auth_req & SM_AUTHREQ_BONDING){
1095         // encryption information only if bonding requested
1096         flags |= SM_KEYDIST_ENC_KEY;
1097     }
1098     return flags;
1099 }
1100 
1101 static void sm_init_setup(sm_connection_t * sm_conn){
1102 
1103     // fill in sm setup
1104     setup->sm_state_vars = 0;
1105     sm_reset_tk();
1106     setup->sm_peer_addr_type = sm_conn->sm_peer_addr_type;
1107     memcpy(setup->sm_peer_address, sm_conn->sm_peer_address, 6);
1108 
1109     // query client for OOB data
1110     int have_oob_data = 0;
1111     if (sm_get_oob_data) {
1112         have_oob_data = (*sm_get_oob_data)(sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, setup->sm_tk);
1113     }
1114 
1115     sm_pairing_packet_t * local_packet;
1116     if (sm_conn->sm_role){
1117         // slave
1118         local_packet = &setup->sm_s_pres;
1119         gap_advertisements_get_address(&setup->sm_s_addr_type, setup->sm_s_address);
1120         setup->sm_m_addr_type = sm_conn->sm_peer_addr_type;
1121         memcpy(setup->sm_m_address, sm_conn->sm_peer_address, 6);
1122     } else {
1123         // master
1124         local_packet = &setup->sm_m_preq;
1125         gap_advertisements_get_address(&setup->sm_m_addr_type, setup->sm_m_address);
1126         setup->sm_s_addr_type = sm_conn->sm_peer_addr_type;
1127         memcpy(setup->sm_s_address, sm_conn->sm_peer_address, 6);
1128 
1129         int key_distribution_flags = sm_key_distribution_flags_for_auth_req();
1130         sm_pairing_packet_set_initiator_key_distribution(setup->sm_m_preq, key_distribution_flags);
1131         sm_pairing_packet_set_responder_key_distribution(setup->sm_m_preq, key_distribution_flags);
1132     }
1133 
1134     sm_pairing_packet_set_io_capability(*local_packet, sm_io_capabilities);
1135     sm_pairing_packet_set_oob_data_flag(*local_packet, have_oob_data);
1136     sm_pairing_packet_set_auth_req(*local_packet, sm_auth_req);
1137     sm_pairing_packet_set_max_encryption_key_size(*local_packet, sm_max_encryption_key_size);
1138 }
1139 
1140 static int sm_stk_generation_init(sm_connection_t * sm_conn){
1141 
1142     sm_pairing_packet_t * remote_packet;
1143     int                   remote_key_request;
1144     if (sm_conn->sm_role){
1145         // slave / responder
1146         remote_packet      = &setup->sm_m_preq;
1147         remote_key_request = sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq);
1148     } else {
1149         // master / initiator
1150         remote_packet      = &setup->sm_s_pres;
1151         remote_key_request = sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres);
1152     }
1153 
1154     // check key size
1155     sm_conn->sm_actual_encryption_key_size = sm_calc_actual_encryption_key_size(sm_pairing_packet_get_max_encryption_key_size(*remote_packet));
1156     if (sm_conn->sm_actual_encryption_key_size == 0) return SM_REASON_ENCRYPTION_KEY_SIZE;
1157 
1158     // decide on STK generation method
1159     sm_setup_tk();
1160     log_info("SMP: generation method %u", setup->sm_stk_generation_method);
1161 
1162     // check if STK generation method is acceptable by client
1163     if (!sm_validate_stk_generation_method()) return SM_REASON_AUTHENTHICATION_REQUIREMENTS;
1164 
1165     // identical to responder
1166     sm_setup_key_distribution(remote_key_request);
1167 
1168     // JUST WORKS doens't provide authentication
1169     sm_conn->sm_connection_authenticated = setup->sm_stk_generation_method == JUST_WORKS ? 0 : 1;
1170 
1171     return 0;
1172 }
1173 
1174 static void sm_address_resolution_handle_event(address_resolution_event_t event){
1175 
1176     // cache and reset context
1177     int matched_device_id = sm_address_resolution_test;
1178     address_resolution_mode_t mode = sm_address_resolution_mode;
1179     void * context = sm_address_resolution_context;
1180 
1181     // reset context
1182     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
1183     sm_address_resolution_context = NULL;
1184     sm_address_resolution_test = -1;
1185     hci_con_handle_t con_handle = 0;
1186 
1187     sm_connection_t * sm_connection;
1188     uint16_t ediv;
1189     switch (mode){
1190         case ADDRESS_RESOLUTION_GENERAL:
1191             break;
1192         case ADDRESS_RESOLUTION_FOR_CONNECTION:
1193             sm_connection = (sm_connection_t *) context;
1194             con_handle = sm_connection->sm_handle;
1195             switch (event){
1196                 case ADDRESS_RESOLUTION_SUCEEDED:
1197                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_SUCCEEDED;
1198                     sm_connection->sm_le_db_index = matched_device_id;
1199                     log_info("ADDRESS_RESOLUTION_SUCEEDED, index %d", sm_connection->sm_le_db_index);
1200                     if (sm_connection->sm_role) break;
1201                     if (!sm_connection->sm_bonding_requested && !sm_connection->sm_security_request_received) break;
1202                     sm_connection->sm_security_request_received = 0;
1203                     sm_connection->sm_bonding_requested = 0;
1204                     le_device_db_encryption_get(sm_connection->sm_le_db_index, &ediv, NULL, NULL, NULL, NULL, NULL);
1205                     if (ediv){
1206                         sm_connection->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
1207                     } else {
1208                         sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1209                     }
1210                     break;
1211                 case ADDRESS_RESOLUTION_FAILED:
1212                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_FAILED;
1213                     if (sm_connection->sm_role) break;
1214                     if (!sm_connection->sm_bonding_requested && !sm_connection->sm_security_request_received) break;
1215                     sm_connection->sm_security_request_received = 0;
1216                     sm_connection->sm_bonding_requested = 0;
1217                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1218                     break;
1219             }
1220             break;
1221         default:
1222             break;
1223     }
1224 
1225     switch (event){
1226         case ADDRESS_RESOLUTION_SUCEEDED:
1227             sm_notify_client_index(SM_EVENT_IDENTITY_RESOLVING_SUCCEEDED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address, matched_device_id);
1228             break;
1229         case ADDRESS_RESOLUTION_FAILED:
1230             sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_FAILED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address);
1231             break;
1232     }
1233 }
1234 
1235 static void sm_key_distribution_handle_all_received(sm_connection_t * sm_conn){
1236 
1237     int le_db_index = -1;
1238 
1239     // lookup device based on IRK
1240     if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
1241         int i;
1242         for (i=0; i < le_device_db_count(); i++){
1243             sm_key_t irk;
1244             bd_addr_t address;
1245             int address_type;
1246             le_device_db_info(i, &address_type, address, irk);
1247             if (memcmp(irk, setup->sm_peer_irk, 16) == 0){
1248                 log_info("sm: device found for IRK, updating");
1249                 le_db_index = i;
1250                 break;
1251             }
1252         }
1253     }
1254 
1255     // if not found, lookup via public address if possible
1256     log_info("sm peer addr type %u, peer addres %s", setup->sm_peer_addr_type, bd_addr_to_str(setup->sm_peer_address));
1257     if (le_db_index < 0 && setup->sm_peer_addr_type == BD_ADDR_TYPE_LE_PUBLIC){
1258         int i;
1259         for (i=0; i < le_device_db_count(); i++){
1260             bd_addr_t address;
1261             int address_type;
1262             le_device_db_info(i, &address_type, address, NULL);
1263             log_info("device %u, sm peer addr type %u, peer addres %s", i, address_type, bd_addr_to_str(address));
1264             if (address_type == BD_ADDR_TYPE_LE_PUBLIC && memcmp(address, setup->sm_peer_address, 6) == 0){
1265                 log_info("sm: device found for public address, updating");
1266                 le_db_index = i;
1267                 break;
1268             }
1269         }
1270     }
1271 
1272     // if not found, add to db
1273     if (le_db_index < 0) {
1274         le_db_index = le_device_db_add(setup->sm_peer_addr_type, setup->sm_peer_address, setup->sm_peer_irk);
1275     }
1276 
1277     if (le_db_index >= 0){
1278         le_device_db_local_counter_set(le_db_index, 0);
1279 
1280         // store local CSRK
1281         if (setup->sm_key_distribution_send_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1282             log_info("sm: store local CSRK");
1283             le_device_db_local_csrk_set(le_db_index, setup->sm_local_csrk);
1284             le_device_db_local_counter_set(le_db_index, 0);
1285         }
1286 
1287         // store remote CSRK
1288         if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1289             log_info("sm: store remote CSRK");
1290             le_device_db_remote_csrk_set(le_db_index, setup->sm_peer_csrk);
1291             le_device_db_remote_counter_set(le_db_index, 0);
1292         }
1293 
1294         // store encryption information
1295         if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION
1296             && setup->sm_key_distribution_received_set &  SM_KEYDIST_FLAG_MASTER_IDENTIFICATION){
1297             log_info("sm: set encryption information (key size %u, authenticatd %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
1298             le_device_db_encryption_set(le_db_index, setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1299                 sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
1300         }
1301     }
1302 
1303     // keep le_db_index
1304     sm_conn->sm_le_db_index = le_db_index;
1305 }
1306 
1307 static void sm_pairing_error(sm_connection_t * sm_conn, uint8_t reason){
1308     setup->sm_pairing_failed_reason = reason;
1309     sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1310 }
1311 
1312 static inline void sm_pdu_received_in_wrong_state(sm_connection_t * sm_conn){
1313     sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
1314 }
1315 
1316 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1317 
1318 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn);
1319 static int sm_passkey_used(stk_generation_method_t method);
1320 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method);
1321 
1322 static void sm_sc_start_calculating_local_confirm(sm_connection_t * sm_conn){
1323     if (sm_passkey_used(setup->sm_stk_generation_method)){
1324         sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
1325     } else {
1326         sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
1327     }
1328 }
1329 
1330 static void sm_sc_state_after_receiving_random(sm_connection_t * sm_conn){
1331     if (sm_conn->sm_role){
1332         // Responder
1333         sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
1334     } else {
1335         // Initiator role
1336         switch (setup->sm_stk_generation_method){
1337             case JUST_WORKS:
1338                 sm_sc_prepare_dhkey_check(sm_conn);
1339                 break;
1340 
1341             case NK_BOTH_INPUT:
1342                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_G2;
1343                 break;
1344             case PK_INIT_INPUT:
1345             case PK_RESP_INPUT:
1346             case OK_BOTH_INPUT:
1347                 if (setup->sm_passkey_bit < 20) {
1348                     sm_sc_start_calculating_local_confirm(sm_conn);
1349                 } else {
1350                     sm_sc_prepare_dhkey_check(sm_conn);
1351                 }
1352                 break;
1353             case OOB:
1354                 // TODO: implement SC OOB
1355                 break;
1356         }
1357     }
1358 }
1359 
1360 static uint8_t sm_sc_cmac_get_byte(uint16_t offset){
1361     return sm_cmac_sc_buffer[offset];
1362 }
1363 
1364 static void sm_sc_cmac_done(uint8_t * hash){
1365     log_info("sm_sc_cmac_done: ");
1366     log_info_hexdump(hash, 16);
1367 
1368     sm_connection_t * sm_conn = sm_cmac_connection;
1369     sm_cmac_connection = NULL;
1370 
1371     switch (sm_conn->sm_engine_state){
1372         case SM_SC_W4_CMAC_FOR_CONFIRMATION:
1373             memcpy(setup->sm_local_confirm, hash, 16);
1374             sm_conn->sm_engine_state = SM_SC_SEND_CONFIRMATION;
1375             break;
1376         case SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION:
1377             // check
1378             if (0 != memcmp(hash, setup->sm_peer_confirm, 16)){
1379                 sm_pairing_error(sm_conn, SM_REASON_CONFIRM_VALUE_FAILED);
1380                 break;
1381             }
1382             sm_sc_state_after_receiving_random(sm_conn);
1383             break;
1384         case SM_SC_W4_CALCULATE_G2: {
1385             uint32_t vab = big_endian_read_32(hash, 12) % 1000000;
1386             big_endian_store_32(setup->sm_tk, 12, vab);
1387             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
1388             sm_trigger_user_response(sm_conn);
1389             break;
1390         }
1391         case SM_SC_W4_CALCULATE_F5_SALT:
1392             memcpy(setup->sm_t, hash, 16);
1393             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_MACKEY;
1394             break;
1395         case SM_SC_W4_CALCULATE_F5_MACKEY:
1396             memcpy(setup->sm_mackey, hash, 16);
1397             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_LTK;
1398             break;
1399         case SM_SC_W4_CALCULATE_F5_LTK:
1400             memcpy(setup->sm_ltk, hash, 16);
1401             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK;
1402             break;
1403         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
1404             memcpy(setup->sm_local_dhkey_check, hash, 16);
1405             if (sm_conn->sm_role){
1406                 // responder
1407                 if (setup->sm_state_vars & SM_STATE_VAR_DHKEY_COMMAND_RECEIVED){
1408                     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
1409                 } else {
1410                     sm_conn->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
1411                 }
1412             } else {
1413                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1414             }
1415             break;
1416         case SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
1417             if (0 != memcmp(hash, setup->sm_peer_dhkey_check, 16) ){
1418                 sm_pairing_error(sm_conn, SM_REASON_DHKEY_CHECK_FAILED);
1419                 break;
1420             }
1421             if (sm_conn->sm_role){
1422                 // responder
1423                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1424             } else {
1425                 // initiator
1426                 sm_conn->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
1427             }
1428             break;
1429         default:
1430             log_error("sm_sc_cmac_done in state %u", sm_conn->sm_engine_state);
1431             break;
1432     }
1433     sm_run();
1434 }
1435 
1436 static void f4_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, uint8_t z){
1437     const uint16_t message_len = 65;
1438     sm_cmac_connection = sm_conn;
1439     memcpy(sm_cmac_sc_buffer, u, 32);
1440     memcpy(sm_cmac_sc_buffer+32, v, 32);
1441     sm_cmac_sc_buffer[64] = z;
1442     log_info("f4 key");
1443     log_info_hexdump(x, 16);
1444     log_info("f4 message");
1445     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1446     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1447 }
1448 
1449 static const sm_key_t f5_salt = { 0x6C ,0x88, 0x83, 0x91, 0xAA, 0xF5, 0xA5, 0x38, 0x60, 0x37, 0x0B, 0xDB, 0x5A, 0x60, 0x83, 0xBE};
1450 static const uint8_t f5_key_id[] = { 0x62, 0x74, 0x6c, 0x65 };
1451 static const uint8_t f5_length[] = { 0x01, 0x00};
1452 
1453 static void sm_sc_calculate_dhkey(sm_key256_t dhkey){
1454 #ifdef USE_MBEDTLS_FOR_ECDH
1455     // da * Pb
1456     mbedtls_ecp_group grp;
1457     mbedtls_ecp_group_init( &grp );
1458     mbedtls_ecp_group_load(&grp, MBEDTLS_ECP_DP_SECP256R1);
1459     mbedtls_ecp_point Q;
1460     mbedtls_ecp_point_init( &Q );
1461     mbedtls_mpi_read_binary(&Q.X, setup->sm_peer_qx, 32);
1462     mbedtls_mpi_read_binary(&Q.Y, setup->sm_peer_qy, 32);
1463     mbedtls_mpi_read_string(&Q.Z, 16, "1" );
1464     mbedtls_ecp_point DH;
1465     mbedtls_ecp_point_init( &DH );
1466     mbedtls_ecp_mul(&grp, &DH, &le_keypair.d, &Q, NULL, NULL);
1467     mbedtls_mpi_write_binary(&DH.X, dhkey, 32);
1468 #endif
1469     log_info("dhkey");
1470     log_info_hexdump(dhkey, 32);
1471 }
1472 
1473 static void f5_calculate_salt(sm_connection_t * sm_conn){
1474     // calculate DHKEY
1475     sm_key256_t dhkey;
1476     sm_sc_calculate_dhkey(dhkey);
1477 
1478     // calculate salt for f5
1479     const uint16_t message_len = 32;
1480     sm_cmac_connection = sm_conn;
1481     memcpy(sm_cmac_sc_buffer, dhkey, message_len);
1482     sm_cmac_general_start(f5_salt, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1483 }
1484 
1485 static inline void f5_mackkey(sm_connection_t * sm_conn, sm_key_t t, const sm_key_t n1, const sm_key_t n2, const sm_key56_t a1, const sm_key56_t a2){
1486     const uint16_t message_len = 53;
1487     sm_cmac_connection = sm_conn;
1488 
1489     // f5(W, N1, N2, A1, A2) = AES-CMACT (Counter = 0 || keyID || N1 || N2|| A1|| A2 || Length = 256) -- this is the MacKey
1490     sm_cmac_sc_buffer[0] = 0;
1491     memcpy(sm_cmac_sc_buffer+01, f5_key_id, 4);
1492     memcpy(sm_cmac_sc_buffer+05, n1, 16);
1493     memcpy(sm_cmac_sc_buffer+21, n2, 16);
1494     memcpy(sm_cmac_sc_buffer+37, a1, 7);
1495     memcpy(sm_cmac_sc_buffer+44, a2, 7);
1496     memcpy(sm_cmac_sc_buffer+51, f5_length, 2);
1497     log_info("f5 key");
1498     log_info_hexdump(t, 16);
1499     log_info("f5 message for MacKey");
1500     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1501     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1502 }
1503 
1504 static void f5_calculate_mackey(sm_connection_t * sm_conn){
1505     sm_key56_t bd_addr_master, bd_addr_slave;
1506     bd_addr_master[0] =  setup->sm_m_addr_type;
1507     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1508     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1509     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1510     if (sm_conn->sm_role){
1511         // responder
1512         f5_mackkey(sm_conn, setup->sm_t, setup->sm_peer_nonce, setup->sm_local_nonce, bd_addr_master, bd_addr_slave);
1513     } else {
1514         // initiator
1515         f5_mackkey(sm_conn, setup->sm_t, setup->sm_local_nonce, setup->sm_peer_nonce, bd_addr_master, bd_addr_slave);
1516     }
1517 }
1518 
1519 // note: must be called right after f5_mackey, as sm_cmac_buffer[1..52] will be reused
1520 static inline void f5_ltk(sm_connection_t * sm_conn, sm_key_t t){
1521     const uint16_t message_len = 53;
1522     sm_cmac_connection = sm_conn;
1523     sm_cmac_sc_buffer[0] = 1;
1524     // 1..52 setup before
1525     log_info("f5 key");
1526     log_info_hexdump(t, 16);
1527     log_info("f5 message for LTK");
1528     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1529     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1530 }
1531 
1532 static void f5_calculate_ltk(sm_connection_t * sm_conn){
1533     f5_ltk(sm_conn, setup->sm_t);
1534 }
1535 
1536 static void f6_engine(sm_connection_t * sm_conn, const sm_key_t w, const sm_key_t n1, const sm_key_t n2, const sm_key_t r, const sm_key24_t io_cap, const sm_key56_t a1, const sm_key56_t a2){
1537     const uint16_t message_len = 65;
1538     sm_cmac_connection = sm_conn;
1539     memcpy(sm_cmac_sc_buffer, n1, 16);
1540     memcpy(sm_cmac_sc_buffer+16, n2, 16);
1541     memcpy(sm_cmac_sc_buffer+32, r, 16);
1542     memcpy(sm_cmac_sc_buffer+48, io_cap, 3);
1543     memcpy(sm_cmac_sc_buffer+51, a1, 7);
1544     memcpy(sm_cmac_sc_buffer+58, a2, 7);
1545     log_info("f6 key");
1546     log_info_hexdump(w, 16);
1547     log_info("f6 message");
1548     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1549     sm_cmac_general_start(w, 65, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1550 }
1551 
1552 // g2(U, V, X, Y) = AES-CMACX(U || V || Y) mod 2^32
1553 // - U is 256 bits
1554 // - V is 256 bits
1555 // - X is 128 bits
1556 // - Y is 128 bits
1557 static void g2_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, const sm_key_t y){
1558     const uint16_t message_len = 80;
1559     sm_cmac_connection = sm_conn;
1560     memcpy(sm_cmac_sc_buffer, u, 32);
1561     memcpy(sm_cmac_sc_buffer+32, v, 32);
1562     memcpy(sm_cmac_sc_buffer+64, y, 16);
1563     log_info("g2 key");
1564     log_info_hexdump(x, 16);
1565     log_info("g2 message");
1566     log_info_hexdump(sm_cmac_sc_buffer, sizeof(sm_cmac_sc_buffer));
1567     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1568 }
1569 
1570 static void g2_calculate(sm_connection_t * sm_conn) {
1571     // calc Va if numeric comparison
1572     uint8_t value[32];
1573     mbedtls_mpi_write_binary(&le_keypair.Q.X, value, sizeof(value));
1574     if (sm_conn->sm_role){
1575         // responder
1576         g2_engine(sm_conn, setup->sm_peer_qx, value, setup->sm_peer_nonce, setup->sm_local_nonce);;
1577     } else {
1578         // initiator
1579         g2_engine(sm_conn, value, setup->sm_peer_qx, setup->sm_local_nonce, setup->sm_peer_nonce);
1580     }
1581 }
1582 
1583 static void sm_sc_calculate_local_confirm(sm_connection_t * sm_conn){
1584     uint8_t z = 0;
1585     if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT){
1586         // some form of passkey
1587         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1588         z = 0x80 | ((pk >> setup->sm_passkey_bit) & 1);
1589         setup->sm_passkey_bit++;
1590     }
1591 #ifdef USE_MBEDTLS_FOR_ECDH
1592     uint8_t local_qx[32];
1593     mbedtls_mpi_write_binary(&le_keypair.Q.X, local_qx, sizeof(local_qx));
1594 #endif
1595     f4_engine(sm_conn, local_qx, setup->sm_peer_qx, setup->sm_local_nonce, z);
1596 }
1597 
1598 static void sm_sc_calculate_remote_confirm(sm_connection_t * sm_conn){
1599     uint8_t z = 0;
1600     if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT){
1601         // some form of passkey
1602         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1603         // sm_passkey_bit was increased before sending confirm value
1604         z = 0x80 | ((pk >> (setup->sm_passkey_bit-1)) & 1);
1605     }
1606 #ifdef USE_MBEDTLS_FOR_ECDH
1607     uint8_t local_qx[32];
1608     mbedtls_mpi_write_binary(&le_keypair.Q.X, local_qx, sizeof(local_qx));
1609 #endif
1610     f4_engine(sm_conn, setup->sm_peer_qx, local_qx, setup->sm_peer_nonce, z);
1611 }
1612 
1613 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn){
1614     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_SALT;
1615 }
1616 
1617 static void sm_sc_calculate_f6_for_dhkey_check(sm_connection_t * sm_conn){
1618     // calculate DHKCheck
1619     sm_key56_t bd_addr_master, bd_addr_slave;
1620     bd_addr_master[0] =  setup->sm_m_addr_type;
1621     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1622     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1623     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1624     uint8_t iocap_a[3];
1625     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1626     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1627     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1628     uint8_t iocap_b[3];
1629     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1630     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1631     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1632     if (sm_conn->sm_role){
1633         // responder
1634         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1635     } else {
1636         // initiator
1637         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1638     }
1639 }
1640 
1641 static void sm_sc_calculate_f6_to_verify_dhkey_check(sm_connection_t * sm_conn){
1642     // validate E = f6()
1643     sm_key56_t bd_addr_master, bd_addr_slave;
1644     bd_addr_master[0] =  setup->sm_m_addr_type;
1645     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1646     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1647     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1648 
1649     uint8_t iocap_a[3];
1650     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1651     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1652     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1653     uint8_t iocap_b[3];
1654     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1655     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1656     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1657     if (sm_conn->sm_role){
1658         // responder
1659         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1660     } else {
1661         // initiator
1662         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1663     }
1664 }
1665 #endif
1666 
1667 static void sm_load_security_info(sm_connection_t * sm_connection){
1668     int encryption_key_size;
1669     int authenticated;
1670     int authorized;
1671 
1672     // fetch data from device db - incl. authenticated/authorized/key size. Note all sm_connection_X require encryption enabled
1673     le_device_db_encryption_get(sm_connection->sm_le_db_index, &setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1674                                 &encryption_key_size, &authenticated, &authorized);
1675     log_info("db index %u, key size %u, authenticated %u, authorized %u", sm_connection->sm_le_db_index, encryption_key_size, authenticated, authorized);
1676     sm_connection->sm_actual_encryption_key_size = encryption_key_size;
1677     sm_connection->sm_connection_authenticated = authenticated;
1678     sm_connection->sm_connection_authorization_state = authorized ? AUTHORIZATION_GRANTED : AUTHORIZATION_UNKNOWN;
1679 }
1680 
1681 static void sm_run(void){
1682 
1683     btstack_linked_list_iterator_t it;
1684 
1685     // assert that we can send at least commands
1686     if (!hci_can_send_command_packet_now()) return;
1687 
1688     //
1689     // non-connection related behaviour
1690     //
1691 
1692     // distributed key generation
1693     switch (dkg_state){
1694         case DKG_CALC_IRK:
1695             // already busy?
1696             if (sm_aes128_state == SM_AES128_IDLE) {
1697                 // IRK = d1(IR, 1, 0)
1698                 sm_key_t d1_prime;
1699                 sm_d1_d_prime(1, 0, d1_prime);  // plaintext
1700                 dkg_next_state();
1701                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
1702                 return;
1703             }
1704             break;
1705         case DKG_CALC_DHK:
1706             // already busy?
1707             if (sm_aes128_state == SM_AES128_IDLE) {
1708                 // DHK = d1(IR, 3, 0)
1709                 sm_key_t d1_prime;
1710                 sm_d1_d_prime(3, 0, d1_prime);  // plaintext
1711                 dkg_next_state();
1712                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
1713                 return;
1714             }
1715             break;
1716         default:
1717             break;
1718     }
1719 
1720 #ifdef USE_MBEDTLS_FOR_ECDH
1721     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
1722         sm_random_start(NULL);
1723         return;
1724     }
1725 #endif
1726 
1727     // random address updates
1728     switch (rau_state){
1729         case RAU_GET_RANDOM:
1730             rau_next_state();
1731             sm_random_start(NULL);
1732             return;
1733         case RAU_GET_ENC:
1734             // already busy?
1735             if (sm_aes128_state == SM_AES128_IDLE) {
1736                 sm_key_t r_prime;
1737                 sm_ah_r_prime(sm_random_address, r_prime);
1738                 rau_next_state();
1739                 sm_aes128_start(sm_persistent_irk, r_prime, NULL);
1740                 return;
1741             }
1742             break;
1743         case RAU_SET_ADDRESS:
1744             log_info("New random address: %s", bd_addr_to_str(sm_random_address));
1745             rau_state = RAU_IDLE;
1746             hci_send_cmd(&hci_le_set_random_address, sm_random_address);
1747             return;
1748         default:
1749             break;
1750     }
1751 
1752     // CMAC
1753     switch (sm_cmac_state){
1754         case CMAC_CALC_SUBKEYS:
1755         case CMAC_CALC_MI:
1756         case CMAC_CALC_MLAST:
1757             // already busy?
1758             if (sm_aes128_state == SM_AES128_ACTIVE) break;
1759             sm_cmac_handle_aes_engine_ready();
1760             return;
1761         default:
1762             break;
1763     }
1764 
1765     // CSRK Lookup
1766     // -- if csrk lookup ready, find connection that require csrk lookup
1767     if (sm_address_resolution_idle()){
1768         hci_connections_get_iterator(&it);
1769         while(btstack_linked_list_iterator_has_next(&it)){
1770             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1771             sm_connection_t  * sm_connection  = &hci_connection->sm_connection;
1772             if (sm_connection->sm_irk_lookup_state == IRK_LOOKUP_W4_READY){
1773                 // and start lookup
1774                 sm_address_resolution_start_lookup(sm_connection->sm_peer_addr_type, sm_connection->sm_handle, sm_connection->sm_peer_address, ADDRESS_RESOLUTION_FOR_CONNECTION, sm_connection);
1775                 sm_connection->sm_irk_lookup_state = IRK_LOOKUP_STARTED;
1776                 break;
1777             }
1778         }
1779     }
1780 
1781     // -- if csrk lookup ready, resolved addresses for received addresses
1782     if (sm_address_resolution_idle()) {
1783         if (!btstack_linked_list_empty(&sm_address_resolution_general_queue)){
1784             sm_lookup_entry_t * entry = (sm_lookup_entry_t *) sm_address_resolution_general_queue;
1785             btstack_linked_list_remove(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
1786             sm_address_resolution_start_lookup(entry->address_type, 0, entry->address, ADDRESS_RESOLUTION_GENERAL, NULL);
1787             btstack_memory_sm_lookup_entry_free(entry);
1788         }
1789     }
1790 
1791     // -- Continue with CSRK device lookup by public or resolvable private address
1792     if (!sm_address_resolution_idle()){
1793         log_info("LE Device Lookup: device %u/%u", sm_address_resolution_test, le_device_db_count());
1794         while (sm_address_resolution_test < le_device_db_count()){
1795             int addr_type;
1796             bd_addr_t addr;
1797             sm_key_t irk;
1798             le_device_db_info(sm_address_resolution_test, &addr_type, addr, irk);
1799             log_info("device type %u, addr: %s", addr_type, bd_addr_to_str(addr));
1800 
1801             if (sm_address_resolution_addr_type == addr_type && memcmp(addr, sm_address_resolution_address, 6) == 0){
1802                 log_info("LE Device Lookup: found CSRK by { addr_type, address} ");
1803                 sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
1804                 break;
1805             }
1806 
1807             if (sm_address_resolution_addr_type == 0){
1808                 sm_address_resolution_test++;
1809                 continue;
1810             }
1811 
1812             if (sm_aes128_state == SM_AES128_ACTIVE) break;
1813 
1814             log_info("LE Device Lookup: calculate AH");
1815             log_info_key("IRK", irk);
1816 
1817             sm_key_t r_prime;
1818             sm_ah_r_prime(sm_address_resolution_address, r_prime);
1819             sm_address_resolution_ah_calculation_active = 1;
1820             sm_aes128_start(irk, r_prime, sm_address_resolution_context);   // keep context
1821             return;
1822         }
1823 
1824         if (sm_address_resolution_test >= le_device_db_count()){
1825             log_info("LE Device Lookup: not found");
1826             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_FAILED);
1827         }
1828     }
1829 
1830 
1831     //
1832     // active connection handling
1833     // -- use loop to handle next connection if lock on setup context is released
1834 
1835     while (1) {
1836 
1837         // Find connections that requires setup context and make active if no other is locked
1838         hci_connections_get_iterator(&it);
1839         while(!sm_active_connection && btstack_linked_list_iterator_has_next(&it)){
1840             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1841             sm_connection_t  * sm_connection = &hci_connection->sm_connection;
1842             // - if no connection locked and we're ready/waiting for setup context, fetch it and start
1843             int done = 1;
1844             int err;
1845             switch (sm_connection->sm_engine_state) {
1846                 case SM_RESPONDER_SEND_SECURITY_REQUEST:
1847                     // send packet if possible,
1848                     if (l2cap_can_send_fixed_channel_packet_now(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)){
1849                         const uint8_t buffer[2] = { SM_CODE_SECURITY_REQUEST, SM_AUTHREQ_BONDING};
1850                         sm_connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_REQUEST;
1851                         l2cap_send_connectionless(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
1852                     } else {
1853                         l2cap_request_can_send_fix_channel_now_event(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
1854                     }
1855                     // don't lock sxetup context yet
1856                     done = 0;
1857                     break;
1858                 case SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED:
1859                     sm_init_setup(sm_connection);
1860                     // recover pairing request
1861                     memcpy(&setup->sm_m_preq, &sm_connection->sm_m_preq, sizeof(sm_pairing_packet_t));
1862                     err = sm_stk_generation_init(sm_connection);
1863                     if (err){
1864                         setup->sm_pairing_failed_reason = err;
1865                         sm_connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1866                         break;
1867                     }
1868                     sm_timeout_start(sm_connection);
1869                     // generate random number first, if we need to show passkey
1870                     if (setup->sm_stk_generation_method == PK_INIT_INPUT){
1871                         sm_connection->sm_engine_state = SM_PH2_GET_RANDOM_TK;
1872                         break;
1873                     }
1874                     sm_connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
1875                     break;
1876                 case SM_INITIATOR_PH0_HAS_LTK:
1877                     sm_load_security_info(sm_connection);
1878                     sm_connection->sm_engine_state = SM_INITIATOR_PH0_SEND_START_ENCRYPTION;
1879                     break;
1880                 case SM_RESPONDER_PH0_RECEIVED_LTK:
1881                     switch (sm_connection->sm_irk_lookup_state){
1882                         case IRK_LOOKUP_SUCCEEDED:{
1883                                 sm_load_security_info(sm_connection);
1884                                 sm_connection->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
1885                                 break;
1886                             }
1887                         case IRK_LOOKUP_FAILED:
1888                             // assume that we don't have a LTK for ediv == 0 and random == null
1889                             if (sm_connection->sm_local_ediv == 0 && sm_is_null_random(sm_connection->sm_local_rand)){
1890                                 log_info("LTK Request: ediv & random are empty");
1891                                 sm_connection->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
1892                                 // TODO: no need to lock context yet -> done = 0;
1893                                 break;
1894                             }
1895                             // re-establish previously used LTK using Rand and EDIV
1896                             memcpy(setup->sm_local_rand, sm_connection->sm_local_rand, 8);
1897                             setup->sm_local_ediv = sm_connection->sm_local_ediv;
1898                             // re-establish used key encryption size
1899                             // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
1900                             sm_connection->sm_actual_encryption_key_size = (setup->sm_local_rand[7] & 0x0f) + 1;
1901                             // no db for authenticated flag hack: flag is stored in bit 4 of LSB
1902                             sm_connection->sm_connection_authenticated = (setup->sm_local_rand[7] & 0x10) >> 4;
1903                             log_info("sm: received ltk request with key size %u, authenticated %u",
1904                                     sm_connection->sm_actual_encryption_key_size, sm_connection->sm_connection_authenticated);
1905                             sm_connection->sm_engine_state = SM_RESPONDER_PH4_Y_GET_ENC;
1906                             break;
1907                         default:
1908                             // just wait until IRK lookup is completed
1909                             // don't lock sxetup context yet
1910                             done = 0;
1911                             break;
1912                     }
1913                     break;
1914                 case SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST:
1915                     sm_init_setup(sm_connection);
1916                     sm_timeout_start(sm_connection);
1917                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_SEND_PAIRING_REQUEST;
1918                     break;
1919                 default:
1920                     done = 0;
1921                     break;
1922             }
1923             if (done){
1924                 sm_active_connection = sm_connection->sm_handle;
1925                 log_info("sm: connection 0x%04x locked setup context as %s", sm_active_connection, sm_connection->sm_role ? "responder" : "initiator");
1926             }
1927         }
1928 
1929         //
1930         // active connection handling
1931         //
1932 
1933         if (sm_active_connection == 0) return;
1934 
1935         // assert that we could send a SM PDU - not needed for all of the following
1936         if (!l2cap_can_send_fixed_channel_packet_now(sm_active_connection, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)) {
1937             l2cap_request_can_send_fix_channel_now_event(sm_active_connection, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
1938             return;
1939         }
1940 
1941         sm_connection_t * connection = sm_get_connection_for_handle(sm_active_connection);
1942         if (!connection) return;
1943 
1944         sm_key_t plaintext;
1945         int key_distribution_flags;
1946 
1947         log_info("sm_run: state %u", connection->sm_engine_state);
1948 
1949         // responding state
1950         switch (connection->sm_engine_state){
1951 
1952             // general
1953             case SM_GENERAL_SEND_PAIRING_FAILED: {
1954                 uint8_t buffer[2];
1955                 buffer[0] = SM_CODE_PAIRING_FAILED;
1956                 buffer[1] = setup->sm_pairing_failed_reason;
1957                 connection->sm_engine_state = connection->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
1958                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
1959                 sm_done_for_handle(connection->sm_handle);
1960                 break;
1961             }
1962 
1963 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1964             case SM_SC_W2_GET_RANDOM_A:
1965                 sm_random_start(connection);
1966                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_A;
1967                 break;
1968             case SM_SC_W2_GET_RANDOM_B:
1969                 sm_random_start(connection);
1970                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_B;
1971                 break;
1972             case SM_SC_W2_CMAC_FOR_CONFIRMATION:
1973                 if (!sm_cmac_ready()) break;
1974                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CONFIRMATION;
1975                 sm_sc_calculate_local_confirm(connection);
1976                 break;
1977             case SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION:
1978                 if (!sm_cmac_ready()) break;
1979                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION;
1980                 sm_sc_calculate_remote_confirm(connection);
1981                 break;
1982             case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
1983                 if (!sm_cmac_ready()) break;
1984                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK;
1985                 sm_sc_calculate_f6_for_dhkey_check(connection);
1986                 break;
1987             case SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
1988                 if (!sm_cmac_ready()) break;
1989                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
1990                 sm_sc_calculate_f6_to_verify_dhkey_check(connection);
1991                 break;
1992             case SM_SC_W2_CALCULATE_F5_SALT:
1993                 if (!sm_cmac_ready()) break;
1994                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_SALT;
1995                 f5_calculate_salt(connection);
1996                 break;
1997             case SM_SC_W2_CALCULATE_F5_MACKEY:
1998                 if (!sm_cmac_ready()) break;
1999                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_MACKEY;
2000                 f5_calculate_mackey(connection);
2001                 break;
2002             case SM_SC_W2_CALCULATE_F5_LTK:
2003                 if (!sm_cmac_ready()) break;
2004                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_LTK;
2005                 f5_calculate_ltk(connection);
2006                 break;
2007             case SM_SC_W2_CALCULATE_G2:
2008                 if (!sm_cmac_ready()) break;
2009                 connection->sm_engine_state = SM_SC_W4_CALCULATE_G2;
2010                 g2_calculate(connection);
2011                 break;
2012 
2013 #endif
2014             // initiator side
2015             case SM_INITIATOR_PH0_SEND_START_ENCRYPTION: {
2016                 sm_key_t peer_ltk_flipped;
2017                 reverse_128(setup->sm_peer_ltk, peer_ltk_flipped);
2018                 connection->sm_engine_state = SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED;
2019                 log_info("sm: hci_le_start_encryption ediv 0x%04x", setup->sm_peer_ediv);
2020                 uint32_t rand_high = big_endian_read_32(setup->sm_peer_rand, 0);
2021                 uint32_t rand_low  = big_endian_read_32(setup->sm_peer_rand, 4);
2022                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle,rand_low, rand_high, setup->sm_peer_ediv, peer_ltk_flipped);
2023                 return;
2024             }
2025 
2026             case SM_INITIATOR_PH1_SEND_PAIRING_REQUEST:
2027                 sm_pairing_packet_set_code(setup->sm_m_preq, SM_CODE_PAIRING_REQUEST);
2028                 connection->sm_engine_state = SM_INITIATOR_PH1_W4_PAIRING_RESPONSE;
2029                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_m_preq, sizeof(sm_pairing_packet_t));
2030                 sm_timeout_reset(connection);
2031                 break;
2032 
2033             // responder side
2034             case SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY:
2035                 connection->sm_engine_state = SM_RESPONDER_IDLE;
2036                 hci_send_cmd(&hci_le_long_term_key_negative_reply, connection->sm_handle);
2037                 return;
2038 
2039 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2040             case SM_SC_SEND_PUBLIC_KEY_COMMAND: {
2041                 uint8_t buffer[65];
2042                 buffer[0] = SM_CODE_PAIRING_PUBLIC_KEY;
2043                 //
2044 #ifdef USE_MBEDTLS_FOR_ECDH
2045                 uint8_t value[32];
2046                 mbedtls_mpi_write_binary(&le_keypair.Q.X, value, sizeof(value));
2047                 reverse_256(value, &buffer[1]);
2048                 mbedtls_mpi_write_binary(&le_keypair.Q.Y, value, sizeof(value));
2049                 reverse_256(value, &buffer[33]);
2050 #endif
2051 
2052                 // stk generation method
2053                 // passkey entry: notify app to show passkey or to request passkey
2054                 switch (setup->sm_stk_generation_method){
2055                     case JUST_WORKS:
2056                     case NK_BOTH_INPUT:
2057                         if (connection->sm_role){
2058                             // responder
2059                             sm_sc_start_calculating_local_confirm(connection);
2060                         } else {
2061                             // initiator
2062                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2063                         }
2064                         break;
2065                     case PK_INIT_INPUT:
2066                     case PK_RESP_INPUT:
2067                     case OK_BOTH_INPUT:
2068                         // use random TK for display
2069                         memcpy(setup->sm_ra, setup->sm_tk, 16);
2070                         memcpy(setup->sm_rb, setup->sm_tk, 16);
2071                         setup->sm_passkey_bit = 0;
2072 
2073                         if (connection->sm_role){
2074                             // responder
2075                             connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2076                         } else {
2077                             // initiator
2078                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2079                         }
2080                         sm_trigger_user_response(connection);
2081                         break;
2082                     case OOB:
2083                         // TODO: implement SC OOB
2084                         break;
2085                 }
2086 
2087                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2088                 sm_timeout_reset(connection);
2089                 break;
2090             }
2091             case SM_SC_SEND_CONFIRMATION: {
2092                 uint8_t buffer[17];
2093                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2094                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2095                 if (connection->sm_role){
2096                     connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2097                 } else {
2098                     connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2099                 }
2100                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2101                 sm_timeout_reset(connection);
2102                 break;
2103             }
2104             case SM_SC_SEND_PAIRING_RANDOM: {
2105                 uint8_t buffer[17];
2106                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2107                 reverse_128(setup->sm_local_nonce, &buffer[1]);
2108                 if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT && setup->sm_passkey_bit < 20){
2109                     if (connection->sm_role){
2110                         // responder
2111                         connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2112                     } else {
2113                         // initiator
2114                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2115                     }
2116                 } else {
2117                     if (connection->sm_role){
2118                         // responder
2119                         if (setup->sm_stk_generation_method == NK_BOTH_INPUT){
2120                             connection->sm_engine_state = SM_SC_W2_CALCULATE_G2;
2121                         } else {
2122                             sm_sc_prepare_dhkey_check(connection);
2123                         }
2124                     } else {
2125                         // initiator
2126                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2127                     }
2128                 }
2129                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2130                 sm_timeout_reset(connection);
2131                 break;
2132             }
2133             case SM_SC_SEND_DHKEY_CHECK_COMMAND: {
2134                 uint8_t buffer[17];
2135                 buffer[0] = SM_CODE_PAIRING_DHKEY_CHECK;
2136                 reverse_128(setup->sm_local_dhkey_check, &buffer[1]);
2137 
2138                 if (connection->sm_role){
2139                     connection->sm_engine_state = SM_SC_W4_LTK_REQUEST_SC;
2140                 } else {
2141                     connection->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
2142                 }
2143 
2144                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2145                 sm_timeout_reset(connection);
2146                 break;
2147             }
2148 
2149 #endif
2150             case SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE:
2151                 // echo initiator for now
2152                 sm_pairing_packet_set_code(setup->sm_s_pres,SM_CODE_PAIRING_RESPONSE);
2153                 key_distribution_flags = sm_key_distribution_flags_for_auth_req();
2154 
2155                 connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_CONFIRM;
2156 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2157                 if (setup->sm_use_secure_connections){
2158                     connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2159                     // skip LTK/EDIV for SC
2160                     log_info("sm: dropping encryption information flag");
2161                     key_distribution_flags &= ~SM_KEYDIST_ENC_KEY;
2162                 }
2163 #endif
2164                 sm_pairing_packet_set_initiator_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_initiator_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2165                 sm_pairing_packet_set_responder_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2166                 // update key distribution after ENC was dropped
2167                 sm_setup_key_distribution(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
2168 
2169                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_s_pres, sizeof(sm_pairing_packet_t));
2170                 sm_timeout_reset(connection);
2171                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
2172                 if (setup->sm_stk_generation_method == JUST_WORKS){
2173                     sm_trigger_user_response(connection);
2174                 }
2175                 return;
2176 
2177             case SM_PH2_SEND_PAIRING_RANDOM: {
2178                 uint8_t buffer[17];
2179                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2180                 reverse_128(setup->sm_local_random, &buffer[1]);
2181                 if (connection->sm_role){
2182                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_LTK_REQUEST;
2183                 } else {
2184                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_RANDOM;
2185                 }
2186                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2187                 sm_timeout_reset(connection);
2188                 break;
2189             }
2190 
2191             case SM_PH2_GET_RANDOM_TK:
2192             case SM_PH2_C1_GET_RANDOM_A:
2193             case SM_PH2_C1_GET_RANDOM_B:
2194             case SM_PH3_GET_RANDOM:
2195             case SM_PH3_GET_DIV:
2196                 sm_next_responding_state(connection);
2197                 sm_random_start(connection);
2198                 return;
2199 
2200             case SM_PH2_C1_GET_ENC_B:
2201             case SM_PH2_C1_GET_ENC_D:
2202                 // already busy?
2203                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2204                 sm_next_responding_state(connection);
2205                 sm_aes128_start(setup->sm_tk, setup->sm_c1_t3_value, connection);
2206                 return;
2207 
2208             case SM_PH3_LTK_GET_ENC:
2209             case SM_RESPONDER_PH4_LTK_GET_ENC:
2210                 // already busy?
2211                 if (sm_aes128_state == SM_AES128_IDLE) {
2212                     sm_key_t d_prime;
2213                     sm_d1_d_prime(setup->sm_local_div, 0, d_prime);
2214                     sm_next_responding_state(connection);
2215                     sm_aes128_start(sm_persistent_er, d_prime, connection);
2216                     return;
2217                 }
2218                 break;
2219 
2220             case SM_PH3_CSRK_GET_ENC:
2221                 // already busy?
2222                 if (sm_aes128_state == SM_AES128_IDLE) {
2223                     sm_key_t d_prime;
2224                     sm_d1_d_prime(setup->sm_local_div, 1, d_prime);
2225                     sm_next_responding_state(connection);
2226                     sm_aes128_start(sm_persistent_er, d_prime, connection);
2227                     return;
2228                 }
2229                 break;
2230 
2231             case SM_PH2_C1_GET_ENC_C:
2232                 // already busy?
2233                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2234                 // calculate m_confirm using aes128 engine - step 1
2235                 sm_c1_t1(setup->sm_peer_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
2236                 sm_next_responding_state(connection);
2237                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2238                 break;
2239             case SM_PH2_C1_GET_ENC_A:
2240                 // already busy?
2241                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2242                 // calculate confirm using aes128 engine - step 1
2243                 sm_c1_t1(setup->sm_local_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
2244                 sm_next_responding_state(connection);
2245                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2246                 break;
2247             case SM_PH2_CALC_STK:
2248                 // already busy?
2249                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2250                 // calculate STK
2251                 if (connection->sm_role){
2252                     sm_s1_r_prime(setup->sm_local_random, setup->sm_peer_random, plaintext);
2253                 } else {
2254                     sm_s1_r_prime(setup->sm_peer_random, setup->sm_local_random, plaintext);
2255                 }
2256                 sm_next_responding_state(connection);
2257                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2258                 break;
2259             case SM_PH3_Y_GET_ENC:
2260                 // already busy?
2261                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2262                 // PH3B2 - calculate Y from      - enc
2263                 // Y = dm(DHK, Rand)
2264                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
2265                 sm_next_responding_state(connection);
2266                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
2267                 return;
2268             case SM_PH2_C1_SEND_PAIRING_CONFIRM: {
2269                 uint8_t buffer[17];
2270                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2271                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2272                 if (connection->sm_role){
2273                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_PAIRING_RANDOM;
2274                 } else {
2275                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_CONFIRM;
2276                 }
2277                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2278                 sm_timeout_reset(connection);
2279                 return;
2280             }
2281             case SM_RESPONDER_PH2_SEND_LTK_REPLY: {
2282                 sm_key_t stk_flipped;
2283                 reverse_128(setup->sm_ltk, stk_flipped);
2284                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2285                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, stk_flipped);
2286                 return;
2287             }
2288             case SM_INITIATOR_PH3_SEND_START_ENCRYPTION: {
2289                 sm_key_t stk_flipped;
2290                 reverse_128(setup->sm_ltk, stk_flipped);
2291                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2292                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle, 0, 0, 0, stk_flipped);
2293                 return;
2294             }
2295             case SM_RESPONDER_PH4_SEND_LTK: {
2296                 sm_key_t ltk_flipped;
2297                 reverse_128(setup->sm_ltk, ltk_flipped);
2298                 connection->sm_engine_state = SM_RESPONDER_IDLE;
2299                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, ltk_flipped);
2300                 return;
2301             }
2302             case SM_RESPONDER_PH4_Y_GET_ENC:
2303                 // already busy?
2304                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2305                 log_info("LTK Request: recalculating with ediv 0x%04x", setup->sm_local_ediv);
2306                 // Y = dm(DHK, Rand)
2307                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
2308                 sm_next_responding_state(connection);
2309                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
2310                 return;
2311 
2312             case SM_PH3_DISTRIBUTE_KEYS:
2313                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION){
2314                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
2315                     uint8_t buffer[17];
2316                     buffer[0] = SM_CODE_ENCRYPTION_INFORMATION;
2317                     reverse_128(setup->sm_ltk, &buffer[1]);
2318                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2319                     sm_timeout_reset(connection);
2320                     return;
2321                 }
2322                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_MASTER_IDENTIFICATION){
2323                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
2324                     uint8_t buffer[11];
2325                     buffer[0] = SM_CODE_MASTER_IDENTIFICATION;
2326                     little_endian_store_16(buffer, 1, setup->sm_local_ediv);
2327                     reverse_64(setup->sm_local_rand, &buffer[3]);
2328                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2329                     sm_timeout_reset(connection);
2330                     return;
2331                 }
2332                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
2333                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
2334                     uint8_t buffer[17];
2335                     buffer[0] = SM_CODE_IDENTITY_INFORMATION;
2336                     reverse_128(sm_persistent_irk, &buffer[1]);
2337                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2338                     sm_timeout_reset(connection);
2339                     return;
2340                 }
2341                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION){
2342                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
2343                     bd_addr_t local_address;
2344                     uint8_t buffer[8];
2345                     buffer[0] = SM_CODE_IDENTITY_ADDRESS_INFORMATION;
2346                     gap_advertisements_get_address(&buffer[1], local_address);
2347                     reverse_bd_addr(local_address, &buffer[2]);
2348                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2349                     sm_timeout_reset(connection);
2350                     return;
2351                 }
2352                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
2353                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
2354 
2355                     // hack to reproduce test runs
2356                     if (test_use_fixed_local_csrk){
2357                         memset(setup->sm_local_csrk, 0xcc, 16);
2358                     }
2359 
2360                     uint8_t buffer[17];
2361                     buffer[0] = SM_CODE_SIGNING_INFORMATION;
2362                     reverse_128(setup->sm_local_csrk, &buffer[1]);
2363                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2364                     sm_timeout_reset(connection);
2365                     return;
2366                 }
2367 
2368                 // keys are sent
2369                 if (connection->sm_role){
2370                     // slave -> receive master keys if any
2371                     if (sm_key_distribution_all_received(connection)){
2372                         sm_key_distribution_handle_all_received(connection);
2373                         connection->sm_engine_state = SM_RESPONDER_IDLE;
2374                         sm_done_for_handle(connection->sm_handle);
2375                     } else {
2376                         connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2377                     }
2378                 } else {
2379                     // master -> all done
2380                     connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2381                     sm_done_for_handle(connection->sm_handle);
2382                 }
2383                 break;
2384 
2385             default:
2386                 break;
2387         }
2388 
2389         // check again if active connection was released
2390         if (sm_active_connection) break;
2391     }
2392 }
2393 
2394 // note: aes engine is ready as we just got the aes result
2395 static void sm_handle_encryption_result(uint8_t * data){
2396 
2397     sm_aes128_state = SM_AES128_IDLE;
2398 
2399     if (sm_address_resolution_ah_calculation_active){
2400         sm_address_resolution_ah_calculation_active = 0;
2401         // compare calulated address against connecting device
2402         uint8_t hash[3];
2403         reverse_24(data, hash);
2404         if (memcmp(&sm_address_resolution_address[3], hash, 3) == 0){
2405             log_info("LE Device Lookup: matched resolvable private address");
2406             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
2407             return;
2408         }
2409         // no match, try next
2410         sm_address_resolution_test++;
2411         return;
2412     }
2413 
2414     switch (dkg_state){
2415         case DKG_W4_IRK:
2416             reverse_128(data, sm_persistent_irk);
2417             log_info_key("irk", sm_persistent_irk);
2418             dkg_next_state();
2419             return;
2420         case DKG_W4_DHK:
2421             reverse_128(data, sm_persistent_dhk);
2422             log_info_key("dhk", sm_persistent_dhk);
2423             dkg_next_state();
2424             // SM Init Finished
2425             return;
2426         default:
2427             break;
2428     }
2429 
2430     switch (rau_state){
2431         case RAU_W4_ENC:
2432             reverse_24(data, &sm_random_address[3]);
2433             rau_next_state();
2434             return;
2435         default:
2436             break;
2437     }
2438 
2439     switch (sm_cmac_state){
2440         case CMAC_W4_SUBKEYS:
2441         case CMAC_W4_MI:
2442         case CMAC_W4_MLAST:
2443             {
2444             sm_key_t t;
2445             reverse_128(data, t);
2446             sm_cmac_handle_encryption_result(t);
2447             }
2448             return;
2449         default:
2450             break;
2451     }
2452 
2453     // retrieve sm_connection provided to sm_aes128_start_encryption
2454     sm_connection_t * connection = (sm_connection_t*) sm_aes128_context;
2455     if (!connection) return;
2456     switch (connection->sm_engine_state){
2457         case SM_PH2_C1_W4_ENC_A:
2458         case SM_PH2_C1_W4_ENC_C:
2459             {
2460             sm_key_t t2;
2461             reverse_128(data, t2);
2462             sm_c1_t3(t2, setup->sm_m_address, setup->sm_s_address, setup->sm_c1_t3_value);
2463             }
2464             sm_next_responding_state(connection);
2465             return;
2466         case SM_PH2_C1_W4_ENC_B:
2467             reverse_128(data, setup->sm_local_confirm);
2468             log_info_key("c1!", setup->sm_local_confirm);
2469             connection->sm_engine_state = SM_PH2_C1_SEND_PAIRING_CONFIRM;
2470             return;
2471         case SM_PH2_C1_W4_ENC_D:
2472             {
2473             sm_key_t peer_confirm_test;
2474             reverse_128(data, peer_confirm_test);
2475             log_info_key("c1!", peer_confirm_test);
2476             if (memcmp(setup->sm_peer_confirm, peer_confirm_test, 16) != 0){
2477                 setup->sm_pairing_failed_reason = SM_REASON_CONFIRM_VALUE_FAILED;
2478                 connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
2479                 return;
2480             }
2481             if (connection->sm_role){
2482                 connection->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
2483             } else {
2484                 connection->sm_engine_state = SM_PH2_CALC_STK;
2485             }
2486             }
2487             return;
2488         case SM_PH2_W4_STK:
2489             reverse_128(data, setup->sm_ltk);
2490             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2491             log_info_key("stk", setup->sm_ltk);
2492             if (connection->sm_role){
2493                 connection->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2494             } else {
2495                 connection->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
2496             }
2497             return;
2498         case SM_PH3_Y_W4_ENC:{
2499             sm_key_t y128;
2500             reverse_128(data, y128);
2501             setup->sm_local_y = big_endian_read_16(y128, 14);
2502             log_info_hex16("y", setup->sm_local_y);
2503             // PH3B3 - calculate EDIV
2504             setup->sm_local_ediv = setup->sm_local_y ^ setup->sm_local_div;
2505             log_info_hex16("ediv", setup->sm_local_ediv);
2506             // PH3B4 - calculate LTK         - enc
2507             // LTK = d1(ER, DIV, 0))
2508             connection->sm_engine_state = SM_PH3_LTK_GET_ENC;
2509             return;
2510         }
2511         case SM_RESPONDER_PH4_Y_W4_ENC:{
2512             sm_key_t y128;
2513             reverse_128(data, y128);
2514             setup->sm_local_y = big_endian_read_16(y128, 14);
2515             log_info_hex16("y", setup->sm_local_y);
2516 
2517             // PH3B3 - calculate DIV
2518             setup->sm_local_div = setup->sm_local_y ^ setup->sm_local_ediv;
2519             log_info_hex16("ediv", setup->sm_local_ediv);
2520             // PH3B4 - calculate LTK         - enc
2521             // LTK = d1(ER, DIV, 0))
2522             connection->sm_engine_state = SM_RESPONDER_PH4_LTK_GET_ENC;
2523             return;
2524         }
2525         case SM_PH3_LTK_W4_ENC:
2526             reverse_128(data, setup->sm_ltk);
2527             log_info_key("ltk", setup->sm_ltk);
2528             // calc CSRK next
2529             connection->sm_engine_state = SM_PH3_CSRK_GET_ENC;
2530             return;
2531         case SM_PH3_CSRK_W4_ENC:
2532             reverse_128(data, setup->sm_local_csrk);
2533             log_info_key("csrk", setup->sm_local_csrk);
2534             if (setup->sm_key_distribution_send_set){
2535                 connection->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
2536             } else {
2537                 // no keys to send, just continue
2538                 if (connection->sm_role){
2539                     // slave -> receive master keys
2540                     connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2541                 } else {
2542                     // master -> all done
2543                     connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2544                     sm_done_for_handle(connection->sm_handle);
2545                 }
2546             }
2547             return;
2548         case SM_RESPONDER_PH4_LTK_W4_ENC:
2549             reverse_128(data, setup->sm_ltk);
2550             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2551             log_info_key("ltk", setup->sm_ltk);
2552             connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK;
2553             return;
2554         default:
2555             break;
2556     }
2557 }
2558 
2559 #ifdef USE_MBEDTLS_FOR_ECDH
2560 
2561 static void sm_log_ec_keypair(void){
2562     // print keypair
2563     char buffer[100];
2564     size_t len;
2565     mbedtls_mpi_write_string( &le_keypair.d, 16, buffer, sizeof(buffer), &len);
2566     log_info("d: %s", buffer);
2567     mbedtls_mpi_write_string( &le_keypair.Q.X, 16, buffer, sizeof(buffer), &len);
2568     log_info("X: %s", buffer);
2569     mbedtls_mpi_write_string( &le_keypair.Q.Y, 16, buffer, sizeof(buffer), &len);
2570     log_info("Y: %s", buffer);
2571 }
2572 
2573 static int sm_generate_f_rng(void * context, unsigned char * buffer, size_t size){
2574     int offset = setup->sm_passkey_bit;
2575     log_info("sm_generate_f_rng: size %u - offset %u", (int) size, offset);
2576     while (size) {
2577         if (offset < 32){
2578             *buffer++ = setup->sm_peer_qx[offset++];
2579         } else {
2580             *buffer++ = setup->sm_peer_qx[offset++ - 32];
2581         }
2582         size--;
2583     }
2584     setup->sm_passkey_bit = offset;
2585     return 0;
2586 }
2587 #endif
2588 
2589 // note: random generator is ready. this doesn NOT imply that aes engine is unused!
2590 static void sm_handle_random_result(uint8_t * data){
2591 
2592 #ifdef USE_MBEDTLS_FOR_ECDH
2593     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
2594         int num_bytes = setup->sm_passkey_bit;
2595         if (num_bytes < 32){
2596             memcpy(&setup->sm_peer_qx[num_bytes], data, 8);
2597         } else {
2598             memcpy(&setup->sm_peer_qx[num_bytes-32], data, 8);
2599         }
2600         num_bytes += 8;
2601         setup->sm_passkey_bit = num_bytes;
2602 
2603         if (num_bytes >= 64){
2604             // generate EC key
2605             setup->sm_passkey_bit = 0;
2606             mbedtls_ecp_gen_key(MBEDTLS_ECP_DP_SECP256R1, &le_keypair, &sm_generate_f_rng, NULL);
2607             sm_log_ec_keypair();
2608             ec_key_generation_state = EC_KEY_GENERATION_DONE;
2609         }
2610     }
2611 #endif
2612 
2613     switch (rau_state){
2614         case RAU_W4_RANDOM:
2615             // non-resolvable vs. resolvable
2616             switch (gap_random_adress_type){
2617                 case GAP_RANDOM_ADDRESS_RESOLVABLE:
2618                     // resolvable: use random as prand and calc address hash
2619                     // "The two most significant bits of prand shall be equal to ‘0’ and ‘1"
2620                     memcpy(sm_random_address, data, 3);
2621                     sm_random_address[0] &= 0x3f;
2622                     sm_random_address[0] |= 0x40;
2623                     rau_state = RAU_GET_ENC;
2624                     break;
2625                 case GAP_RANDOM_ADDRESS_NON_RESOLVABLE:
2626                 default:
2627                     // "The two most significant bits of the address shall be equal to ‘0’""
2628                     memcpy(sm_random_address, data, 6);
2629                     sm_random_address[0] &= 0x3f;
2630                     rau_state = RAU_SET_ADDRESS;
2631                     break;
2632             }
2633             return;
2634         default:
2635             break;
2636     }
2637 
2638     // retrieve sm_connection provided to sm_random_start
2639     sm_connection_t * connection = (sm_connection_t *) sm_random_context;
2640     if (!connection) return;
2641     switch (connection->sm_engine_state){
2642 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2643         case SM_SC_W4_GET_RANDOM_A:
2644             memcpy(&setup->sm_local_nonce[0], data, 8);
2645             connection->sm_engine_state = SM_SC_W2_GET_RANDOM_B;
2646             break;
2647         case SM_SC_W4_GET_RANDOM_B:
2648             memcpy(&setup->sm_local_nonce[8], data, 8);
2649             // initiator & jw/nc -> send pairing random
2650             if (connection->sm_role == 0 && sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
2651                 connection->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
2652                 break;
2653             } else {
2654                 connection->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
2655             }
2656             break;
2657 #endif
2658 
2659         case SM_PH2_W4_RANDOM_TK:
2660         {
2661             // map random to 0-999999 without speding much cycles on a modulus operation
2662             uint32_t tk = little_endian_read_32(data,0);
2663             tk = tk & 0xfffff;  // 1048575
2664             if (tk >= 999999){
2665                 tk = tk - 999999;
2666             }
2667             sm_reset_tk();
2668             big_endian_store_32(setup->sm_tk, 12, tk);
2669             if (connection->sm_role){
2670                 connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
2671             } else {
2672                 connection->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
2673                 sm_trigger_user_response(connection);
2674                 // response_idle == nothing <--> sm_trigger_user_response() did not require response
2675                 if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
2676                     connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
2677                 }
2678             }
2679             return;
2680         }
2681         case SM_PH2_C1_W4_RANDOM_A:
2682             memcpy(&setup->sm_local_random[0], data, 8); // random endinaness
2683             connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_B;
2684             return;
2685         case SM_PH2_C1_W4_RANDOM_B:
2686             memcpy(&setup->sm_local_random[8], data, 8); // random endinaness
2687             connection->sm_engine_state = SM_PH2_C1_GET_ENC_A;
2688             return;
2689         case SM_PH3_W4_RANDOM:
2690             reverse_64(data, setup->sm_local_rand);
2691             // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
2692             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xf0) + (connection->sm_actual_encryption_key_size - 1);
2693             // no db for authenticated flag hack: store flag in bit 4 of LSB
2694             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xef) + (connection->sm_connection_authenticated << 4);
2695             connection->sm_engine_state = SM_PH3_GET_DIV;
2696             return;
2697         case SM_PH3_W4_DIV:
2698             // use 16 bit from random value as div
2699             setup->sm_local_div = big_endian_read_16(data, 0);
2700             log_info_hex16("div", setup->sm_local_div);
2701             connection->sm_engine_state = SM_PH3_Y_GET_ENC;
2702             return;
2703         default:
2704             break;
2705     }
2706 }
2707 
2708 static void sm_event_packet_handler (uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
2709 
2710     sm_connection_t  * sm_conn;
2711     hci_con_handle_t con_handle;
2712 
2713     switch (packet_type) {
2714 
2715 		case HCI_EVENT_PACKET:
2716 			switch (hci_event_packet_get_type(packet)) {
2717 
2718                 case BTSTACK_EVENT_STATE:
2719 					// bt stack activated, get started
2720 					if (btstack_event_state_get_state(packet) == HCI_STATE_WORKING){
2721                         log_info("HCI Working!");
2722                         dkg_state = sm_persistent_irk_ready ? DKG_CALC_DHK : DKG_CALC_IRK;
2723                         rau_state = RAU_IDLE;
2724 #ifdef USE_MBEDTLS_FOR_ECDH
2725                         if (!test_use_fixed_ec_keypair){
2726                             setup->sm_passkey_bit = 0;
2727                             ec_key_generation_state = EC_KEY_GENERATION_ACTIVE;
2728                         }
2729 #endif
2730                         sm_run();
2731 					}
2732 					break;
2733 
2734                 case HCI_EVENT_LE_META:
2735                     switch (packet[2]) {
2736                         case HCI_SUBEVENT_LE_CONNECTION_COMPLETE:
2737 
2738                             log_info("sm: connected");
2739 
2740                             if (packet[3]) return; // connection failed
2741 
2742                             con_handle = little_endian_read_16(packet, 4);
2743                             sm_conn = sm_get_connection_for_handle(con_handle);
2744                             if (!sm_conn) break;
2745 
2746                             sm_conn->sm_handle = con_handle;
2747                             sm_conn->sm_role = packet[6];
2748                             sm_conn->sm_peer_addr_type = packet[7];
2749                             reverse_bd_addr(&packet[8],
2750                                             sm_conn->sm_peer_address);
2751 
2752                             log_info("New sm_conn, role %s", sm_conn->sm_role ? "slave" : "master");
2753 
2754                             // reset security properties
2755                             sm_conn->sm_connection_encrypted = 0;
2756                             sm_conn->sm_connection_authenticated = 0;
2757                             sm_conn->sm_connection_authorization_state = AUTHORIZATION_UNKNOWN;
2758                             sm_conn->sm_le_db_index = -1;
2759 
2760                             // prepare CSRK lookup (does not involve setup)
2761                             sm_conn->sm_irk_lookup_state = IRK_LOOKUP_W4_READY;
2762 
2763                             // just connected -> everything else happens in sm_run()
2764                             if (sm_conn->sm_role){
2765                                 // slave - state already could be SM_RESPONDER_SEND_SECURITY_REQUEST instead
2766                                 if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
2767                                     if (sm_slave_request_security) {
2768                                         // request security if requested by app
2769                                         sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
2770                                     } else {
2771                                         // otherwise, wait for pairing request
2772                                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
2773                                     }
2774                                 }
2775                                 break;
2776                             } else {
2777                                 // master
2778                                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2779                             }
2780                             break;
2781 
2782                         case HCI_SUBEVENT_LE_LONG_TERM_KEY_REQUEST:
2783                             con_handle = little_endian_read_16(packet, 3);
2784                             sm_conn = sm_get_connection_for_handle(con_handle);
2785                             if (!sm_conn) break;
2786 
2787                             log_info("LTK Request: state %u", sm_conn->sm_engine_state);
2788                             if (sm_conn->sm_engine_state == SM_RESPONDER_PH2_W4_LTK_REQUEST){
2789                                 sm_conn->sm_engine_state = SM_PH2_CALC_STK;
2790                                 break;
2791                             }
2792                             if (sm_conn->sm_engine_state == SM_SC_W4_LTK_REQUEST_SC){
2793                                 sm_conn->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2794                                 break;
2795                             }
2796 
2797                             // store rand and ediv
2798                             reverse_64(&packet[5], sm_conn->sm_local_rand);
2799                             sm_conn->sm_local_ediv   = little_endian_read_16(packet, 13);
2800                             sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK;
2801                             break;
2802 
2803                         default:
2804                             break;
2805                     }
2806                     break;
2807 
2808                 case HCI_EVENT_ENCRYPTION_CHANGE:
2809                     con_handle = little_endian_read_16(packet, 3);
2810                     sm_conn = sm_get_connection_for_handle(con_handle);
2811                     if (!sm_conn) break;
2812 
2813                     sm_conn->sm_connection_encrypted = packet[5];
2814                     log_info("Encryption state change: %u, key size %u", sm_conn->sm_connection_encrypted,
2815                         sm_conn->sm_actual_encryption_key_size);
2816                     log_info("event handler, state %u", sm_conn->sm_engine_state);
2817                     if (!sm_conn->sm_connection_encrypted) break;
2818                     // continue if part of initial pairing
2819                     switch (sm_conn->sm_engine_state){
2820                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
2821                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2822                             sm_done_for_handle(sm_conn->sm_handle);
2823                             break;
2824                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
2825                             if (sm_conn->sm_role){
2826                                 // slave
2827                                 if (setup->sm_use_secure_connections){
2828                                     sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
2829                                 } else {
2830                                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
2831                                 }
2832                             } else {
2833                                 // master
2834                                 if (sm_key_distribution_all_received(sm_conn)){
2835                                     // skip receiving keys as there are none
2836                                     sm_key_distribution_handle_all_received(sm_conn);
2837                                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
2838                                 } else {
2839                                     sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2840                                 }
2841                             }
2842                             break;
2843                         default:
2844                             break;
2845                     }
2846                     break;
2847 
2848                 case HCI_EVENT_ENCRYPTION_KEY_REFRESH_COMPLETE:
2849                     con_handle = little_endian_read_16(packet, 3);
2850                     sm_conn = sm_get_connection_for_handle(con_handle);
2851                     if (!sm_conn) break;
2852 
2853                     log_info("Encryption key refresh complete, key size %u", sm_conn->sm_actual_encryption_key_size);
2854                     log_info("event handler, state %u", sm_conn->sm_engine_state);
2855                     // continue if part of initial pairing
2856                     switch (sm_conn->sm_engine_state){
2857                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
2858                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2859                             sm_done_for_handle(sm_conn->sm_handle);
2860                             break;
2861                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
2862                             if (sm_conn->sm_role){
2863                                 // slave
2864                                 sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
2865                             } else {
2866                                 // master
2867                                 sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2868                             }
2869                             break;
2870                         default:
2871                             break;
2872                     }
2873                     break;
2874 
2875 
2876                 case HCI_EVENT_DISCONNECTION_COMPLETE:
2877                     con_handle = little_endian_read_16(packet, 3);
2878                     sm_done_for_handle(con_handle);
2879                     sm_conn = sm_get_connection_for_handle(con_handle);
2880                     if (!sm_conn) break;
2881 
2882                     // delete stored bonding on disconnect with authentication failure in ph0
2883                     if (sm_conn->sm_role == 0
2884                         && sm_conn->sm_engine_state == SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED
2885                         && packet[2] == ERROR_CODE_AUTHENTICATION_FAILURE){
2886                         le_device_db_remove(sm_conn->sm_le_db_index);
2887                     }
2888 
2889                     sm_conn->sm_engine_state = SM_GENERAL_IDLE;
2890                     sm_conn->sm_handle = 0;
2891                     break;
2892 
2893 				case HCI_EVENT_COMMAND_COMPLETE:
2894                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_encrypt)){
2895                         sm_handle_encryption_result(&packet[6]);
2896                         break;
2897                     }
2898                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_rand)){
2899                         sm_handle_random_result(&packet[6]);
2900                         break;
2901                     }
2902                     break;
2903                 default:
2904                     break;
2905 			}
2906             break;
2907         default:
2908             break;
2909 	}
2910 
2911     sm_run();
2912 }
2913 
2914 static inline int sm_calc_actual_encryption_key_size(int other){
2915     if (other < sm_min_encryption_key_size) return 0;
2916     if (other < sm_max_encryption_key_size) return other;
2917     return sm_max_encryption_key_size;
2918 }
2919 
2920 
2921 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method){
2922     switch (method){
2923         case JUST_WORKS:
2924         case NK_BOTH_INPUT:
2925             return 1;
2926         default:
2927             return 0;
2928     }
2929 }
2930 // responder
2931 
2932 static int sm_passkey_used(stk_generation_method_t method){
2933     switch (method){
2934         case PK_RESP_INPUT:
2935             return 1;
2936         default:
2937             return 0;
2938     }
2939 }
2940 
2941 /**
2942  * @return ok
2943  */
2944 static int sm_validate_stk_generation_method(void){
2945     // check if STK generation method is acceptable by client
2946     switch (setup->sm_stk_generation_method){
2947         case JUST_WORKS:
2948             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_JUST_WORKS) != 0;
2949         case PK_RESP_INPUT:
2950         case PK_INIT_INPUT:
2951         case OK_BOTH_INPUT:
2952             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_PASSKEY) != 0;
2953         case OOB:
2954             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_OOB) != 0;
2955         case NK_BOTH_INPUT:
2956             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON) != 0;
2957             return 1;
2958         default:
2959             return 0;
2960     }
2961 }
2962 
2963 static void sm_pdu_handler(uint8_t packet_type, hci_con_handle_t con_handle, uint8_t *packet, uint16_t size){
2964 
2965     if (packet_type == HCI_EVENT_PACKET && packet[0] == L2CAP_EVENT_CAN_SEND_NOW){
2966         sm_run();
2967     }
2968 
2969     if (packet_type != SM_DATA_PACKET) return;
2970 
2971     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
2972     if (!sm_conn) return;
2973 
2974     if (packet[0] == SM_CODE_PAIRING_FAILED){
2975         sm_conn->sm_engine_state = sm_conn->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
2976         return;
2977     }
2978 
2979     log_debug("sm_pdu_handler: state %u, pdu 0x%02x", sm_conn->sm_engine_state, packet[0]);
2980 
2981     int err;
2982 
2983     switch (sm_conn->sm_engine_state){
2984 
2985         // a sm timeout requries a new physical connection
2986         case SM_GENERAL_TIMEOUT:
2987             return;
2988 
2989         // Initiator
2990         case SM_INITIATOR_CONNECTED:
2991             if ((packet[0] != SM_CODE_SECURITY_REQUEST) || (sm_conn->sm_role)){
2992                 sm_pdu_received_in_wrong_state(sm_conn);
2993                 break;
2994             }
2995             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_FAILED){
2996                 sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
2997                 break;
2998             }
2999             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_SUCCEEDED){
3000                 uint16_t ediv;
3001                 le_device_db_encryption_get(sm_conn->sm_le_db_index, &ediv, NULL, NULL, NULL, NULL, NULL);
3002                 if (ediv){
3003                     log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3004                     sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3005                 } else {
3006                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3007                 }
3008                 break;
3009             }
3010             // otherwise, store security request
3011             sm_conn->sm_security_request_received = 1;
3012             break;
3013 
3014         case SM_INITIATOR_PH1_W4_PAIRING_RESPONSE:
3015             if (packet[0] != SM_CODE_PAIRING_RESPONSE){
3016                 sm_pdu_received_in_wrong_state(sm_conn);
3017                 break;
3018             }
3019             // store pairing request
3020             memcpy(&setup->sm_s_pres, packet, sizeof(sm_pairing_packet_t));
3021             err = sm_stk_generation_init(sm_conn);
3022             if (err){
3023                 setup->sm_pairing_failed_reason = err;
3024                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3025                 break;
3026             }
3027 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3028             if (setup->sm_use_secure_connections){
3029                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
3030                 if (setup->sm_stk_generation_method == JUST_WORKS){
3031                     sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3032                     sm_trigger_user_response(sm_conn);
3033                     if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3034                         sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3035                     }
3036                 } else {
3037                     sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3038                 }
3039                 break;
3040             }
3041 #endif
3042             // generate random number first, if we need to show passkey
3043             if (setup->sm_stk_generation_method == PK_RESP_INPUT){
3044                 sm_conn->sm_engine_state = SM_PH2_GET_RANDOM_TK;
3045                 break;
3046             }
3047             sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3048             sm_trigger_user_response(sm_conn);
3049             // response_idle == nothing <--> sm_trigger_user_response() did not require response
3050             if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3051                 sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3052             }
3053             break;
3054 
3055         case SM_INITIATOR_PH2_W4_PAIRING_CONFIRM:
3056             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3057                 sm_pdu_received_in_wrong_state(sm_conn);
3058                 break;
3059             }
3060 
3061             // store s_confirm
3062             reverse_128(&packet[1], setup->sm_peer_confirm);
3063             sm_conn->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
3064             break;
3065 
3066         case SM_INITIATOR_PH2_W4_PAIRING_RANDOM:
3067             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3068                 sm_pdu_received_in_wrong_state(sm_conn);
3069                 break;;
3070             }
3071 
3072             // received random value
3073             reverse_128(&packet[1], setup->sm_peer_random);
3074             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3075             break;
3076 
3077         // Responder
3078         case SM_RESPONDER_IDLE:
3079         case SM_RESPONDER_SEND_SECURITY_REQUEST:
3080         case SM_RESPONDER_PH1_W4_PAIRING_REQUEST:
3081             if (packet[0] != SM_CODE_PAIRING_REQUEST){
3082                 sm_pdu_received_in_wrong_state(sm_conn);
3083                 break;;
3084             }
3085 
3086             // store pairing request
3087             memcpy(&sm_conn->sm_m_preq, packet, sizeof(sm_pairing_packet_t));
3088             sm_conn->sm_engine_state = SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED;
3089             break;
3090 
3091 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3092         case SM_SC_W4_PUBLIC_KEY_COMMAND:
3093             if (packet[0] != SM_CODE_PAIRING_PUBLIC_KEY){
3094                 sm_pdu_received_in_wrong_state(sm_conn);
3095                 break;
3096             }
3097 
3098             // store public key for DH Key calculation
3099             reverse_256(&packet[01], setup->sm_peer_qx);
3100             reverse_256(&packet[33], setup->sm_peer_qy);
3101 
3102 #ifdef USE_MBEDTLS_FOR_ECDH
3103             // validate public key
3104             mbedtls_ecp_group grp;
3105             mbedtls_ecp_group_init( &grp );
3106             mbedtls_ecp_group_load(&grp, MBEDTLS_ECP_DP_SECP256R1);
3107 
3108             mbedtls_ecp_point Q;
3109             mbedtls_ecp_point_init( &Q );
3110             mbedtls_mpi_read_binary(&Q.X, setup->sm_peer_qx, 32);
3111             mbedtls_mpi_read_binary(&Q.Y, setup->sm_peer_qy, 32);
3112             mbedtls_mpi_read_string(&Q.Z, 16, "1" );
3113             err = mbedtls_ecp_check_pubkey(&grp, &Q);
3114             if (err){
3115                 log_error("sm: peer public key invalid %x", err);
3116                 // uses "unspecified reason", there is no "public key invalid" error code
3117                 sm_pdu_received_in_wrong_state(sm_conn);
3118                 break;
3119             }
3120 #endif
3121             if (sm_conn->sm_role){
3122                 // responder
3123                 sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3124             } else {
3125                 // initiator
3126                 // stk generation method
3127                 // passkey entry: notify app to show passkey or to request passkey
3128                 switch (setup->sm_stk_generation_method){
3129                     case JUST_WORKS:
3130                     case NK_BOTH_INPUT:
3131                         sm_conn->sm_engine_state = SM_SC_W4_CONFIRMATION;
3132                         break;
3133                     case PK_RESP_INPUT:
3134                         sm_sc_start_calculating_local_confirm(sm_conn);
3135                         break;
3136                     case PK_INIT_INPUT:
3137                     case OK_BOTH_INPUT:
3138                         if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3139                             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3140                             break;
3141                         }
3142                         sm_sc_start_calculating_local_confirm(sm_conn);
3143                         break;
3144                     case OOB:
3145                         // TODO: implement SC OOB
3146                         break;
3147                 }
3148             }
3149             break;
3150 
3151         case SM_SC_W4_CONFIRMATION:
3152             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3153                 sm_pdu_received_in_wrong_state(sm_conn);
3154                 break;
3155             }
3156             // received confirm value
3157             reverse_128(&packet[1], setup->sm_peer_confirm);
3158 
3159             if (sm_conn->sm_role){
3160                 // responder
3161                 if (sm_passkey_used(setup->sm_stk_generation_method)){
3162                     if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3163                         // still waiting for passkey
3164                         sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3165                         break;
3166                     }
3167                 }
3168                 sm_sc_start_calculating_local_confirm(sm_conn);
3169             } else {
3170                 // initiator
3171                 if (sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
3172                     sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
3173                 } else {
3174                     sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
3175                 }
3176             }
3177             break;
3178 
3179         case SM_SC_W4_PAIRING_RANDOM:
3180             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3181                 sm_pdu_received_in_wrong_state(sm_conn);
3182                 break;
3183             }
3184 
3185             // received random value
3186             reverse_128(&packet[1], setup->sm_peer_nonce);
3187 
3188             // validate confirm value if Cb = f4(Pkb, Pka, Nb, z)
3189             // only check for JUST WORK/NC in initiator role AND passkey entry
3190             int passkey_entry = sm_passkey_used(setup->sm_stk_generation_method);
3191             if (sm_conn->sm_role || passkey_entry) {
3192                  sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION;
3193             }
3194 
3195             sm_sc_state_after_receiving_random(sm_conn);
3196             break;
3197 
3198         case SM_SC_W2_CALCULATE_G2:
3199         case SM_SC_W4_CALCULATE_G2:
3200         case SM_SC_W2_CALCULATE_F5_SALT:
3201         case SM_SC_W4_CALCULATE_F5_SALT:
3202         case SM_SC_W2_CALCULATE_F5_MACKEY:
3203         case SM_SC_W4_CALCULATE_F5_MACKEY:
3204         case SM_SC_W2_CALCULATE_F5_LTK:
3205         case SM_SC_W4_CALCULATE_F5_LTK:
3206         case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
3207         case SM_SC_W4_DHKEY_CHECK_COMMAND:
3208         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
3209             if (packet[0] != SM_CODE_PAIRING_DHKEY_CHECK){
3210                 sm_pdu_received_in_wrong_state(sm_conn);
3211                 break;
3212             }
3213             // store DHKey Check
3214             setup->sm_state_vars |= SM_STATE_VAR_DHKEY_COMMAND_RECEIVED;
3215             reverse_128(&packet[01], setup->sm_peer_dhkey_check);
3216 
3217             // have we been only waiting for dhkey check command?
3218             if (sm_conn->sm_engine_state == SM_SC_W4_DHKEY_CHECK_COMMAND){
3219                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
3220             }
3221             break;
3222 #endif
3223 
3224         case SM_RESPONDER_PH1_W4_PAIRING_CONFIRM:
3225             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3226                 sm_pdu_received_in_wrong_state(sm_conn);
3227                 break;
3228             }
3229 
3230             // received confirm value
3231             reverse_128(&packet[1], setup->sm_peer_confirm);
3232 
3233             // notify client to hide shown passkey
3234             if (setup->sm_stk_generation_method == PK_INIT_INPUT){
3235                 sm_notify_client_base(SM_EVENT_PASSKEY_DISPLAY_CANCEL, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
3236             }
3237 
3238             // handle user cancel pairing?
3239             if (setup->sm_user_response == SM_USER_RESPONSE_DECLINE){
3240                 setup->sm_pairing_failed_reason = SM_REASON_PASSKEYT_ENTRY_FAILED;
3241                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3242                 break;
3243             }
3244 
3245             // wait for user action?
3246             if (setup->sm_user_response == SM_USER_RESPONSE_PENDING){
3247                 sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3248                 break;
3249             }
3250 
3251             // calculate and send local_confirm
3252             sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3253             break;
3254 
3255         case SM_RESPONDER_PH2_W4_PAIRING_RANDOM:
3256             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3257                 sm_pdu_received_in_wrong_state(sm_conn);
3258                 break;;
3259             }
3260 
3261             // received random value
3262             reverse_128(&packet[1], setup->sm_peer_random);
3263             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3264             break;
3265 
3266         case SM_PH3_RECEIVE_KEYS:
3267             switch(packet[0]){
3268                 case SM_CODE_ENCRYPTION_INFORMATION:
3269                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
3270                     reverse_128(&packet[1], setup->sm_peer_ltk);
3271                     break;
3272 
3273                 case SM_CODE_MASTER_IDENTIFICATION:
3274                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
3275                     setup->sm_peer_ediv = little_endian_read_16(packet, 1);
3276                     reverse_64(&packet[3], setup->sm_peer_rand);
3277                     break;
3278 
3279                 case SM_CODE_IDENTITY_INFORMATION:
3280                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
3281                     reverse_128(&packet[1], setup->sm_peer_irk);
3282                     break;
3283 
3284                 case SM_CODE_IDENTITY_ADDRESS_INFORMATION:
3285                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
3286                     setup->sm_peer_addr_type = packet[1];
3287                     reverse_bd_addr(&packet[2], setup->sm_peer_address);
3288                     break;
3289 
3290                 case SM_CODE_SIGNING_INFORMATION:
3291                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
3292                     reverse_128(&packet[1], setup->sm_peer_csrk);
3293                     break;
3294                 default:
3295                     // Unexpected PDU
3296                     log_info("Unexpected PDU %u in SM_PH3_RECEIVE_KEYS", packet[0]);
3297                     break;
3298             }
3299             // done with key distribution?
3300             if (sm_key_distribution_all_received(sm_conn)){
3301 
3302                 sm_key_distribution_handle_all_received(sm_conn);
3303 
3304                 if (sm_conn->sm_role){
3305                     sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
3306                     sm_done_for_handle(sm_conn->sm_handle);
3307                 } else {
3308                     if (setup->sm_use_secure_connections){
3309                         sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
3310                     } else {
3311                         sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3312                     }
3313                 }
3314             }
3315             break;
3316         default:
3317             // Unexpected PDU
3318             log_info("Unexpected PDU %u in state %u", packet[0], sm_conn->sm_engine_state);
3319             break;
3320     }
3321 
3322     // try to send preparared packet
3323     sm_run();
3324 }
3325 
3326 // Security Manager Client API
3327 void sm_register_oob_data_callback( int (*get_oob_data_callback)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data)){
3328     sm_get_oob_data = get_oob_data_callback;
3329 }
3330 
3331 void sm_add_event_handler(btstack_packet_callback_registration_t * callback_handler){
3332     btstack_linked_list_add_tail(&sm_event_handlers, (btstack_linked_item_t*) callback_handler);
3333 }
3334 
3335 void sm_set_accepted_stk_generation_methods(uint8_t accepted_stk_generation_methods){
3336     sm_accepted_stk_generation_methods = accepted_stk_generation_methods;
3337 }
3338 
3339 void sm_set_encryption_key_size_range(uint8_t min_size, uint8_t max_size){
3340 	sm_min_encryption_key_size = min_size;
3341 	sm_max_encryption_key_size = max_size;
3342 }
3343 
3344 void sm_set_authentication_requirements(uint8_t auth_req){
3345     sm_auth_req = auth_req;
3346 }
3347 
3348 void sm_set_io_capabilities(io_capability_t io_capability){
3349     sm_io_capabilities = io_capability;
3350 }
3351 
3352 void sm_set_request_security(int enable){
3353     sm_slave_request_security = enable;
3354 }
3355 
3356 void sm_set_er(sm_key_t er){
3357     memcpy(sm_persistent_er, er, 16);
3358 }
3359 
3360 void sm_set_ir(sm_key_t ir){
3361     memcpy(sm_persistent_ir, ir, 16);
3362 }
3363 
3364 // Testing support only
3365 void sm_test_set_irk(sm_key_t irk){
3366     memcpy(sm_persistent_irk, irk, 16);
3367     sm_persistent_irk_ready = 1;
3368 }
3369 
3370 void sm_test_use_fixed_local_csrk(void){
3371     test_use_fixed_local_csrk = 1;
3372 }
3373 
3374 void sm_init(void){
3375     // set some (BTstack default) ER and IR
3376     int i;
3377     sm_key_t er;
3378     sm_key_t ir;
3379     for (i=0;i<16;i++){
3380         er[i] = 0x30 + i;
3381         ir[i] = 0x90 + i;
3382     }
3383     sm_set_er(er);
3384     sm_set_ir(ir);
3385     // defaults
3386     sm_accepted_stk_generation_methods = SM_STK_GENERATION_METHOD_JUST_WORKS
3387                                        | SM_STK_GENERATION_METHOD_OOB
3388                                        | SM_STK_GENERATION_METHOD_PASSKEY
3389                                        | SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON;
3390 
3391     sm_max_encryption_key_size = 16;
3392     sm_min_encryption_key_size = 7;
3393 
3394     sm_cmac_state  = CMAC_IDLE;
3395     dkg_state = DKG_W4_WORKING;
3396     rau_state = RAU_W4_WORKING;
3397     sm_aes128_state = SM_AES128_IDLE;
3398     sm_address_resolution_test = -1;    // no private address to resolve yet
3399     sm_address_resolution_ah_calculation_active = 0;
3400     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
3401     sm_address_resolution_general_queue = NULL;
3402 
3403     gap_random_adress_update_period = 15 * 60 * 1000L;
3404 
3405     sm_active_connection = 0;
3406 
3407     test_use_fixed_local_csrk = 0;
3408 
3409     // register for HCI Events from HCI
3410     hci_event_callback_registration.callback = &sm_event_packet_handler;
3411     hci_add_event_handler(&hci_event_callback_registration);
3412 
3413     // and L2CAP PDUs + L2CAP_EVENT_CAN_SEND_NOW
3414     l2cap_register_fixed_channel(sm_pdu_handler, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
3415 
3416 #ifdef USE_MBEDTLS_FOR_ECDH
3417     ec_key_generation_state = EC_KEY_GENERATION_IDLE;
3418 #endif
3419 }
3420 
3421 void sm_test_use_fixed_ec_keypair(void){
3422     test_use_fixed_ec_keypair = 1;
3423 #ifdef USE_MBEDTLS_FOR_ECDH
3424     // use test keypair from spec
3425     mbedtls_ecp_keypair_init(&le_keypair);
3426     mbedtls_ecp_group_load(&le_keypair.grp, MBEDTLS_ECP_DP_SECP256R1);
3427     mbedtls_mpi_read_string( &le_keypair.d,   16, "3f49f6d4a3c55f3874c9b3e3d2103f504aff607beb40b7995899b8a6cd3c1abd");
3428     mbedtls_mpi_read_string( &le_keypair.Q.X, 16, "20b003d2f297be2c5e2c83a7e9f9a5b9eff49111acf4fddbcc0301480e359de6");
3429     mbedtls_mpi_read_string( &le_keypair.Q.Y, 16, "dc809c49652aeb6d63329abf5a52155c766345c28fed3024741c8ed01589d28b");
3430     mbedtls_mpi_read_string( &le_keypair.Q.Z, 16, "1");
3431 #endif
3432 }
3433 
3434 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle){
3435     hci_connection_t * hci_con = hci_connection_for_handle(con_handle);
3436     if (!hci_con) return NULL;
3437     return &hci_con->sm_connection;
3438 }
3439 
3440 // @returns 0 if not encrypted, 7-16 otherwise
3441 int sm_encryption_key_size(hci_con_handle_t con_handle){
3442     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3443     if (!sm_conn) return 0;     // wrong connection
3444     if (!sm_conn->sm_connection_encrypted) return 0;
3445     return sm_conn->sm_actual_encryption_key_size;
3446 }
3447 
3448 int sm_authenticated(hci_con_handle_t con_handle){
3449     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3450     if (!sm_conn) return 0;     // wrong connection
3451     if (!sm_conn->sm_connection_encrypted) return 0; // unencrypted connection cannot be authenticated
3452     return sm_conn->sm_connection_authenticated;
3453 }
3454 
3455 authorization_state_t sm_authorization_state(hci_con_handle_t con_handle){
3456     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3457     if (!sm_conn) return AUTHORIZATION_UNKNOWN;     // wrong connection
3458     if (!sm_conn->sm_connection_encrypted)               return AUTHORIZATION_UNKNOWN; // unencrypted connection cannot be authorized
3459     if (!sm_conn->sm_connection_authenticated)           return AUTHORIZATION_UNKNOWN; // unauthenticatd connection cannot be authorized
3460     return sm_conn->sm_connection_authorization_state;
3461 }
3462 
3463 static void sm_send_security_request_for_connection(sm_connection_t * sm_conn){
3464     switch (sm_conn->sm_engine_state){
3465         case SM_GENERAL_IDLE:
3466         case SM_RESPONDER_IDLE:
3467             sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
3468             sm_run();
3469             break;
3470         default:
3471             break;
3472     }
3473 }
3474 
3475 /**
3476  * @brief Trigger Security Request
3477  */
3478 void sm_send_security_request(hci_con_handle_t con_handle){
3479     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3480     if (!sm_conn) return;
3481     sm_send_security_request_for_connection(sm_conn);
3482 }
3483 
3484 // request pairing
3485 void sm_request_pairing(hci_con_handle_t con_handle){
3486     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3487     if (!sm_conn) return;     // wrong connection
3488 
3489     log_info("sm_request_pairing in role %u, state %u", sm_conn->sm_role, sm_conn->sm_engine_state);
3490     if (sm_conn->sm_role){
3491         sm_send_security_request_for_connection(sm_conn);
3492     } else {
3493         // used as a trigger to start central/master/initiator security procedures
3494         uint16_t ediv;
3495         if (sm_conn->sm_engine_state == SM_INITIATOR_CONNECTED){
3496             switch (sm_conn->sm_irk_lookup_state){
3497                 case IRK_LOOKUP_FAILED:
3498                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3499                     break;
3500                 case IRK_LOOKUP_SUCCEEDED:
3501                         le_device_db_encryption_get(sm_conn->sm_le_db_index, &ediv, NULL, NULL, NULL, NULL, NULL);
3502                         if (ediv){
3503                             log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3504                             sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3505                         } else {
3506                             sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3507                         }
3508                         break;
3509                 default:
3510                     sm_conn->sm_bonding_requested = 1;
3511                     break;
3512             }
3513         } else if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
3514             sm_conn->sm_bonding_requested = 1;
3515         }
3516     }
3517     sm_run();
3518 }
3519 
3520 // called by client app on authorization request
3521 void sm_authorization_decline(hci_con_handle_t con_handle){
3522     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3523     if (!sm_conn) return;     // wrong connection
3524     sm_conn->sm_connection_authorization_state = AUTHORIZATION_DECLINED;
3525     sm_notify_client_authorization(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 0);
3526 }
3527 
3528 void sm_authorization_grant(hci_con_handle_t con_handle){
3529     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3530     if (!sm_conn) return;     // wrong connection
3531     sm_conn->sm_connection_authorization_state = AUTHORIZATION_GRANTED;
3532     sm_notify_client_authorization(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 1);
3533 }
3534 
3535 // GAP Bonding API
3536 
3537 void sm_bonding_decline(hci_con_handle_t con_handle){
3538     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3539     if (!sm_conn) return;     // wrong connection
3540     setup->sm_user_response = SM_USER_RESPONSE_DECLINE;
3541 
3542     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3543         switch (setup->sm_stk_generation_method){
3544             case PK_RESP_INPUT:
3545             case PK_INIT_INPUT:
3546             case OK_BOTH_INPUT:
3547                 sm_pairing_error(sm_conn, SM_GENERAL_SEND_PAIRING_FAILED);
3548                 break;
3549             case NK_BOTH_INPUT:
3550                 sm_pairing_error(sm_conn, SM_REASON_NUMERIC_COMPARISON_FAILED);
3551                 break;
3552             case JUST_WORKS:
3553             case OOB:
3554                 sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
3555                 break;
3556         }
3557     }
3558     sm_run();
3559 }
3560 
3561 void sm_just_works_confirm(hci_con_handle_t con_handle){
3562     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3563     if (!sm_conn) return;     // wrong connection
3564     setup->sm_user_response = SM_USER_RESPONSE_CONFIRM;
3565     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3566         if (setup->sm_use_secure_connections){
3567             sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3568         } else {
3569             sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3570         }
3571     }
3572 
3573 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3574     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
3575         sm_sc_prepare_dhkey_check(sm_conn);
3576     }
3577 #endif
3578 
3579     sm_run();
3580 }
3581 
3582 void sm_numeric_comparison_confirm(hci_con_handle_t con_handle){
3583     // for now, it's the same
3584     sm_just_works_confirm(con_handle);
3585 }
3586 
3587 void sm_passkey_input(hci_con_handle_t con_handle, uint32_t passkey){
3588     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3589     if (!sm_conn) return;     // wrong connection
3590     sm_reset_tk();
3591     big_endian_store_32(setup->sm_tk, 12, passkey);
3592     setup->sm_user_response = SM_USER_RESPONSE_PASSKEY;
3593     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3594         sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3595     }
3596 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3597     memcpy(setup->sm_ra, setup->sm_tk, 16);
3598     memcpy(setup->sm_rb, setup->sm_tk, 16);
3599     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
3600         sm_sc_start_calculating_local_confirm(sm_conn);
3601     }
3602 #endif
3603     sm_run();
3604 }
3605 
3606 /**
3607  * @brief Identify device in LE Device DB
3608  * @param handle
3609  * @returns index from le_device_db or -1 if not found/identified
3610  */
3611 int sm_le_device_index(hci_con_handle_t con_handle ){
3612     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3613     if (!sm_conn) return -1;
3614     return sm_conn->sm_le_db_index;
3615 }
3616 
3617 // GAP LE API
3618 void gap_random_address_set_mode(gap_random_address_type_t random_address_type){
3619     gap_random_address_update_stop();
3620     gap_random_adress_type = random_address_type;
3621     if (random_address_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return;
3622     gap_random_address_update_start();
3623     gap_random_address_trigger();
3624 }
3625 
3626 gap_random_address_type_t gap_random_address_get_mode(void){
3627     return gap_random_adress_type;
3628 }
3629 
3630 void gap_random_address_set_update_period(int period_ms){
3631     gap_random_adress_update_period = period_ms;
3632     if (gap_random_adress_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return;
3633     gap_random_address_update_stop();
3634     gap_random_address_update_start();
3635 }
3636 
3637 void gap_random_address_set(bd_addr_t addr){
3638     gap_random_address_set_mode(GAP_RANDOM_ADDRESS_TYPE_OFF);
3639     memcpy(sm_random_address, addr, 6);
3640     rau_state = RAU_SET_ADDRESS;
3641     sm_run();
3642 }
3643 
3644 /*
3645  * @brief Set Advertisement Paramters
3646  * @param adv_int_min
3647  * @param adv_int_max
3648  * @param adv_type
3649  * @param direct_address_type
3650  * @param direct_address
3651  * @param channel_map
3652  * @param filter_policy
3653  *
3654  * @note own_address_type is used from gap_random_address_set_mode
3655  */
3656 void gap_advertisements_set_params(uint16_t adv_int_min, uint16_t adv_int_max, uint8_t adv_type,
3657     uint8_t direct_address_typ, bd_addr_t direct_address, uint8_t channel_map, uint8_t filter_policy){
3658     hci_le_advertisements_set_params(adv_int_min, adv_int_max, adv_type, gap_random_adress_type,
3659         direct_address_typ, direct_address, channel_map, filter_policy);
3660 }
3661 
3662