xref: /btstack/src/ble/sm.c (revision f1c1783e413d281982ca9cb37a8ab5fdf2d18fdd)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #include <stdio.h>
39 #include <string.h>
40 #include <inttypes.h>
41 
42 #include "ble/le_device_db.h"
43 #include "ble/core.h"
44 #include "ble/sm.h"
45 #include "btstack_debug.h"
46 #include "btstack_event.h"
47 #include "btstack_linked_list.h"
48 #include "btstack_memory.h"
49 #include "gap.h"
50 #include "hci.h"
51 #include "l2cap.h"
52 
53 #ifdef ENABLE_LE_SECURE_CONNECTIONS
54 // TODO: remove software AES
55 #include "rijndael.h"
56 #endif
57 
58 #if defined(ENABLE_LE_SECURE_CONNECTIONS) && !defined(HAVE_HCI_CONTROLLER_DHKEY_SUPPORT)
59 #define USE_MBEDTLS_FOR_ECDH
60 #endif
61 
62 #ifdef ENABLE_LE_SECURE_CONNECTIONS
63 #ifdef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
64 #error "Support for DHKEY Support in HCI Controller not implemented yet. Please use software implementation"
65 #else
66 #define USE_MBEDTLS_FOR_ECDH
67 #endif
68 #endif
69 
70 
71 // Software ECDH implementation provided by mbedtls
72 #ifdef USE_MBEDTLS_FOR_ECDH
73 #if !defined(MBEDTLS_CONFIG_FILE)
74 #include "mbedtls/config.h"
75 #else
76 #include MBEDTLS_CONFIG_FILE
77 #endif
78 #if defined(MBEDTLS_PLATFORM_C)
79 #include "mbedtls/platform.h"
80 #else
81 #include <stdio.h>
82 #define mbedtls_printf     printf
83 #endif
84 #include "mbedtls/ecp.h"
85 #endif
86 
87 //
88 // SM internal types and globals
89 //
90 
91 typedef enum {
92     DKG_W4_WORKING,
93     DKG_CALC_IRK,
94     DKG_W4_IRK,
95     DKG_CALC_DHK,
96     DKG_W4_DHK,
97     DKG_READY
98 } derived_key_generation_t;
99 
100 typedef enum {
101     RAU_W4_WORKING,
102     RAU_IDLE,
103     RAU_GET_RANDOM,
104     RAU_W4_RANDOM,
105     RAU_GET_ENC,
106     RAU_W4_ENC,
107     RAU_SET_ADDRESS,
108 } random_address_update_t;
109 
110 typedef enum {
111     CMAC_IDLE,
112     CMAC_CALC_SUBKEYS,
113     CMAC_W4_SUBKEYS,
114     CMAC_CALC_MI,
115     CMAC_W4_MI,
116     CMAC_CALC_MLAST,
117     CMAC_W4_MLAST
118 } cmac_state_t;
119 
120 typedef enum {
121     JUST_WORKS,
122     PK_RESP_INPUT,  // Initiator displays PK, responder inputs PK
123     PK_INIT_INPUT,  // Responder displays PK, initiator inputs PK
124     OK_BOTH_INPUT,  // Only input on both, both input PK
125     NK_BOTH_INPUT,  // Only numerical compparison (yes/no) on on both sides
126     OOB             // OOB available on both sides
127 } stk_generation_method_t;
128 
129 typedef enum {
130     SM_USER_RESPONSE_IDLE,
131     SM_USER_RESPONSE_PENDING,
132     SM_USER_RESPONSE_CONFIRM,
133     SM_USER_RESPONSE_PASSKEY,
134     SM_USER_RESPONSE_DECLINE
135 } sm_user_response_t;
136 
137 typedef enum {
138     SM_AES128_IDLE,
139     SM_AES128_ACTIVE
140 } sm_aes128_state_t;
141 
142 typedef enum {
143     ADDRESS_RESOLUTION_IDLE,
144     ADDRESS_RESOLUTION_GENERAL,
145     ADDRESS_RESOLUTION_FOR_CONNECTION,
146 } address_resolution_mode_t;
147 
148 typedef enum {
149     ADDRESS_RESOLUTION_SUCEEDED,
150     ADDRESS_RESOLUTION_FAILED,
151 } address_resolution_event_t;
152 
153 typedef enum {
154     EC_KEY_GENERATION_IDLE,
155     EC_KEY_GENERATION_ACTIVE,
156     EC_KEY_GENERATION_DONE,
157 } ec_key_generation_state_t;
158 
159 typedef enum {
160     SM_STATE_VAR_DHKEY_COMMAND_RECEIVED = 1 << 0
161 } sm_state_var_t;
162 
163 //
164 // GLOBAL DATA
165 //
166 
167 static uint8_t test_use_fixed_local_csrk;
168 static uint8_t test_use_fixed_ec_keypair;
169 
170 // configuration
171 static uint8_t sm_accepted_stk_generation_methods;
172 static uint8_t sm_max_encryption_key_size;
173 static uint8_t sm_min_encryption_key_size;
174 static uint8_t sm_auth_req = 0;
175 static uint8_t sm_io_capabilities = IO_CAPABILITY_NO_INPUT_NO_OUTPUT;
176 static uint8_t sm_slave_request_security;
177 
178 // Security Manager Master Keys, please use sm_set_er(er) and sm_set_ir(ir) with your own 128 bit random values
179 static sm_key_t sm_persistent_er;
180 static sm_key_t sm_persistent_ir;
181 
182 // derived from sm_persistent_ir
183 static sm_key_t sm_persistent_dhk;
184 static sm_key_t sm_persistent_irk;
185 static uint8_t  sm_persistent_irk_ready = 0;    // used for testing
186 static derived_key_generation_t dkg_state;
187 
188 // derived from sm_persistent_er
189 // ..
190 
191 // random address update
192 static random_address_update_t rau_state;
193 static bd_addr_t sm_random_address;
194 
195 // CMAC Calculation: General
196 static cmac_state_t sm_cmac_state;
197 static uint16_t     sm_cmac_message_len;
198 static sm_key_t     sm_cmac_k;
199 static sm_key_t     sm_cmac_x;
200 static sm_key_t     sm_cmac_m_last;
201 static uint8_t      sm_cmac_block_current;
202 static uint8_t      sm_cmac_block_count;
203 static uint8_t      (*sm_cmac_get_byte)(uint16_t offset);
204 static void         (*sm_cmac_done_handler)(uint8_t * hash);
205 
206 // CMAC for ATT Signed Writes
207 static uint8_t      sm_cmac_header[3];
208 static const uint8_t * sm_cmac_message;
209 static uint8_t      sm_cmac_sign_counter[4];
210 
211 // CMAC for Secure Connection functions
212 #ifdef ENABLE_LE_SECURE_CONNECTIONS
213 static sm_connection_t * sm_cmac_connection;
214 static uint8_t           sm_cmac_sc_buffer[80];
215 #endif
216 
217 // resolvable private address lookup / CSRK calculation
218 static int       sm_address_resolution_test;
219 static int       sm_address_resolution_ah_calculation_active;
220 static uint8_t   sm_address_resolution_addr_type;
221 static bd_addr_t sm_address_resolution_address;
222 static void *    sm_address_resolution_context;
223 static address_resolution_mode_t sm_address_resolution_mode;
224 static btstack_linked_list_t sm_address_resolution_general_queue;
225 
226 // aes128 crypto engine. store current sm_connection_t in sm_aes128_context
227 static sm_aes128_state_t  sm_aes128_state;
228 static void *             sm_aes128_context;
229 
230 // random engine. store context (ususally sm_connection_t)
231 static void * sm_random_context;
232 
233 // to receive hci events
234 static btstack_packet_callback_registration_t hci_event_callback_registration;
235 
236 /* to dispatch sm event */
237 static btstack_linked_list_t sm_event_handlers;
238 
239 // Software ECDH implementation provided by mbedtls
240 #ifdef USE_MBEDTLS_FOR_ECDH
241 static mbedtls_ecp_keypair le_keypair;
242 static ec_key_generation_state_t ec_key_generation_state;
243 #endif
244 
245 //
246 // Volume 3, Part H, Chapter 24
247 // "Security shall be initiated by the Security Manager in the device in the master role.
248 // The device in the slave role shall be the responding device."
249 // -> master := initiator, slave := responder
250 //
251 
252 // data needed for security setup
253 typedef struct sm_setup_context {
254 
255     btstack_timer_source_t sm_timeout;
256 
257     // used in all phases
258     uint8_t   sm_pairing_failed_reason;
259 
260     // user response, (Phase 1 and/or 2)
261     uint8_t   sm_user_response;
262 
263     // defines which keys will be send after connection is encrypted - calculated during Phase 1, used Phase 3
264     int       sm_key_distribution_send_set;
265     int       sm_key_distribution_received_set;
266 
267     // Phase 2 (Pairing over SMP)
268     stk_generation_method_t sm_stk_generation_method;
269     sm_key_t  sm_tk;
270     uint8_t   sm_use_secure_connections;
271 
272     sm_key_t  sm_c1_t3_value;   // c1 calculation
273     sm_pairing_packet_t sm_m_preq; // pairing request - needed only for c1
274     sm_pairing_packet_t sm_s_pres; // pairing response - needed only for c1
275     sm_key_t  sm_local_random;
276     sm_key_t  sm_local_confirm;
277     sm_key_t  sm_peer_random;
278     sm_key_t  sm_peer_confirm;
279     uint8_t   sm_m_addr_type;   // address and type can be removed
280     uint8_t   sm_s_addr_type;   //  ''
281     bd_addr_t sm_m_address;     //  ''
282     bd_addr_t sm_s_address;     //  ''
283     sm_key_t  sm_ltk;
284 
285 #ifdef ENABLE_LE_SECURE_CONNECTIONS
286     uint8_t   sm_peer_qx[32];   // also stores random for EC key generation during init
287     uint8_t   sm_peer_qy[32];   //  ''
288     sm_key_t  sm_peer_nonce;    // might be combined with sm_peer_random
289     sm_key_t  sm_local_nonce;   // might be combined with sm_local_random
290     sm_key_t  sm_peer_dhkey_check;
291     sm_key_t  sm_local_dhkey_check;
292     sm_key_t  sm_ra;
293     sm_key_t  sm_rb;
294     sm_key_t  sm_t;             // used for f5
295     sm_key_t  sm_mackey;
296     uint8_t   sm_passkey_bit;   // also stores number of generated random bytes for EC key generation
297     uint8_t   sm_state_vars;
298 #endif
299 
300     // Phase 3
301 
302     // key distribution, we generate
303     uint16_t  sm_local_y;
304     uint16_t  sm_local_div;
305     uint16_t  sm_local_ediv;
306     uint8_t   sm_local_rand[8];
307     sm_key_t  sm_local_ltk;
308     sm_key_t  sm_local_csrk;
309     sm_key_t  sm_local_irk;
310     // sm_local_address/addr_type not needed
311 
312     // key distribution, received from peer
313     uint16_t  sm_peer_y;
314     uint16_t  sm_peer_div;
315     uint16_t  sm_peer_ediv;
316     uint8_t   sm_peer_rand[8];
317     sm_key_t  sm_peer_ltk;
318     sm_key_t  sm_peer_irk;
319     sm_key_t  sm_peer_csrk;
320     uint8_t   sm_peer_addr_type;
321     bd_addr_t sm_peer_address;
322 
323 } sm_setup_context_t;
324 
325 //
326 static sm_setup_context_t the_setup;
327 static sm_setup_context_t * setup = &the_setup;
328 
329 // active connection - the one for which the_setup is used for
330 static uint16_t sm_active_connection = 0;
331 
332 // @returns 1 if oob data is available
333 // stores oob data in provided 16 byte buffer if not null
334 static int (*sm_get_oob_data)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data) = NULL;
335 
336 // used to notify applicationss that user interaction is neccessary, see sm_notify_t below
337 static btstack_packet_handler_t sm_client_packet_handler = NULL;
338 
339 // horizontal: initiator capabilities
340 // vertial:    responder capabilities
341 static const stk_generation_method_t stk_generation_method [5] [5] = {
342     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
343     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
344     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
345     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
346     { PK_RESP_INPUT,   PK_RESP_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
347 };
348 
349 // uses numeric comparison if one side has DisplayYesNo and KeyboardDisplay combinations
350 #ifdef ENABLE_LE_SECURE_CONNECTIONS
351 static const stk_generation_method_t stk_generation_method_with_secure_connection[5][5] = {
352     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
353     { JUST_WORKS,      NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
354     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
355     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
356     { PK_RESP_INPUT,   NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
357 };
358 #endif
359 
360 static void sm_run(void);
361 static void sm_done_for_handle(hci_con_handle_t con_handle);
362 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle);
363 static inline int sm_calc_actual_encryption_key_size(int other);
364 static int sm_validate_stk_generation_method(void);
365 static void sm_shift_left_by_one_bit_inplace(int len, uint8_t * data);
366 
367 static void log_info_hex16(const char * name, uint16_t value){
368     log_info("%-6s 0x%04x", name, value);
369 }
370 
371 // @returns 1 if all bytes are 0
372 static int sm_is_null_random(uint8_t random[8]){
373     int i;
374     for (i=0; i < 8 ; i++){
375         if (random[i]) return 0;
376     }
377     return 1;
378 }
379 
380 // Key utils
381 static void sm_reset_tk(void){
382     int i;
383     for (i=0;i<16;i++){
384         setup->sm_tk[i] = 0;
385     }
386 }
387 
388 // "For example, if a 128-bit encryption key is 0x123456789ABCDEF0123456789ABCDEF0
389 // and it is reduced to 7 octets (56 bits), then the resulting key is 0x0000000000000000003456789ABCDEF0.""
390 static void sm_truncate_key(sm_key_t key, int max_encryption_size){
391     int i;
392     for (i = max_encryption_size ; i < 16 ; i++){
393         key[15-i] = 0;
394     }
395 }
396 
397 // SMP Timeout implementation
398 
399 // Upon transmission of the Pairing Request command or reception of the Pairing Request command,
400 // the Security Manager Timer shall be reset and started.
401 //
402 // The Security Manager Timer shall be reset when an L2CAP SMP command is queued for transmission.
403 //
404 // If the Security Manager Timer reaches 30 seconds, the procedure shall be considered to have failed,
405 // and the local higher layer shall be notified. No further SMP commands shall be sent over the L2CAP
406 // Security Manager Channel. A new SM procedure shall only be performed when a new physical link has been
407 // established.
408 
409 static void sm_timeout_handler(btstack_timer_source_t * timer){
410     log_info("SM timeout");
411     sm_connection_t * sm_conn = (sm_connection_t*) btstack_run_loop_get_timer_context(timer);
412     sm_conn->sm_engine_state = SM_GENERAL_TIMEOUT;
413     sm_done_for_handle(sm_conn->sm_handle);
414 
415     // trigger handling of next ready connection
416     sm_run();
417 }
418 static void sm_timeout_start(sm_connection_t * sm_conn){
419     btstack_run_loop_remove_timer(&setup->sm_timeout);
420     btstack_run_loop_set_timer_context(&setup->sm_timeout, sm_conn);
421     btstack_run_loop_set_timer_handler(&setup->sm_timeout, sm_timeout_handler);
422     btstack_run_loop_set_timer(&setup->sm_timeout, 30000); // 30 seconds sm timeout
423     btstack_run_loop_add_timer(&setup->sm_timeout);
424 }
425 static void sm_timeout_stop(void){
426     btstack_run_loop_remove_timer(&setup->sm_timeout);
427 }
428 static void sm_timeout_reset(sm_connection_t * sm_conn){
429     sm_timeout_stop();
430     sm_timeout_start(sm_conn);
431 }
432 
433 // end of sm timeout
434 
435 // GAP Random Address updates
436 static gap_random_address_type_t gap_random_adress_type;
437 static btstack_timer_source_t gap_random_address_update_timer;
438 static uint32_t gap_random_adress_update_period;
439 
440 static void gap_random_address_trigger(void){
441     if (rau_state != RAU_IDLE) return;
442     log_info("gap_random_address_trigger");
443     rau_state = RAU_GET_RANDOM;
444     sm_run();
445 }
446 
447 static void gap_random_address_update_handler(btstack_timer_source_t * timer){
448     log_info("GAP Random Address Update due");
449     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
450     btstack_run_loop_add_timer(&gap_random_address_update_timer);
451     gap_random_address_trigger();
452 }
453 
454 static void gap_random_address_update_start(void){
455     btstack_run_loop_set_timer_handler(&gap_random_address_update_timer, gap_random_address_update_handler);
456     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
457     btstack_run_loop_add_timer(&gap_random_address_update_timer);
458 }
459 
460 static void gap_random_address_update_stop(void){
461     btstack_run_loop_remove_timer(&gap_random_address_update_timer);
462 }
463 
464 
465 static void sm_random_start(void * context){
466     sm_random_context = context;
467     hci_send_cmd(&hci_le_rand);
468 }
469 
470 // pre: sm_aes128_state != SM_AES128_ACTIVE, hci_can_send_command == 1
471 // context is made availabe to aes128 result handler by this
472 static void sm_aes128_start(sm_key_t key, sm_key_t plaintext, void * context){
473     sm_aes128_state = SM_AES128_ACTIVE;
474     sm_key_t key_flipped, plaintext_flipped;
475     reverse_128(key, key_flipped);
476     reverse_128(plaintext, plaintext_flipped);
477     sm_aes128_context = context;
478     hci_send_cmd(&hci_le_encrypt, key_flipped, plaintext_flipped);
479 }
480 
481 // ah(k,r) helper
482 // r = padding || r
483 // r - 24 bit value
484 static void sm_ah_r_prime(uint8_t r[3], sm_key_t r_prime){
485     // r'= padding || r
486     memset(r_prime, 0, 16);
487     memcpy(&r_prime[13], r, 3);
488 }
489 
490 // d1 helper
491 // d' = padding || r || d
492 // d,r - 16 bit values
493 static void sm_d1_d_prime(uint16_t d, uint16_t r, sm_key_t d1_prime){
494     // d'= padding || r || d
495     memset(d1_prime, 0, 16);
496     big_endian_store_16(d1_prime, 12, r);
497     big_endian_store_16(d1_prime, 14, d);
498 }
499 
500 // dm helper
501 // r’ = padding || r
502 // r - 64 bit value
503 static void sm_dm_r_prime(uint8_t r[8], sm_key_t r_prime){
504     memset(r_prime, 0, 16);
505     memcpy(&r_prime[8], r, 8);
506 }
507 
508 // calculate arguments for first AES128 operation in C1 function
509 static void sm_c1_t1(sm_key_t r, uint8_t preq[7], uint8_t pres[7], uint8_t iat, uint8_t rat, sm_key_t t1){
510 
511     // p1 = pres || preq || rat’ || iat’
512     // "The octet of iat’ becomes the least significant octet of p1 and the most signifi-
513     // cant octet of pres becomes the most significant octet of p1.
514     // For example, if the 8-bit iat’ is 0x01, the 8-bit rat’ is 0x00, the 56-bit preq
515     // is 0x07071000000101 and the 56 bit pres is 0x05000800000302 then
516     // p1 is 0x05000800000302070710000001010001."
517 
518     sm_key_t p1;
519     reverse_56(pres, &p1[0]);
520     reverse_56(preq, &p1[7]);
521     p1[14] = rat;
522     p1[15] = iat;
523     log_info_key("p1", p1);
524     log_info_key("r", r);
525 
526     // t1 = r xor p1
527     int i;
528     for (i=0;i<16;i++){
529         t1[i] = r[i] ^ p1[i];
530     }
531     log_info_key("t1", t1);
532 }
533 
534 // calculate arguments for second AES128 operation in C1 function
535 static void sm_c1_t3(sm_key_t t2, bd_addr_t ia, bd_addr_t ra, sm_key_t t3){
536      // p2 = padding || ia || ra
537     // "The least significant octet of ra becomes the least significant octet of p2 and
538     // the most significant octet of padding becomes the most significant octet of p2.
539     // For example, if 48-bit ia is 0xA1A2A3A4A5A6 and the 48-bit ra is
540     // 0xB1B2B3B4B5B6 then p2 is 0x00000000A1A2A3A4A5A6B1B2B3B4B5B6.
541 
542     sm_key_t p2;
543     memset(p2, 0, 16);
544     memcpy(&p2[4],  ia, 6);
545     memcpy(&p2[10], ra, 6);
546     log_info_key("p2", p2);
547 
548     // c1 = e(k, t2_xor_p2)
549     int i;
550     for (i=0;i<16;i++){
551         t3[i] = t2[i] ^ p2[i];
552     }
553     log_info_key("t3", t3);
554 }
555 
556 static void sm_s1_r_prime(sm_key_t r1, sm_key_t r2, sm_key_t r_prime){
557     log_info_key("r1", r1);
558     log_info_key("r2", r2);
559     memcpy(&r_prime[8], &r2[8], 8);
560     memcpy(&r_prime[0], &r1[8], 8);
561 }
562 
563 #ifdef ENABLE_LE_SECURE_CONNECTIONS
564 // Software implementations of crypto toolbox for LE Secure Connection
565 // TODO: replace with code to use AES Engine of HCI Controller
566 typedef uint8_t sm_key24_t[3];
567 typedef uint8_t sm_key56_t[7];
568 typedef uint8_t sm_key256_t[32];
569 
570 #if 0
571 static void aes128_calc_cyphertext(const uint8_t key[16], const uint8_t plaintext[16], uint8_t cyphertext[16]){
572     uint32_t rk[RKLENGTH(KEYBITS)];
573     int nrounds = rijndaelSetupEncrypt(rk, &key[0], KEYBITS);
574     rijndaelEncrypt(rk, nrounds, plaintext, cyphertext);
575 }
576 
577 static void calc_subkeys(sm_key_t k0, sm_key_t k1, sm_key_t k2){
578     memcpy(k1, k0, 16);
579     sm_shift_left_by_one_bit_inplace(16, k1);
580     if (k0[0] & 0x80){
581         k1[15] ^= 0x87;
582     }
583     memcpy(k2, k1, 16);
584     sm_shift_left_by_one_bit_inplace(16, k2);
585     if (k1[0] & 0x80){
586         k2[15] ^= 0x87;
587     }
588 }
589 
590 static void aes_cmac(sm_key_t aes_cmac, const sm_key_t key, const uint8_t * data, int cmac_message_len){
591     sm_key_t k0, k1, k2, zero;
592     memset(zero, 0, 16);
593 
594     aes128_calc_cyphertext(key, zero, k0);
595     calc_subkeys(k0, k1, k2);
596 
597     int cmac_block_count = (cmac_message_len + 15) / 16;
598 
599     // step 3: ..
600     if (cmac_block_count==0){
601         cmac_block_count = 1;
602     }
603 
604     // step 4: set m_last
605     sm_key_t cmac_m_last;
606     int sm_cmac_last_block_complete = cmac_message_len != 0 && (cmac_message_len & 0x0f) == 0;
607     int i;
608     if (sm_cmac_last_block_complete){
609         for (i=0;i<16;i++){
610             cmac_m_last[i] = data[cmac_message_len - 16 + i] ^ k1[i];
611         }
612     } else {
613         int valid_octets_in_last_block = cmac_message_len & 0x0f;
614         for (i=0;i<16;i++){
615             if (i < valid_octets_in_last_block){
616                 cmac_m_last[i] = data[(cmac_message_len & 0xfff0) + i] ^ k2[i];
617                 continue;
618             }
619             if (i == valid_octets_in_last_block){
620                 cmac_m_last[i] = 0x80 ^ k2[i];
621                 continue;
622             }
623             cmac_m_last[i] = k2[i];
624         }
625     }
626 
627     // printf("sm_cmac_start: len %u, block count %u\n", cmac_message_len, cmac_block_count);
628     // LOG_KEY(cmac_m_last);
629 
630     // Step 5
631     sm_key_t cmac_x;
632     memset(cmac_x, 0, 16);
633 
634     // Step 6
635     sm_key_t sm_cmac_y;
636     for (int block = 0 ; block < cmac_block_count-1 ; block++){
637         for (i=0;i<16;i++){
638             sm_cmac_y[i] = cmac_x[i] ^ data[block * 16 + i];
639         }
640         aes128_calc_cyphertext(key, sm_cmac_y, cmac_x);
641     }
642     for (i=0;i<16;i++){
643         sm_cmac_y[i] = cmac_x[i] ^ cmac_m_last[i];
644     }
645 
646     // Step 7
647     aes128_calc_cyphertext(key, sm_cmac_y, aes_cmac);
648 }
649 #endif
650 
651 #if 0
652 //
653 // Link Key Conversion Function h6
654 //
655 // h6(W, keyID) = AES-CMACW(keyID)
656 // - W is 128 bits
657 // - keyID is 32 bits
658 static void h6(sm_key_t res, const sm_key_t w, const uint32_t key_id){
659     uint8_t key_id_buffer[4];
660     big_endian_store_32(key_id_buffer, 0, key_id);
661     aes_cmac(res, w, key_id_buffer, 4);
662 }
663 #endif
664 #endif
665 
666 static void sm_setup_event_base(uint8_t * event, int event_size, uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
667     event[0] = type;
668     event[1] = event_size - 2;
669     little_endian_store_16(event, 2, con_handle);
670     event[4] = addr_type;
671     reverse_bd_addr(address, &event[5]);
672 }
673 
674 static void sm_dispatch_event(uint8_t packet_type, uint16_t channel, uint8_t * packet, uint16_t size){
675     if (sm_client_packet_handler) {
676         sm_client_packet_handler(HCI_EVENT_PACKET, 0, packet, size);
677     }
678     // dispatch to all event handlers
679     btstack_linked_list_iterator_t it;
680     btstack_linked_list_iterator_init(&it, &sm_event_handlers);
681     while (btstack_linked_list_iterator_has_next(&it)){
682         btstack_packet_callback_registration_t * entry = (btstack_packet_callback_registration_t*) btstack_linked_list_iterator_next(&it);
683         entry->callback(packet_type, 0, packet, size);
684     }
685 }
686 
687 static void sm_notify_client_base(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
688     uint8_t event[11];
689     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
690     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
691 }
692 
693 static void sm_notify_client_passkey(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint32_t passkey){
694     uint8_t event[15];
695     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
696     little_endian_store_32(event, 11, passkey);
697     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
698 }
699 
700 static void sm_notify_client_index(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint16_t index){
701     uint8_t event[13];
702     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
703     little_endian_store_16(event, 11, index);
704     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
705 }
706 
707 static void sm_notify_client_authorization(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint8_t result){
708 
709     uint8_t event[18];
710     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
711     event[11] = result;
712     sm_dispatch_event(HCI_EVENT_PACKET, 0, (uint8_t*) &event, sizeof(event));
713 }
714 
715 // decide on stk generation based on
716 // - pairing request
717 // - io capabilities
718 // - OOB data availability
719 static void sm_setup_tk(void){
720 
721     // default: just works
722     setup->sm_stk_generation_method = JUST_WORKS;
723 
724 #ifdef ENABLE_LE_SECURE_CONNECTIONS
725     setup->sm_use_secure_connections = ( sm_pairing_packet_get_auth_req(setup->sm_m_preq)
726                                        & sm_pairing_packet_get_auth_req(setup->sm_s_pres)
727                                        & SM_AUTHREQ_SECURE_CONNECTION ) != 0;
728     memset(setup->sm_ra, 0, 16);
729     memset(setup->sm_rb, 0, 16);
730 #else
731     setup->sm_use_secure_connections = 0;
732 #endif
733 
734     // If both devices have not set the MITM option in the Authentication Requirements
735     // Flags, then the IO capabilities shall be ignored and the Just Works association
736     // model shall be used.
737     if (((sm_pairing_packet_get_auth_req(setup->sm_m_preq) & SM_AUTHREQ_MITM_PROTECTION) == 0)
738     &&  ((sm_pairing_packet_get_auth_req(setup->sm_s_pres) & SM_AUTHREQ_MITM_PROTECTION) == 0)){
739         log_info("SM: MITM not required by both -> JUST WORKS");
740         return;
741     }
742 
743     // TODO: with LE SC, OOB is used to transfer data OOB during pairing, single device with OOB is sufficient
744 
745     // If both devices have out of band authentication data, then the Authentication
746     // Requirements Flags shall be ignored when selecting the pairing method and the
747     // Out of Band pairing method shall be used.
748     if (sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq)
749     &&  sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres)){
750         log_info("SM: have OOB data");
751         log_info_key("OOB", setup->sm_tk);
752         setup->sm_stk_generation_method = OOB;
753         return;
754     }
755 
756     // Reset TK as it has been setup in sm_init_setup
757     sm_reset_tk();
758 
759     // Also use just works if unknown io capabilites
760     if ((sm_pairing_packet_get_io_capability(setup->sm_m_preq) > IO_CAPABILITY_KEYBOARD_DISPLAY) || (sm_pairing_packet_get_io_capability(setup->sm_s_pres) > IO_CAPABILITY_KEYBOARD_DISPLAY)){
761         return;
762     }
763 
764     // Otherwise the IO capabilities of the devices shall be used to determine the
765     // pairing method as defined in Table 2.4.
766     // see http://stackoverflow.com/a/1052837/393697 for how to specify pointer to 2-dimensional array
767     const stk_generation_method_t (*generation_method)[5] = stk_generation_method;
768 
769 #ifdef ENABLE_LE_SECURE_CONNECTIONS
770     // table not define by default
771     if (setup->sm_use_secure_connections){
772         generation_method = stk_generation_method_with_secure_connection;
773     }
774 #endif
775     setup->sm_stk_generation_method = generation_method[sm_pairing_packet_get_io_capability(setup->sm_s_pres)][sm_pairing_packet_get_io_capability(setup->sm_m_preq)];
776 
777     log_info("sm_setup_tk: master io cap: %u, slave io cap: %u -> method %u",
778         sm_pairing_packet_get_io_capability(setup->sm_m_preq), sm_pairing_packet_get_io_capability(setup->sm_s_pres), setup->sm_stk_generation_method);
779 }
780 
781 static int sm_key_distribution_flags_for_set(uint8_t key_set){
782     int flags = 0;
783     if (key_set & SM_KEYDIST_ENC_KEY){
784         flags |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
785         flags |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
786     }
787     if (key_set & SM_KEYDIST_ID_KEY){
788         flags |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
789         flags |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
790     }
791     if (key_set & SM_KEYDIST_SIGN){
792         flags |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
793     }
794     return flags;
795 }
796 
797 static void sm_setup_key_distribution(uint8_t key_set){
798     setup->sm_key_distribution_received_set = 0;
799     setup->sm_key_distribution_send_set = sm_key_distribution_flags_for_set(key_set);
800 }
801 
802 // CSRK Key Lookup
803 
804 
805 static int sm_address_resolution_idle(void){
806     return sm_address_resolution_mode == ADDRESS_RESOLUTION_IDLE;
807 }
808 
809 static void sm_address_resolution_start_lookup(uint8_t addr_type, hci_con_handle_t con_handle, bd_addr_t addr, address_resolution_mode_t mode, void * context){
810     memcpy(sm_address_resolution_address, addr, 6);
811     sm_address_resolution_addr_type = addr_type;
812     sm_address_resolution_test = 0;
813     sm_address_resolution_mode = mode;
814     sm_address_resolution_context = context;
815     sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_STARTED, con_handle, addr_type, addr);
816 }
817 
818 int sm_address_resolution_lookup(uint8_t address_type, bd_addr_t address){
819     // check if already in list
820     btstack_linked_list_iterator_t it;
821     sm_lookup_entry_t * entry;
822     btstack_linked_list_iterator_init(&it, &sm_address_resolution_general_queue);
823     while(btstack_linked_list_iterator_has_next(&it)){
824         entry = (sm_lookup_entry_t *) btstack_linked_list_iterator_next(&it);
825         if (entry->address_type != address_type) continue;
826         if (memcmp(entry->address, address, 6))  continue;
827         // already in list
828         return BTSTACK_BUSY;
829     }
830     entry = btstack_memory_sm_lookup_entry_get();
831     if (!entry) return BTSTACK_MEMORY_ALLOC_FAILED;
832     entry->address_type = (bd_addr_type_t) address_type;
833     memcpy(entry->address, address, 6);
834     btstack_linked_list_add(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
835     sm_run();
836     return 0;
837 }
838 
839 // CMAC Implementation using AES128 engine
840 static void sm_shift_left_by_one_bit_inplace(int len, uint8_t * data){
841     int i;
842     int carry = 0;
843     for (i=len-1; i >= 0 ; i--){
844         int new_carry = data[i] >> 7;
845         data[i] = data[i] << 1 | carry;
846         carry = new_carry;
847     }
848 }
849 
850 // while x_state++ for an enum is possible in C, it isn't in C++. we use this helpers to avoid compile errors for now
851 static inline void sm_next_responding_state(sm_connection_t * sm_conn){
852     sm_conn->sm_engine_state = (security_manager_state_t) (((int)sm_conn->sm_engine_state) + 1);
853 }
854 static inline void dkg_next_state(void){
855     dkg_state = (derived_key_generation_t) (((int)dkg_state) + 1);
856 }
857 static inline void rau_next_state(void){
858     rau_state = (random_address_update_t) (((int)rau_state) + 1);
859 }
860 
861 // CMAC calculation using AES Engine
862 
863 static inline void sm_cmac_next_state(void){
864     sm_cmac_state = (cmac_state_t) (((int)sm_cmac_state) + 1);
865 }
866 
867 static int sm_cmac_last_block_complete(void){
868     if (sm_cmac_message_len == 0) return 0;
869     return (sm_cmac_message_len & 0x0f) == 0;
870 }
871 
872 static inline uint8_t sm_cmac_message_get_byte(uint16_t offset){
873     if (offset >= sm_cmac_message_len) {
874         log_error("sm_cmac_message_get_byte. out of bounds, access %u, len %u", offset, sm_cmac_message_len);
875         return 0;
876     }
877 
878     offset = sm_cmac_message_len - 1 - offset;
879 
880     // sm_cmac_header[3] | message[] | sm_cmac_sign_counter[4]
881     if (offset < 3){
882         return sm_cmac_header[offset];
883     }
884     int actual_message_len_incl_header = sm_cmac_message_len - 4;
885     if (offset <  actual_message_len_incl_header){
886         return sm_cmac_message[offset - 3];
887     }
888     return sm_cmac_sign_counter[offset - actual_message_len_incl_header];
889 }
890 
891 // generic cmac calculation
892 void sm_cmac_general_start(const sm_key_t key, uint16_t message_len, uint8_t (*get_byte_callback)(uint16_t offset), void (*done_callback)(uint8_t hash[8])){
893     // Generalized CMAC
894     memcpy(sm_cmac_k, key, 16);
895     memset(sm_cmac_x, 0, 16);
896     sm_cmac_block_current = 0;
897     sm_cmac_message_len  = message_len;
898     sm_cmac_done_handler = done_callback;
899     sm_cmac_get_byte     = get_byte_callback;
900 
901     // step 2: n := ceil(len/const_Bsize);
902     sm_cmac_block_count = (sm_cmac_message_len + 15) / 16;
903 
904     // step 3: ..
905     if (sm_cmac_block_count==0){
906         sm_cmac_block_count = 1;
907     }
908     log_info("sm_cmac_connection %p", sm_cmac_connection);
909     log_info("sm_cmac_general_start: len %u, block count %u", sm_cmac_message_len, sm_cmac_block_count);
910 
911     // first, we need to compute l for k1, k2, and m_last
912     sm_cmac_state = CMAC_CALC_SUBKEYS;
913 
914     // let's go
915     sm_run();
916 }
917 
918 // cmac for ATT Message signing
919 void sm_cmac_start(const sm_key_t k, uint8_t opcode, hci_con_handle_t con_handle, uint16_t message_len, const uint8_t * message, uint32_t sign_counter, void (*done_handler)(uint8_t * hash)){
920     // ATT Message Signing
921     sm_cmac_header[0] = opcode;
922     little_endian_store_16(sm_cmac_header, 1, con_handle);
923     little_endian_store_32(sm_cmac_sign_counter, 0, sign_counter);
924     uint16_t total_message_len = 3 + message_len + 4;  // incl. virtually prepended att opcode, handle and appended sign_counter in LE
925     sm_cmac_message = message;
926     sm_cmac_general_start(k, total_message_len, &sm_cmac_message_get_byte, done_handler);
927 }
928 
929 int sm_cmac_ready(void){
930     return sm_cmac_state == CMAC_IDLE;
931 }
932 
933 static void sm_cmac_handle_aes_engine_ready(void){
934     switch (sm_cmac_state){
935         case CMAC_CALC_SUBKEYS: {
936             sm_key_t const_zero;
937             memset(const_zero, 0, 16);
938             sm_cmac_next_state();
939             sm_aes128_start(sm_cmac_k, const_zero, NULL);
940             break;
941         }
942         case CMAC_CALC_MI: {
943             int j;
944             sm_key_t y;
945             for (j=0;j<16;j++){
946                 y[j] = sm_cmac_x[j] ^ sm_cmac_get_byte(sm_cmac_block_current*16 + j);
947             }
948             sm_cmac_block_current++;
949             sm_cmac_next_state();
950             sm_aes128_start(sm_cmac_k, y, NULL);
951             break;
952         }
953         case CMAC_CALC_MLAST: {
954             int i;
955             sm_key_t y;
956             for (i=0;i<16;i++){
957                 y[i] = sm_cmac_x[i] ^ sm_cmac_m_last[i];
958             }
959             log_info_key("Y", y);
960             sm_cmac_block_current++;
961             sm_cmac_next_state();
962             sm_aes128_start(sm_cmac_k, y, NULL);
963             break;
964         }
965         default:
966             log_info("sm_cmac_handle_aes_engine_ready called in state %u", sm_cmac_state);
967             break;
968     }
969 }
970 
971 static void sm_cmac_handle_encryption_result(sm_key_t data){
972     switch (sm_cmac_state){
973         case CMAC_W4_SUBKEYS: {
974             sm_key_t k1;
975             memcpy(k1, data, 16);
976             sm_shift_left_by_one_bit_inplace(16, k1);
977             if (data[0] & 0x80){
978                 k1[15] ^= 0x87;
979             }
980             sm_key_t k2;
981             memcpy(k2, k1, 16);
982             sm_shift_left_by_one_bit_inplace(16, k2);
983             if (k1[0] & 0x80){
984                 k2[15] ^= 0x87;
985             }
986 
987             log_info_key("k", sm_cmac_k);
988             log_info_key("k1", k1);
989             log_info_key("k2", k2);
990 
991             // step 4: set m_last
992             int i;
993             if (sm_cmac_last_block_complete()){
994                 for (i=0;i<16;i++){
995                     sm_cmac_m_last[i] = sm_cmac_get_byte(sm_cmac_message_len - 16 + i) ^ k1[i];
996                 }
997             } else {
998                 int valid_octets_in_last_block = sm_cmac_message_len & 0x0f;
999                 for (i=0;i<16;i++){
1000                     if (i < valid_octets_in_last_block){
1001                         sm_cmac_m_last[i] = sm_cmac_get_byte((sm_cmac_message_len & 0xfff0) + i) ^ k2[i];
1002                         continue;
1003                     }
1004                     if (i == valid_octets_in_last_block){
1005                         sm_cmac_m_last[i] = 0x80 ^ k2[i];
1006                         continue;
1007                     }
1008                     sm_cmac_m_last[i] = k2[i];
1009                 }
1010             }
1011 
1012             // next
1013             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
1014             break;
1015         }
1016         case CMAC_W4_MI:
1017             memcpy(sm_cmac_x, data, 16);
1018             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
1019             break;
1020         case CMAC_W4_MLAST:
1021             // done
1022             log_info("Setting CMAC Engine to IDLE");
1023             sm_cmac_state = CMAC_IDLE;
1024             log_info_key("CMAC", data);
1025             sm_cmac_done_handler(data);
1026             break;
1027         default:
1028             log_info("sm_cmac_handle_encryption_result called in state %u", sm_cmac_state);
1029             break;
1030     }
1031 }
1032 
1033 static void sm_trigger_user_response(sm_connection_t * sm_conn){
1034     // notify client for: JUST WORKS confirm, Numeric comparison confirm, PASSKEY display or input
1035     setup->sm_user_response = SM_USER_RESPONSE_IDLE;
1036     switch (setup->sm_stk_generation_method){
1037         case PK_RESP_INPUT:
1038             if (sm_conn->sm_role){
1039                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1040                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1041             } else {
1042                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1043             }
1044             break;
1045         case PK_INIT_INPUT:
1046             if (sm_conn->sm_role){
1047                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1048             } else {
1049                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1050                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1051             }
1052             break;
1053         case OK_BOTH_INPUT:
1054             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1055             sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1056             break;
1057         case NK_BOTH_INPUT:
1058             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1059             sm_notify_client_passkey(SM_EVENT_NUMERIC_COMPARISON_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1060             break;
1061         case JUST_WORKS:
1062             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1063             sm_notify_client_base(SM_EVENT_JUST_WORKS_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1064             break;
1065         case OOB:
1066             // client already provided OOB data, let's skip notification.
1067             break;
1068     }
1069 }
1070 
1071 static int sm_key_distribution_all_received(sm_connection_t * sm_conn){
1072     int recv_flags;
1073     if (sm_conn->sm_role){
1074         // slave / responder
1075         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres));
1076     } else {
1077         // master / initiator
1078         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
1079     }
1080     log_debug("sm_key_distribution_all_received: received 0x%02x, expecting 0x%02x", setup->sm_key_distribution_received_set, recv_flags);
1081     return recv_flags == setup->sm_key_distribution_received_set;
1082 }
1083 
1084 static void sm_done_for_handle(hci_con_handle_t con_handle){
1085     if (sm_active_connection == con_handle){
1086         sm_timeout_stop();
1087         sm_active_connection = 0;
1088         log_info("sm: connection 0x%x released setup context", con_handle);
1089     }
1090 }
1091 
1092 static int sm_key_distribution_flags_for_auth_req(void){
1093     int flags = SM_KEYDIST_ID_KEY | SM_KEYDIST_SIGN;
1094     if (sm_auth_req & SM_AUTHREQ_BONDING){
1095         // encryption information only if bonding requested
1096         flags |= SM_KEYDIST_ENC_KEY;
1097     }
1098     return flags;
1099 }
1100 
1101 static void sm_init_setup(sm_connection_t * sm_conn){
1102 
1103     // fill in sm setup
1104     setup->sm_state_vars = 0;
1105     sm_reset_tk();
1106     setup->sm_peer_addr_type = sm_conn->sm_peer_addr_type;
1107     memcpy(setup->sm_peer_address, sm_conn->sm_peer_address, 6);
1108 
1109     // query client for OOB data
1110     int have_oob_data = 0;
1111     if (sm_get_oob_data) {
1112         have_oob_data = (*sm_get_oob_data)(sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, setup->sm_tk);
1113     }
1114 
1115     sm_pairing_packet_t * local_packet;
1116     if (sm_conn->sm_role){
1117         // slave
1118         local_packet = &setup->sm_s_pres;
1119         gap_advertisements_get_address(&setup->sm_s_addr_type, setup->sm_s_address);
1120         setup->sm_m_addr_type = sm_conn->sm_peer_addr_type;
1121         memcpy(setup->sm_m_address, sm_conn->sm_peer_address, 6);
1122     } else {
1123         // master
1124         local_packet = &setup->sm_m_preq;
1125         gap_advertisements_get_address(&setup->sm_m_addr_type, setup->sm_m_address);
1126         setup->sm_s_addr_type = sm_conn->sm_peer_addr_type;
1127         memcpy(setup->sm_s_address, sm_conn->sm_peer_address, 6);
1128 
1129         int key_distribution_flags = sm_key_distribution_flags_for_auth_req();
1130         sm_pairing_packet_set_initiator_key_distribution(setup->sm_m_preq, key_distribution_flags);
1131         sm_pairing_packet_set_responder_key_distribution(setup->sm_m_preq, key_distribution_flags);
1132     }
1133 
1134     sm_pairing_packet_set_io_capability(*local_packet, sm_io_capabilities);
1135     sm_pairing_packet_set_oob_data_flag(*local_packet, have_oob_data);
1136     sm_pairing_packet_set_auth_req(*local_packet, sm_auth_req);
1137     sm_pairing_packet_set_max_encryption_key_size(*local_packet, sm_max_encryption_key_size);
1138 }
1139 
1140 static int sm_stk_generation_init(sm_connection_t * sm_conn){
1141 
1142     sm_pairing_packet_t * remote_packet;
1143     int                   remote_key_request;
1144     if (sm_conn->sm_role){
1145         // slave / responder
1146         remote_packet      = &setup->sm_m_preq;
1147         remote_key_request = sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq);
1148     } else {
1149         // master / initiator
1150         remote_packet      = &setup->sm_s_pres;
1151         remote_key_request = sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres);
1152     }
1153 
1154     // check key size
1155     sm_conn->sm_actual_encryption_key_size = sm_calc_actual_encryption_key_size(sm_pairing_packet_get_max_encryption_key_size(*remote_packet));
1156     if (sm_conn->sm_actual_encryption_key_size == 0) return SM_REASON_ENCRYPTION_KEY_SIZE;
1157 
1158     // decide on STK generation method
1159     sm_setup_tk();
1160     log_info("SMP: generation method %u", setup->sm_stk_generation_method);
1161 
1162     // check if STK generation method is acceptable by client
1163     if (!sm_validate_stk_generation_method()) return SM_REASON_AUTHENTHICATION_REQUIREMENTS;
1164 
1165     // identical to responder
1166     sm_setup_key_distribution(remote_key_request);
1167 
1168     // JUST WORKS doens't provide authentication
1169     sm_conn->sm_connection_authenticated = setup->sm_stk_generation_method == JUST_WORKS ? 0 : 1;
1170 
1171     return 0;
1172 }
1173 
1174 static void sm_address_resolution_handle_event(address_resolution_event_t event){
1175 
1176     // cache and reset context
1177     int matched_device_id = sm_address_resolution_test;
1178     address_resolution_mode_t mode = sm_address_resolution_mode;
1179     void * context = sm_address_resolution_context;
1180 
1181     // reset context
1182     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
1183     sm_address_resolution_context = NULL;
1184     sm_address_resolution_test = -1;
1185     hci_con_handle_t con_handle = 0;
1186 
1187     sm_connection_t * sm_connection;
1188     uint16_t ediv;
1189     switch (mode){
1190         case ADDRESS_RESOLUTION_GENERAL:
1191             break;
1192         case ADDRESS_RESOLUTION_FOR_CONNECTION:
1193             sm_connection = (sm_connection_t *) context;
1194             con_handle = sm_connection->sm_handle;
1195             switch (event){
1196                 case ADDRESS_RESOLUTION_SUCEEDED:
1197                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_SUCCEEDED;
1198                     sm_connection->sm_le_db_index = matched_device_id;
1199                     log_info("ADDRESS_RESOLUTION_SUCEEDED, index %d", sm_connection->sm_le_db_index);
1200                     if (sm_connection->sm_role) break;
1201                     if (!sm_connection->sm_bonding_requested && !sm_connection->sm_security_request_received) break;
1202                     sm_connection->sm_security_request_received = 0;
1203                     sm_connection->sm_bonding_requested = 0;
1204                     le_device_db_encryption_get(sm_connection->sm_le_db_index, &ediv, NULL, NULL, NULL, NULL, NULL);
1205                     if (ediv){
1206                         sm_connection->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
1207                     } else {
1208                         sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1209                     }
1210                     break;
1211                 case ADDRESS_RESOLUTION_FAILED:
1212                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_FAILED;
1213                     if (sm_connection->sm_role) break;
1214                     if (!sm_connection->sm_bonding_requested && !sm_connection->sm_security_request_received) break;
1215                     sm_connection->sm_security_request_received = 0;
1216                     sm_connection->sm_bonding_requested = 0;
1217                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1218                     break;
1219             }
1220             break;
1221         default:
1222             break;
1223     }
1224 
1225     switch (event){
1226         case ADDRESS_RESOLUTION_SUCEEDED:
1227             sm_notify_client_index(SM_EVENT_IDENTITY_RESOLVING_SUCCEEDED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address, matched_device_id);
1228             break;
1229         case ADDRESS_RESOLUTION_FAILED:
1230             sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_FAILED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address);
1231             break;
1232     }
1233 }
1234 
1235 static void sm_key_distribution_handle_all_received(sm_connection_t * sm_conn){
1236 
1237     int le_db_index = -1;
1238 
1239     // lookup device based on IRK
1240     if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
1241         int i;
1242         for (i=0; i < le_device_db_count(); i++){
1243             sm_key_t irk;
1244             bd_addr_t address;
1245             int address_type;
1246             le_device_db_info(i, &address_type, address, irk);
1247             if (memcmp(irk, setup->sm_peer_irk, 16) == 0){
1248                 log_info("sm: device found for IRK, updating");
1249                 le_db_index = i;
1250                 break;
1251             }
1252         }
1253     }
1254 
1255     // if not found, lookup via public address if possible
1256     log_info("sm peer addr type %u, peer addres %s", setup->sm_peer_addr_type, bd_addr_to_str(setup->sm_peer_address));
1257     if (le_db_index < 0 && setup->sm_peer_addr_type == BD_ADDR_TYPE_LE_PUBLIC){
1258         int i;
1259         for (i=0; i < le_device_db_count(); i++){
1260             bd_addr_t address;
1261             int address_type;
1262             le_device_db_info(i, &address_type, address, NULL);
1263             log_info("device %u, sm peer addr type %u, peer addres %s", i, address_type, bd_addr_to_str(address));
1264             if (address_type == BD_ADDR_TYPE_LE_PUBLIC && memcmp(address, setup->sm_peer_address, 6) == 0){
1265                 log_info("sm: device found for public address, updating");
1266                 le_db_index = i;
1267                 break;
1268             }
1269         }
1270     }
1271 
1272     // if not found, add to db
1273     if (le_db_index < 0) {
1274         le_db_index = le_device_db_add(setup->sm_peer_addr_type, setup->sm_peer_address, setup->sm_peer_irk);
1275     }
1276 
1277     if (le_db_index >= 0){
1278         le_device_db_local_counter_set(le_db_index, 0);
1279 
1280         // store local CSRK
1281         if (setup->sm_key_distribution_send_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1282             log_info("sm: store local CSRK");
1283             le_device_db_local_csrk_set(le_db_index, setup->sm_local_csrk);
1284             le_device_db_local_counter_set(le_db_index, 0);
1285         }
1286 
1287         // store remote CSRK
1288         if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1289             log_info("sm: store remote CSRK");
1290             le_device_db_remote_csrk_set(le_db_index, setup->sm_peer_csrk);
1291             le_device_db_remote_counter_set(le_db_index, 0);
1292         }
1293 
1294         // store encryption information
1295         if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION
1296             && setup->sm_key_distribution_received_set &  SM_KEYDIST_FLAG_MASTER_IDENTIFICATION){
1297             log_info("sm: set encryption information (key size %u, authenticatd %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
1298             le_device_db_encryption_set(le_db_index, setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1299                 sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
1300         }
1301     }
1302 
1303     // keep le_db_index
1304     sm_conn->sm_le_db_index = le_db_index;
1305 }
1306 
1307 static void sm_pairing_error(sm_connection_t * sm_conn, uint8_t reason){
1308     setup->sm_pairing_failed_reason = reason;
1309     sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1310 }
1311 
1312 static inline void sm_pdu_received_in_wrong_state(sm_connection_t * sm_conn){
1313     sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
1314 }
1315 
1316 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1317 
1318 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn);
1319 static int sm_passkey_used(stk_generation_method_t method);
1320 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method);
1321 
1322 static void sm_sc_state_after_receiving_random(sm_connection_t * sm_conn){
1323     if (sm_conn->sm_role){
1324         // Responder
1325         sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
1326     } else {
1327         // Initiator role
1328         switch (setup->sm_stk_generation_method){
1329             case JUST_WORKS:
1330                 sm_sc_prepare_dhkey_check(sm_conn);
1331                 break;
1332 
1333             case NK_BOTH_INPUT:
1334                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_G2;
1335                 break;
1336             case PK_INIT_INPUT:
1337             case PK_RESP_INPUT:
1338             case OK_BOTH_INPUT:
1339                 if (setup->sm_passkey_bit < 20) {
1340                     sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
1341                 } else {
1342                     sm_sc_prepare_dhkey_check(sm_conn);
1343                 }
1344                 break;
1345             case OOB:
1346                 // TODO: implement SC OOB
1347                 break;
1348         }
1349     }
1350 }
1351 
1352 static uint8_t sm_sc_cmac_get_byte(uint16_t offset){
1353     return sm_cmac_sc_buffer[offset];
1354 }
1355 
1356 static void sm_sc_cmac_done(uint8_t * hash){
1357     log_info("sm_sc_cmac_done: ");
1358     log_info_hexdump(hash, 16);
1359 
1360     sm_connection_t * sm_conn = sm_cmac_connection;
1361     sm_cmac_connection = NULL;
1362 
1363     switch (sm_conn->sm_engine_state){
1364         case SM_SC_W4_CMAC_FOR_CONFIRMATION:
1365             memcpy(setup->sm_local_confirm, hash, 16);
1366             sm_conn->sm_engine_state = SM_SC_SEND_CONFIRMATION;
1367             break;
1368         case SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION:
1369             // check
1370             if (0 != memcmp(hash, setup->sm_peer_confirm, 16)){
1371                 sm_pairing_error(sm_conn, SM_REASON_CONFIRM_VALUE_FAILED);
1372                 break;
1373             }
1374             sm_sc_state_after_receiving_random(sm_conn);
1375             break;
1376         case SM_SC_W4_CALCULATE_G2: {
1377             uint32_t vab = big_endian_read_32(hash, 12) % 1000000;
1378             big_endian_store_32(setup->sm_tk, 12, vab);
1379             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
1380             sm_trigger_user_response(sm_conn);
1381             break;
1382         }
1383         case SM_SC_W4_CALCULATE_F5_SALT:
1384             memcpy(setup->sm_t, hash, 16);
1385             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_MACKEY;
1386             break;
1387         case SM_SC_W4_CALCULATE_F5_MACKEY:
1388             memcpy(setup->sm_mackey, hash, 16);
1389             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_LTK;
1390             break;
1391         case SM_SC_W4_CALCULATE_F5_LTK:
1392             memcpy(setup->sm_ltk, hash, 16);
1393             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK;
1394             break;
1395         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
1396             memcpy(setup->sm_local_dhkey_check, hash, 16);
1397             if (sm_conn->sm_role){
1398                 // responder
1399                 if (setup->sm_state_vars & SM_STATE_VAR_DHKEY_COMMAND_RECEIVED){
1400                     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
1401                 } else {
1402                     sm_conn->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
1403                 }
1404             } else {
1405                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1406             }
1407             break;
1408         case SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
1409             if (0 != memcmp(hash, setup->sm_peer_dhkey_check, 16) ){
1410                 sm_pairing_error(sm_conn, SM_REASON_DHKEY_CHECK_FAILED);
1411                 break;
1412             }
1413             if (sm_conn->sm_role){
1414                 // responder
1415                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1416             } else {
1417                 // initiator
1418                 sm_conn->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
1419             }
1420             break;
1421         default:
1422             log_error("sm_sc_cmac_done in state %u", sm_conn->sm_engine_state);
1423             break;
1424     }
1425     sm_run();
1426 }
1427 
1428 static void f4_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, uint8_t z){
1429     const uint16_t message_len = 65;
1430     sm_cmac_connection = sm_conn;
1431     memcpy(sm_cmac_sc_buffer, u, 32);
1432     memcpy(sm_cmac_sc_buffer+32, v, 32);
1433     sm_cmac_sc_buffer[64] = z;
1434     log_info("f4 key");
1435     log_info_hexdump(x, 16);
1436     log_info("f4 message");
1437     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1438     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1439 }
1440 
1441 static const sm_key_t f5_salt = { 0x6C ,0x88, 0x83, 0x91, 0xAA, 0xF5, 0xA5, 0x38, 0x60, 0x37, 0x0B, 0xDB, 0x5A, 0x60, 0x83, 0xBE};
1442 static const uint8_t f5_key_id[] = { 0x62, 0x74, 0x6c, 0x65 };
1443 static const uint8_t f5_length[] = { 0x01, 0x00};
1444 
1445 static void sm_sc_calculate_dhkey(sm_key256_t dhkey){
1446 #ifdef USE_MBEDTLS_FOR_ECDH
1447     // da * Pb
1448     mbedtls_ecp_group grp;
1449     mbedtls_ecp_group_init( &grp );
1450     mbedtls_ecp_group_load(&grp, MBEDTLS_ECP_DP_SECP256R1);
1451     mbedtls_ecp_point Q;
1452     mbedtls_ecp_point_init( &Q );
1453     mbedtls_mpi_read_binary(&Q.X, setup->sm_peer_qx, 32);
1454     mbedtls_mpi_read_binary(&Q.Y, setup->sm_peer_qy, 32);
1455     mbedtls_mpi_read_string(&Q.Z, 16, "1" );
1456     mbedtls_ecp_point DH;
1457     mbedtls_ecp_point_init( &DH );
1458     mbedtls_ecp_mul(&grp, &DH, &le_keypair.d, &Q, NULL, NULL);
1459     mbedtls_mpi_write_binary(&DH.X, dhkey, 32);
1460 #endif
1461     log_info("dhkey");
1462     log_info_hexdump(dhkey, 32);
1463 }
1464 
1465 static void f5_calculate_salt(sm_connection_t * sm_conn){
1466     // calculate DHKEY
1467     sm_key256_t dhkey;
1468     sm_sc_calculate_dhkey(dhkey);
1469 
1470     // calculate salt for f5
1471     const uint16_t message_len = 32;
1472     sm_cmac_connection = sm_conn;
1473     memcpy(sm_cmac_sc_buffer, dhkey, message_len);
1474     sm_cmac_general_start(f5_salt, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1475 }
1476 
1477 static inline void f5_mackkey(sm_connection_t * sm_conn, sm_key_t t, const sm_key_t n1, const sm_key_t n2, const sm_key56_t a1, const sm_key56_t a2){
1478     const uint16_t message_len = 53;
1479     sm_cmac_connection = sm_conn;
1480 
1481     // f5(W, N1, N2, A1, A2) = AES-CMACT (Counter = 0 || keyID || N1 || N2|| A1|| A2 || Length = 256) -- this is the MacKey
1482     sm_cmac_sc_buffer[0] = 0;
1483     memcpy(sm_cmac_sc_buffer+01, f5_key_id, 4);
1484     memcpy(sm_cmac_sc_buffer+05, n1, 16);
1485     memcpy(sm_cmac_sc_buffer+21, n2, 16);
1486     memcpy(sm_cmac_sc_buffer+37, a1, 7);
1487     memcpy(sm_cmac_sc_buffer+44, a2, 7);
1488     memcpy(sm_cmac_sc_buffer+51, f5_length, 2);
1489     log_info("f5 key");
1490     log_info_hexdump(t, 16);
1491     log_info("f5 message for MacKey");
1492     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1493     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1494 }
1495 
1496 static void f5_calculate_mackey(sm_connection_t * sm_conn){
1497     sm_key56_t bd_addr_master, bd_addr_slave;
1498     bd_addr_master[0] =  setup->sm_m_addr_type;
1499     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1500     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1501     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1502     if (sm_conn->sm_role){
1503         // responder
1504         f5_mackkey(sm_conn, setup->sm_t, setup->sm_peer_nonce, setup->sm_local_nonce, bd_addr_master, bd_addr_slave);
1505     } else {
1506         // initiator
1507         f5_mackkey(sm_conn, setup->sm_t, setup->sm_local_nonce, setup->sm_peer_nonce, bd_addr_master, bd_addr_slave);
1508     }
1509 }
1510 
1511 // note: must be called right after f5_mackey, as sm_cmac_buffer[1..52] will be reused
1512 static inline void f5_ltk(sm_connection_t * sm_conn, sm_key_t t){
1513     const uint16_t message_len = 53;
1514     sm_cmac_connection = sm_conn;
1515     sm_cmac_sc_buffer[0] = 1;
1516     // 1..52 setup before
1517     log_info("f5 key");
1518     log_info_hexdump(t, 16);
1519     log_info("f5 message for LTK");
1520     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1521     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1522 }
1523 
1524 static void f5_calculate_ltk(sm_connection_t * sm_conn){
1525     f5_ltk(sm_conn, setup->sm_t);
1526 }
1527 
1528 static void f6_engine(sm_connection_t * sm_conn, const sm_key_t w, const sm_key_t n1, const sm_key_t n2, const sm_key_t r, const sm_key24_t io_cap, const sm_key56_t a1, const sm_key56_t a2){
1529     const uint16_t message_len = 65;
1530     sm_cmac_connection = sm_conn;
1531     memcpy(sm_cmac_sc_buffer, n1, 16);
1532     memcpy(sm_cmac_sc_buffer+16, n2, 16);
1533     memcpy(sm_cmac_sc_buffer+32, r, 16);
1534     memcpy(sm_cmac_sc_buffer+48, io_cap, 3);
1535     memcpy(sm_cmac_sc_buffer+51, a1, 7);
1536     memcpy(sm_cmac_sc_buffer+58, a2, 7);
1537     log_info("f6 key");
1538     log_info_hexdump(w, 16);
1539     log_info("f6 message");
1540     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1541     sm_cmac_general_start(w, 65, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1542 }
1543 
1544 // g2(U, V, X, Y) = AES-CMACX(U || V || Y) mod 2^32
1545 // - U is 256 bits
1546 // - V is 256 bits
1547 // - X is 128 bits
1548 // - Y is 128 bits
1549 static void g2_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, const sm_key_t y){
1550     const uint16_t message_len = 80;
1551     sm_cmac_connection = sm_conn;
1552     memcpy(sm_cmac_sc_buffer, u, 32);
1553     memcpy(sm_cmac_sc_buffer+32, v, 32);
1554     memcpy(sm_cmac_sc_buffer+64, y, 16);
1555     log_info("g2 key");
1556     log_info_hexdump(x, 16);
1557     log_info("g2 message");
1558     log_info_hexdump(sm_cmac_sc_buffer, sizeof(sm_cmac_sc_buffer));
1559     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1560 }
1561 
1562 static void g2_calculate_engine(sm_connection_t * sm_conn) {
1563     // calc Va if numeric comparison
1564     uint8_t value[32];
1565     mbedtls_mpi_write_binary(&le_keypair.Q.X, value, sizeof(value));
1566     if (sm_conn->sm_role){
1567         // responder
1568         g2_engine(sm_conn, setup->sm_peer_qx, value, setup->sm_peer_nonce, setup->sm_local_nonce);;
1569     } else {
1570         // initiator
1571         g2_engine(sm_conn, value, setup->sm_peer_qx, setup->sm_local_nonce, setup->sm_peer_nonce);
1572     }
1573 }
1574 
1575 static void sm_sc_generate_local_nonce(sm_connection_t * sm_conn){
1576     // TODO: use random generator to generate nonce
1577     log_info("SM: generate local nonce");
1578     // generate 128-bit nonce
1579     int i;
1580     for (i=0;i<16;i++){
1581         setup->sm_local_nonce[i] = rand() & 0xff;
1582     }
1583 }
1584 
1585 static void sm_sc_calculate_local_confirm(sm_connection_t * sm_conn){
1586     uint8_t z = 0;
1587     if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT){
1588         // some form of passkey
1589         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1590         z = 0x80 | ((pk >> setup->sm_passkey_bit) & 1);
1591         setup->sm_passkey_bit++;
1592     }
1593 #ifdef USE_MBEDTLS_FOR_ECDH
1594     uint8_t local_qx[32];
1595     mbedtls_mpi_write_binary(&le_keypair.Q.X, local_qx, sizeof(local_qx));
1596 #endif
1597     f4_engine(sm_conn, local_qx, setup->sm_peer_qx, setup->sm_local_nonce, z);
1598 }
1599 
1600 static void sm_sc_calculate_remote_confirm(sm_connection_t * sm_conn){
1601     uint8_t z = 0;
1602     if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT){
1603         // some form of passkey
1604         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1605         // sm_passkey_bit was increased before sending confirm value
1606         z = 0x80 | ((pk >> (setup->sm_passkey_bit-1)) & 1);
1607     }
1608 #ifdef USE_MBEDTLS_FOR_ECDH
1609     uint8_t local_qx[32];
1610     mbedtls_mpi_write_binary(&le_keypair.Q.X, local_qx, sizeof(local_qx));
1611 #endif
1612     f4_engine(sm_conn, setup->sm_peer_qx, local_qx, setup->sm_peer_nonce, z);
1613 }
1614 
1615 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn){
1616     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_SALT;
1617 }
1618 
1619 static void sm_sc_calculate_f6_for_dhkey_check(sm_connection_t * sm_conn){
1620     // calculate DHKCheck
1621     sm_key56_t bd_addr_master, bd_addr_slave;
1622     bd_addr_master[0] =  setup->sm_m_addr_type;
1623     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1624     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1625     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1626     uint8_t iocap_a[3];
1627     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1628     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1629     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1630     uint8_t iocap_b[3];
1631     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1632     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1633     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1634     if (sm_conn->sm_role){
1635         // responder
1636         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1637     } else {
1638         // initiator
1639         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1640     }
1641 }
1642 
1643 static void sm_sc_calculate_f6_to_verify_dhkey_check(sm_connection_t * sm_conn){
1644     // validate E = f6()
1645     sm_key56_t bd_addr_master, bd_addr_slave;
1646     bd_addr_master[0] =  setup->sm_m_addr_type;
1647     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1648     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1649     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1650 
1651     uint8_t iocap_a[3];
1652     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1653     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1654     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1655     uint8_t iocap_b[3];
1656     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1657     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1658     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1659     if (sm_conn->sm_role){
1660         // responder
1661         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1662     } else {
1663         // initiator
1664         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1665     }
1666 }
1667 #endif
1668 
1669 
1670 static void sm_run(void){
1671 
1672     btstack_linked_list_iterator_t it;
1673 
1674     // assert that we can send at least commands
1675     if (!hci_can_send_command_packet_now()) return;
1676 
1677     //
1678     // non-connection related behaviour
1679     //
1680 
1681     // distributed key generation
1682     switch (dkg_state){
1683         case DKG_CALC_IRK:
1684             // already busy?
1685             if (sm_aes128_state == SM_AES128_IDLE) {
1686                 // IRK = d1(IR, 1, 0)
1687                 sm_key_t d1_prime;
1688                 sm_d1_d_prime(1, 0, d1_prime);  // plaintext
1689                 dkg_next_state();
1690                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
1691                 return;
1692             }
1693             break;
1694         case DKG_CALC_DHK:
1695             // already busy?
1696             if (sm_aes128_state == SM_AES128_IDLE) {
1697                 // DHK = d1(IR, 3, 0)
1698                 sm_key_t d1_prime;
1699                 sm_d1_d_prime(3, 0, d1_prime);  // plaintext
1700                 dkg_next_state();
1701                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
1702                 return;
1703             }
1704             break;
1705         default:
1706             break;
1707     }
1708 
1709 #ifdef USE_MBEDTLS_FOR_ECDH
1710     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
1711         sm_random_start(NULL);
1712         return;
1713     }
1714 #endif
1715 
1716     // random address updates
1717     switch (rau_state){
1718         case RAU_GET_RANDOM:
1719             rau_next_state();
1720             sm_random_start(NULL);
1721             return;
1722         case RAU_GET_ENC:
1723             // already busy?
1724             if (sm_aes128_state == SM_AES128_IDLE) {
1725                 sm_key_t r_prime;
1726                 sm_ah_r_prime(sm_random_address, r_prime);
1727                 rau_next_state();
1728                 sm_aes128_start(sm_persistent_irk, r_prime, NULL);
1729                 return;
1730             }
1731             break;
1732         case RAU_SET_ADDRESS:
1733             log_info("New random address: %s", bd_addr_to_str(sm_random_address));
1734             rau_state = RAU_IDLE;
1735             hci_send_cmd(&hci_le_set_random_address, sm_random_address);
1736             return;
1737         default:
1738             break;
1739     }
1740 
1741     // CMAC
1742     switch (sm_cmac_state){
1743         case CMAC_CALC_SUBKEYS:
1744         case CMAC_CALC_MI:
1745         case CMAC_CALC_MLAST:
1746             // already busy?
1747             if (sm_aes128_state == SM_AES128_ACTIVE) break;
1748             sm_cmac_handle_aes_engine_ready();
1749             return;
1750         default:
1751             break;
1752     }
1753 
1754     // CSRK Lookup
1755     // -- if csrk lookup ready, find connection that require csrk lookup
1756     if (sm_address_resolution_idle()){
1757         hci_connections_get_iterator(&it);
1758         while(btstack_linked_list_iterator_has_next(&it)){
1759             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1760             sm_connection_t  * sm_connection  = &hci_connection->sm_connection;
1761             if (sm_connection->sm_irk_lookup_state == IRK_LOOKUP_W4_READY){
1762                 // and start lookup
1763                 sm_address_resolution_start_lookup(sm_connection->sm_peer_addr_type, sm_connection->sm_handle, sm_connection->sm_peer_address, ADDRESS_RESOLUTION_FOR_CONNECTION, sm_connection);
1764                 sm_connection->sm_irk_lookup_state = IRK_LOOKUP_STARTED;
1765                 break;
1766             }
1767         }
1768     }
1769 
1770     // -- if csrk lookup ready, resolved addresses for received addresses
1771     if (sm_address_resolution_idle()) {
1772         if (!btstack_linked_list_empty(&sm_address_resolution_general_queue)){
1773             sm_lookup_entry_t * entry = (sm_lookup_entry_t *) sm_address_resolution_general_queue;
1774             btstack_linked_list_remove(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
1775             sm_address_resolution_start_lookup(entry->address_type, 0, entry->address, ADDRESS_RESOLUTION_GENERAL, NULL);
1776             btstack_memory_sm_lookup_entry_free(entry);
1777         }
1778     }
1779 
1780     // -- Continue with CSRK device lookup by public or resolvable private address
1781     if (!sm_address_resolution_idle()){
1782         log_info("LE Device Lookup: device %u/%u", sm_address_resolution_test, le_device_db_count());
1783         while (sm_address_resolution_test < le_device_db_count()){
1784             int addr_type;
1785             bd_addr_t addr;
1786             sm_key_t irk;
1787             le_device_db_info(sm_address_resolution_test, &addr_type, addr, irk);
1788             log_info("device type %u, addr: %s", addr_type, bd_addr_to_str(addr));
1789 
1790             if (sm_address_resolution_addr_type == addr_type && memcmp(addr, sm_address_resolution_address, 6) == 0){
1791                 log_info("LE Device Lookup: found CSRK by { addr_type, address} ");
1792                 sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
1793                 break;
1794             }
1795 
1796             if (sm_address_resolution_addr_type == 0){
1797                 sm_address_resolution_test++;
1798                 continue;
1799             }
1800 
1801             if (sm_aes128_state == SM_AES128_ACTIVE) break;
1802 
1803             log_info("LE Device Lookup: calculate AH");
1804             log_info_key("IRK", irk);
1805 
1806             sm_key_t r_prime;
1807             sm_ah_r_prime(sm_address_resolution_address, r_prime);
1808             sm_address_resolution_ah_calculation_active = 1;
1809             sm_aes128_start(irk, r_prime, sm_address_resolution_context);   // keep context
1810             return;
1811         }
1812 
1813         if (sm_address_resolution_test >= le_device_db_count()){
1814             log_info("LE Device Lookup: not found");
1815             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_FAILED);
1816         }
1817     }
1818 
1819 
1820     //
1821     // active connection handling
1822     // -- use loop to handle next connection if lock on setup context is released
1823 
1824     while (1) {
1825 
1826         // Find connections that requires setup context and make active if no other is locked
1827         hci_connections_get_iterator(&it);
1828         while(!sm_active_connection && btstack_linked_list_iterator_has_next(&it)){
1829             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1830             sm_connection_t  * sm_connection = &hci_connection->sm_connection;
1831             // - if no connection locked and we're ready/waiting for setup context, fetch it and start
1832             int done = 1;
1833             int err;
1834             int encryption_key_size;
1835             int authenticated;
1836             int authorized;
1837             switch (sm_connection->sm_engine_state) {
1838                 case SM_RESPONDER_SEND_SECURITY_REQUEST:
1839                     // send packet if possible,
1840                     if (l2cap_can_send_fixed_channel_packet_now(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)){
1841                         const uint8_t buffer[2] = { SM_CODE_SECURITY_REQUEST, SM_AUTHREQ_BONDING};
1842                         sm_connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_REQUEST;
1843                         l2cap_send_connectionless(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
1844                     } else {
1845                         l2cap_request_can_send_fix_channel_now_event(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
1846                     }
1847                     // don't lock setup context yet
1848                     done = 0;
1849                     break;
1850                 case SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED:
1851                     sm_init_setup(sm_connection);
1852                     // recover pairing request
1853                     memcpy(&setup->sm_m_preq, &sm_connection->sm_m_preq, sizeof(sm_pairing_packet_t));
1854                     err = sm_stk_generation_init(sm_connection);
1855                     if (err){
1856                         setup->sm_pairing_failed_reason = err;
1857                         sm_connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1858                         break;
1859                     }
1860                     sm_timeout_start(sm_connection);
1861                     // generate random number first, if we need to show passkey
1862                     if (setup->sm_stk_generation_method == PK_INIT_INPUT){
1863                         sm_connection->sm_engine_state = SM_PH2_GET_RANDOM_TK;
1864                         break;
1865                     }
1866                     sm_connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
1867                     break;
1868                 case SM_INITIATOR_PH0_HAS_LTK:
1869                     // fetch data from device db - incl. authenticated/authorized/key size. Note all sm_connection_X require encryption enabled
1870                     le_device_db_encryption_get(sm_connection->sm_le_db_index, &setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1871                                                 &encryption_key_size, &authenticated, &authorized);
1872                     log_info("db index %u, key size %u, authenticated %u, authorized %u", sm_connection->sm_le_db_index, encryption_key_size, authenticated, authorized);
1873                     sm_connection->sm_actual_encryption_key_size = encryption_key_size;
1874                     sm_connection->sm_connection_authenticated = authenticated;
1875                     sm_connection->sm_connection_authorization_state = authorized ? AUTHORIZATION_GRANTED : AUTHORIZATION_UNKNOWN;
1876                     sm_connection->sm_engine_state = SM_INITIATOR_PH0_SEND_START_ENCRYPTION;
1877                     break;
1878                 case SM_RESPONDER_PH0_RECEIVED_LTK:
1879                     // re-establish previously used LTK using Rand and EDIV
1880                     memcpy(setup->sm_local_rand, sm_connection->sm_local_rand, 8);
1881                     setup->sm_local_ediv = sm_connection->sm_local_ediv;
1882                     // re-establish used key encryption size
1883                     // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
1884                     sm_connection->sm_actual_encryption_key_size = (setup->sm_local_rand[7] & 0x0f) + 1;
1885                     // no db for authenticated flag hack: flag is stored in bit 4 of LSB
1886                     sm_connection->sm_connection_authenticated = (setup->sm_local_rand[7] & 0x10) >> 4;
1887                     log_info("sm: received ltk request with key size %u, authenticated %u",
1888                             sm_connection->sm_actual_encryption_key_size, sm_connection->sm_connection_authenticated);
1889                     sm_connection->sm_engine_state = SM_RESPONDER_PH4_Y_GET_ENC;
1890                     break;
1891                 case SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST:
1892                     sm_init_setup(sm_connection);
1893                     sm_timeout_start(sm_connection);
1894                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_SEND_PAIRING_REQUEST;
1895                     break;
1896                 default:
1897                     done = 0;
1898                     break;
1899             }
1900             if (done){
1901                 sm_active_connection = sm_connection->sm_handle;
1902                 log_info("sm: connection 0x%04x locked setup context as %s", sm_active_connection, sm_connection->sm_role ? "responder" : "initiator");
1903             }
1904         }
1905 
1906         //
1907         // active connection handling
1908         //
1909 
1910         if (sm_active_connection == 0) return;
1911 
1912         // assert that we could send a SM PDU - not needed for all of the following
1913         if (!l2cap_can_send_fixed_channel_packet_now(sm_active_connection, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)) {
1914             l2cap_request_can_send_fix_channel_now_event(sm_active_connection, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
1915             return;
1916         }
1917 
1918         sm_connection_t * connection = sm_get_connection_for_handle(sm_active_connection);
1919         if (!connection) return;
1920 
1921         sm_key_t plaintext;
1922         int key_distribution_flags;
1923 
1924         log_info("sm_run: state %u", connection->sm_engine_state);
1925 
1926         // responding state
1927         switch (connection->sm_engine_state){
1928 
1929             // general
1930             case SM_GENERAL_SEND_PAIRING_FAILED: {
1931                 uint8_t buffer[2];
1932                 buffer[0] = SM_CODE_PAIRING_FAILED;
1933                 buffer[1] = setup->sm_pairing_failed_reason;
1934                 connection->sm_engine_state = connection->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
1935                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
1936                 sm_done_for_handle(connection->sm_handle);
1937                 break;
1938             }
1939 
1940 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1941             case SM_SC_W2_GET_RANDOM_A:
1942                 sm_random_start(connection);
1943                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_A;
1944                 break;
1945 
1946             case SM_SC_W2_GET_RANDOM_B:
1947                 sm_random_start(connection);
1948                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_B;
1949                 break;
1950 
1951             case SM_SC_W2_CMAC_FOR_CONFIRMATION:
1952                 if (!sm_cmac_ready()) break;
1953 
1954                 if (sm_passkey_used(setup->sm_stk_generation_method)){
1955                     sm_sc_generate_local_nonce(connection);
1956                 }
1957 
1958                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CONFIRMATION;
1959                 sm_sc_calculate_local_confirm(connection);
1960                 break;
1961 
1962             case SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION:
1963                 if (!sm_cmac_ready()) break;
1964                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION;
1965                 sm_sc_calculate_remote_confirm(connection);
1966                 break;
1967 
1968             case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
1969                 if (!sm_cmac_ready()) break;
1970                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK;
1971                 sm_sc_calculate_f6_for_dhkey_check(connection);
1972                 break;
1973             case SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
1974                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
1975                 sm_sc_calculate_f6_to_verify_dhkey_check(connection);
1976                 break;
1977             case SM_SC_W2_CALCULATE_F5_SALT:
1978                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_SALT;
1979                 f5_calculate_salt(connection);
1980                 break;
1981             case SM_SC_W2_CALCULATE_F5_MACKEY:
1982                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_MACKEY;
1983                 f5_calculate_mackey(connection);
1984                 break;
1985             case SM_SC_W2_CALCULATE_F5_LTK:
1986                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_LTK;
1987                 f5_calculate_ltk(connection);
1988                 break;
1989             case SM_SC_W2_CALCULATE_G2:
1990                 connection->sm_engine_state = SM_SC_W4_CALCULATE_G2;
1991                 g2_calculate_engine(connection);
1992                 break;
1993 
1994 #endif
1995             // initiator side
1996             case SM_INITIATOR_PH0_SEND_START_ENCRYPTION: {
1997                 sm_key_t peer_ltk_flipped;
1998                 reverse_128(setup->sm_peer_ltk, peer_ltk_flipped);
1999                 connection->sm_engine_state = SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED;
2000                 log_info("sm: hci_le_start_encryption ediv 0x%04x", setup->sm_peer_ediv);
2001                 uint32_t rand_high = big_endian_read_32(setup->sm_peer_rand, 0);
2002                 uint32_t rand_low  = big_endian_read_32(setup->sm_peer_rand, 4);
2003                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle,rand_low, rand_high, setup->sm_peer_ediv, peer_ltk_flipped);
2004                 return;
2005             }
2006 
2007             case SM_INITIATOR_PH1_SEND_PAIRING_REQUEST:
2008                 sm_pairing_packet_set_code(setup->sm_m_preq, SM_CODE_PAIRING_REQUEST);
2009                 connection->sm_engine_state = SM_INITIATOR_PH1_W4_PAIRING_RESPONSE;
2010                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_m_preq, sizeof(sm_pairing_packet_t));
2011                 sm_timeout_reset(connection);
2012                 break;
2013 
2014             // responder side
2015             case SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY:
2016                 connection->sm_engine_state = SM_RESPONDER_IDLE;
2017                 hci_send_cmd(&hci_le_long_term_key_negative_reply, connection->sm_handle);
2018                 return;
2019 
2020 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2021             case SM_SC_SEND_PUBLIC_KEY_COMMAND: {
2022                 uint8_t buffer[65];
2023                 buffer[0] = SM_CODE_PAIRING_PUBLIC_KEY;
2024                 //
2025 #ifdef USE_MBEDTLS_FOR_ECDH
2026                 uint8_t value[32];
2027                 mbedtls_mpi_write_binary(&le_keypair.Q.X, value, sizeof(value));
2028                 reverse_256(value, &buffer[1]);
2029                 mbedtls_mpi_write_binary(&le_keypair.Q.Y, value, sizeof(value));
2030                 reverse_256(value, &buffer[33]);
2031 #endif
2032 
2033                 // stk generation method
2034                 // passkey entry: notify app to show passkey or to request passkey
2035                 switch (setup->sm_stk_generation_method){
2036                     case JUST_WORKS:
2037                     case NK_BOTH_INPUT:
2038                         if (connection->sm_role){
2039                             connection->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
2040                         } else {
2041                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2042                         }
2043                         break;
2044                     case PK_INIT_INPUT:
2045                     case PK_RESP_INPUT:
2046                     case OK_BOTH_INPUT:
2047                         // hack for testing: assume user entered '000000'
2048                         // memset(setup->sm_tk, 0, 16);
2049                         memcpy(setup->sm_ra, setup->sm_tk, 16);
2050                         memcpy(setup->sm_rb, setup->sm_tk, 16);
2051                         setup->sm_passkey_bit = 0;
2052                         if (connection->sm_role){
2053                             // responder
2054                             connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2055                         } else {
2056                             // initiator
2057                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2058                         }
2059                         sm_trigger_user_response(connection);
2060                         break;
2061                     case OOB:
2062                         // TODO: implement SC OOB
2063                         break;
2064                 }
2065 
2066                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2067                 sm_timeout_reset(connection);
2068                 break;
2069             }
2070             case SM_SC_SEND_CONFIRMATION: {
2071                 uint8_t buffer[17];
2072                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2073                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2074                 if (connection->sm_role){
2075                     connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2076                 } else {
2077                     connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2078                 }
2079                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2080                 sm_timeout_reset(connection);
2081                 break;
2082             }
2083             case SM_SC_SEND_PAIRING_RANDOM: {
2084                 uint8_t buffer[17];
2085                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2086                 reverse_128(setup->sm_local_nonce, &buffer[1]);
2087                 if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT && setup->sm_passkey_bit < 20){
2088                     if (connection->sm_role){
2089                         // responder
2090                         connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2091                     } else {
2092                         // initiator
2093                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2094                     }
2095                 } else {
2096                     if (connection->sm_role){
2097                         // responder
2098                         if (setup->sm_stk_generation_method == NK_BOTH_INPUT){
2099                             connection->sm_engine_state = SM_SC_W2_CALCULATE_G2;
2100                         } else {
2101                             sm_sc_prepare_dhkey_check(connection);
2102                         }
2103                     } else {
2104                         // initiator
2105                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2106                     }
2107                 }
2108                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2109                 sm_timeout_reset(connection);
2110                 break;
2111             }
2112             case SM_SC_SEND_DHKEY_CHECK_COMMAND: {
2113                 uint8_t buffer[17];
2114                 buffer[0] = SM_CODE_PAIRING_DHKEY_CHECK;
2115                 reverse_128(setup->sm_local_dhkey_check, &buffer[1]);
2116 
2117                 if (connection->sm_role){
2118                     connection->sm_engine_state = SM_SC_W4_LTK_REQUEST_SC;
2119                 } else {
2120                     connection->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
2121                 }
2122 
2123                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2124                 sm_timeout_reset(connection);
2125                 break;
2126             }
2127 
2128 #endif
2129             case SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE:
2130                 // echo initiator for now
2131                 sm_pairing_packet_set_code(setup->sm_s_pres,SM_CODE_PAIRING_RESPONSE);
2132                 key_distribution_flags = sm_key_distribution_flags_for_auth_req();
2133 
2134                 connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_CONFIRM;
2135 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2136                 if (setup->sm_use_secure_connections){
2137                     connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2138                     // skip LTK/EDIV for SC
2139                     key_distribution_flags &= ~SM_KEYDIST_ENC_KEY;
2140                 }
2141 #endif
2142                 sm_pairing_packet_set_initiator_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_initiator_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2143                 sm_pairing_packet_set_responder_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2144 
2145                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_s_pres, sizeof(sm_pairing_packet_t));
2146                 sm_timeout_reset(connection);
2147                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
2148                 if (setup->sm_stk_generation_method == JUST_WORKS){
2149                     sm_trigger_user_response(connection);
2150                 }
2151                 return;
2152 
2153             case SM_PH2_SEND_PAIRING_RANDOM: {
2154                 uint8_t buffer[17];
2155                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2156                 reverse_128(setup->sm_local_random, &buffer[1]);
2157                 if (connection->sm_role){
2158                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_LTK_REQUEST;
2159                 } else {
2160                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_RANDOM;
2161                 }
2162                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2163                 sm_timeout_reset(connection);
2164                 break;
2165             }
2166 
2167             case SM_PH2_GET_RANDOM_TK:
2168             case SM_PH2_C1_GET_RANDOM_A:
2169             case SM_PH2_C1_GET_RANDOM_B:
2170             case SM_PH3_GET_RANDOM:
2171             case SM_PH3_GET_DIV:
2172                 sm_next_responding_state(connection);
2173                 sm_random_start(connection);
2174                 return;
2175 
2176             case SM_PH2_C1_GET_ENC_B:
2177             case SM_PH2_C1_GET_ENC_D:
2178                 // already busy?
2179                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2180                 sm_next_responding_state(connection);
2181                 sm_aes128_start(setup->sm_tk, setup->sm_c1_t3_value, connection);
2182                 return;
2183 
2184             case SM_PH3_LTK_GET_ENC:
2185             case SM_RESPONDER_PH4_LTK_GET_ENC:
2186                 // already busy?
2187                 if (sm_aes128_state == SM_AES128_IDLE) {
2188                     sm_key_t d_prime;
2189                     sm_d1_d_prime(setup->sm_local_div, 0, d_prime);
2190                     sm_next_responding_state(connection);
2191                     sm_aes128_start(sm_persistent_er, d_prime, connection);
2192                     return;
2193                 }
2194                 break;
2195 
2196             case SM_PH3_CSRK_GET_ENC:
2197                 // already busy?
2198                 if (sm_aes128_state == SM_AES128_IDLE) {
2199                     sm_key_t d_prime;
2200                     sm_d1_d_prime(setup->sm_local_div, 1, d_prime);
2201                     sm_next_responding_state(connection);
2202                     sm_aes128_start(sm_persistent_er, d_prime, connection);
2203                     return;
2204                 }
2205                 break;
2206 
2207             case SM_PH2_C1_GET_ENC_C:
2208                 // already busy?
2209                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2210                 // calculate m_confirm using aes128 engine - step 1
2211                 sm_c1_t1(setup->sm_peer_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
2212                 sm_next_responding_state(connection);
2213                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2214                 break;
2215             case SM_PH2_C1_GET_ENC_A:
2216                 // already busy?
2217                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2218                 // calculate confirm using aes128 engine - step 1
2219                 sm_c1_t1(setup->sm_local_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
2220                 sm_next_responding_state(connection);
2221                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2222                 break;
2223             case SM_PH2_CALC_STK:
2224                 // already busy?
2225                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2226                 // calculate STK
2227                 if (connection->sm_role){
2228                     sm_s1_r_prime(setup->sm_local_random, setup->sm_peer_random, plaintext);
2229                 } else {
2230                     sm_s1_r_prime(setup->sm_peer_random, setup->sm_local_random, plaintext);
2231                 }
2232                 sm_next_responding_state(connection);
2233                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2234                 break;
2235             case SM_PH3_Y_GET_ENC:
2236                 // already busy?
2237                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2238                 // PH3B2 - calculate Y from      - enc
2239                 // Y = dm(DHK, Rand)
2240                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
2241                 sm_next_responding_state(connection);
2242                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
2243                 return;
2244             case SM_PH2_C1_SEND_PAIRING_CONFIRM: {
2245                 uint8_t buffer[17];
2246                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2247                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2248                 if (connection->sm_role){
2249                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_PAIRING_RANDOM;
2250                 } else {
2251                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_CONFIRM;
2252                 }
2253                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2254                 sm_timeout_reset(connection);
2255                 return;
2256             }
2257             case SM_RESPONDER_PH2_SEND_LTK_REPLY: {
2258                 sm_key_t stk_flipped;
2259                 reverse_128(setup->sm_ltk, stk_flipped);
2260                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2261                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, stk_flipped);
2262                 return;
2263             }
2264             case SM_INITIATOR_PH3_SEND_START_ENCRYPTION: {
2265                 sm_key_t stk_flipped;
2266                 reverse_128(setup->sm_ltk, stk_flipped);
2267                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2268                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle, 0, 0, 0, stk_flipped);
2269                 return;
2270             }
2271             case SM_RESPONDER_PH4_SEND_LTK: {
2272                 sm_key_t ltk_flipped;
2273                 reverse_128(setup->sm_ltk, ltk_flipped);
2274                 connection->sm_engine_state = SM_RESPONDER_IDLE;
2275                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, ltk_flipped);
2276                 return;
2277             }
2278             case SM_RESPONDER_PH4_Y_GET_ENC:
2279                 // already busy?
2280                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2281                 log_info("LTK Request: recalculating with ediv 0x%04x", setup->sm_local_ediv);
2282                 // Y = dm(DHK, Rand)
2283                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
2284                 sm_next_responding_state(connection);
2285                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
2286                 return;
2287 
2288             case SM_PH3_DISTRIBUTE_KEYS:
2289                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION){
2290                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
2291                     uint8_t buffer[17];
2292                     buffer[0] = SM_CODE_ENCRYPTION_INFORMATION;
2293                     reverse_128(setup->sm_ltk, &buffer[1]);
2294                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2295                     sm_timeout_reset(connection);
2296                     return;
2297                 }
2298                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_MASTER_IDENTIFICATION){
2299                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
2300                     uint8_t buffer[11];
2301                     buffer[0] = SM_CODE_MASTER_IDENTIFICATION;
2302                     little_endian_store_16(buffer, 1, setup->sm_local_ediv);
2303                     reverse_64(setup->sm_local_rand, &buffer[3]);
2304                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2305                     sm_timeout_reset(connection);
2306                     return;
2307                 }
2308                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
2309                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
2310                     uint8_t buffer[17];
2311                     buffer[0] = SM_CODE_IDENTITY_INFORMATION;
2312                     reverse_128(sm_persistent_irk, &buffer[1]);
2313                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2314                     sm_timeout_reset(connection);
2315                     return;
2316                 }
2317                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION){
2318                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
2319                     bd_addr_t local_address;
2320                     uint8_t buffer[8];
2321                     buffer[0] = SM_CODE_IDENTITY_ADDRESS_INFORMATION;
2322                     gap_advertisements_get_address(&buffer[1], local_address);
2323                     reverse_bd_addr(local_address, &buffer[2]);
2324                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2325                     sm_timeout_reset(connection);
2326                     return;
2327                 }
2328                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
2329                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
2330 
2331                     // hack to reproduce test runs
2332                     if (test_use_fixed_local_csrk){
2333                         memset(setup->sm_local_csrk, 0xcc, 16);
2334                     }
2335 
2336                     uint8_t buffer[17];
2337                     buffer[0] = SM_CODE_SIGNING_INFORMATION;
2338                     reverse_128(setup->sm_local_csrk, &buffer[1]);
2339                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2340                     sm_timeout_reset(connection);
2341                     return;
2342                 }
2343 
2344                 // keys are sent
2345                 if (connection->sm_role){
2346                     // slave -> receive master keys if any
2347                     if (sm_key_distribution_all_received(connection)){
2348                         sm_key_distribution_handle_all_received(connection);
2349                         connection->sm_engine_state = SM_RESPONDER_IDLE;
2350                         sm_done_for_handle(connection->sm_handle);
2351                     } else {
2352                         connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2353                     }
2354                 } else {
2355                     // master -> all done
2356                     connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2357                     sm_done_for_handle(connection->sm_handle);
2358                 }
2359                 break;
2360 
2361             default:
2362                 break;
2363         }
2364 
2365         // check again if active connection was released
2366         if (sm_active_connection) break;
2367     }
2368 }
2369 
2370 // note: aes engine is ready as we just got the aes result
2371 static void sm_handle_encryption_result(uint8_t * data){
2372 
2373     sm_aes128_state = SM_AES128_IDLE;
2374 
2375     if (sm_address_resolution_ah_calculation_active){
2376         sm_address_resolution_ah_calculation_active = 0;
2377         // compare calulated address against connecting device
2378         uint8_t hash[3];
2379         reverse_24(data, hash);
2380         if (memcmp(&sm_address_resolution_address[3], hash, 3) == 0){
2381             log_info("LE Device Lookup: matched resolvable private address");
2382             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
2383             return;
2384         }
2385         // no match, try next
2386         sm_address_resolution_test++;
2387         return;
2388     }
2389 
2390     switch (dkg_state){
2391         case DKG_W4_IRK:
2392             reverse_128(data, sm_persistent_irk);
2393             log_info_key("irk", sm_persistent_irk);
2394             dkg_next_state();
2395             return;
2396         case DKG_W4_DHK:
2397             reverse_128(data, sm_persistent_dhk);
2398             log_info_key("dhk", sm_persistent_dhk);
2399             dkg_next_state();
2400             // SM Init Finished
2401             return;
2402         default:
2403             break;
2404     }
2405 
2406     switch (rau_state){
2407         case RAU_W4_ENC:
2408             reverse_24(data, &sm_random_address[3]);
2409             rau_next_state();
2410             return;
2411         default:
2412             break;
2413     }
2414 
2415     switch (sm_cmac_state){
2416         case CMAC_W4_SUBKEYS:
2417         case CMAC_W4_MI:
2418         case CMAC_W4_MLAST:
2419             {
2420             sm_key_t t;
2421             reverse_128(data, t);
2422             sm_cmac_handle_encryption_result(t);
2423             }
2424             return;
2425         default:
2426             break;
2427     }
2428 
2429     // retrieve sm_connection provided to sm_aes128_start_encryption
2430     sm_connection_t * connection = (sm_connection_t*) sm_aes128_context;
2431     if (!connection) return;
2432     switch (connection->sm_engine_state){
2433         case SM_PH2_C1_W4_ENC_A:
2434         case SM_PH2_C1_W4_ENC_C:
2435             {
2436             sm_key_t t2;
2437             reverse_128(data, t2);
2438             sm_c1_t3(t2, setup->sm_m_address, setup->sm_s_address, setup->sm_c1_t3_value);
2439             }
2440             sm_next_responding_state(connection);
2441             return;
2442         case SM_PH2_C1_W4_ENC_B:
2443             reverse_128(data, setup->sm_local_confirm);
2444             log_info_key("c1!", setup->sm_local_confirm);
2445             connection->sm_engine_state = SM_PH2_C1_SEND_PAIRING_CONFIRM;
2446             return;
2447         case SM_PH2_C1_W4_ENC_D:
2448             {
2449             sm_key_t peer_confirm_test;
2450             reverse_128(data, peer_confirm_test);
2451             log_info_key("c1!", peer_confirm_test);
2452             if (memcmp(setup->sm_peer_confirm, peer_confirm_test, 16) != 0){
2453                 setup->sm_pairing_failed_reason = SM_REASON_CONFIRM_VALUE_FAILED;
2454                 connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
2455                 return;
2456             }
2457             if (connection->sm_role){
2458                 connection->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
2459             } else {
2460                 connection->sm_engine_state = SM_PH2_CALC_STK;
2461             }
2462             }
2463             return;
2464         case SM_PH2_W4_STK:
2465             reverse_128(data, setup->sm_ltk);
2466             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2467             log_info_key("stk", setup->sm_ltk);
2468             if (connection->sm_role){
2469                 connection->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2470             } else {
2471                 connection->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
2472             }
2473             return;
2474         case SM_PH3_Y_W4_ENC:{
2475             sm_key_t y128;
2476             reverse_128(data, y128);
2477             setup->sm_local_y = big_endian_read_16(y128, 14);
2478             log_info_hex16("y", setup->sm_local_y);
2479             // PH3B3 - calculate EDIV
2480             setup->sm_local_ediv = setup->sm_local_y ^ setup->sm_local_div;
2481             log_info_hex16("ediv", setup->sm_local_ediv);
2482             // PH3B4 - calculate LTK         - enc
2483             // LTK = d1(ER, DIV, 0))
2484             connection->sm_engine_state = SM_PH3_LTK_GET_ENC;
2485             return;
2486         }
2487         case SM_RESPONDER_PH4_Y_W4_ENC:{
2488             sm_key_t y128;
2489             reverse_128(data, y128);
2490             setup->sm_local_y = big_endian_read_16(y128, 14);
2491             log_info_hex16("y", setup->sm_local_y);
2492 
2493             // PH3B3 - calculate DIV
2494             setup->sm_local_div = setup->sm_local_y ^ setup->sm_local_ediv;
2495             log_info_hex16("ediv", setup->sm_local_ediv);
2496             // PH3B4 - calculate LTK         - enc
2497             // LTK = d1(ER, DIV, 0))
2498             connection->sm_engine_state = SM_RESPONDER_PH4_LTK_GET_ENC;
2499             return;
2500         }
2501         case SM_PH3_LTK_W4_ENC:
2502             reverse_128(data, setup->sm_ltk);
2503             log_info_key("ltk", setup->sm_ltk);
2504             // calc CSRK next
2505             connection->sm_engine_state = SM_PH3_CSRK_GET_ENC;
2506             return;
2507         case SM_PH3_CSRK_W4_ENC:
2508             reverse_128(data, setup->sm_local_csrk);
2509             log_info_key("csrk", setup->sm_local_csrk);
2510             if (setup->sm_key_distribution_send_set){
2511                 connection->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
2512             } else {
2513                 // no keys to send, just continue
2514                 if (connection->sm_role){
2515                     // slave -> receive master keys
2516                     connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2517                 } else {
2518                     // master -> all done
2519                     connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2520                     sm_done_for_handle(connection->sm_handle);
2521                 }
2522             }
2523             return;
2524         case SM_RESPONDER_PH4_LTK_W4_ENC:
2525             reverse_128(data, setup->sm_ltk);
2526             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2527             log_info_key("ltk", setup->sm_ltk);
2528             connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK;
2529             return;
2530         default:
2531             break;
2532     }
2533 }
2534 
2535 #ifdef USE_MBEDTLS_FOR_ECDH
2536 
2537 static void sm_log_ec_keypair(void){
2538     // print keypair
2539     char buffer[100];
2540     size_t len;
2541     mbedtls_mpi_write_string( &le_keypair.d, 16, buffer, sizeof(buffer), &len);
2542     log_info("d: %s", buffer);
2543     mbedtls_mpi_write_string( &le_keypair.Q.X, 16, buffer, sizeof(buffer), &len);
2544     log_info("X: %s", buffer);
2545     mbedtls_mpi_write_string( &le_keypair.Q.Y, 16, buffer, sizeof(buffer), &len);
2546     log_info("Y: %s", buffer);
2547 }
2548 
2549 static int sm_generate_f_rng(void * context, unsigned char * buffer, size_t size){
2550     int offset = setup->sm_passkey_bit;
2551     log_info("sm_generate_f_rng: size %u - offset %u", (int) size, offset);
2552     while (size) {
2553         if (offset < 32){
2554             *buffer++ = setup->sm_peer_qx[offset++];
2555         } else {
2556             *buffer++ = setup->sm_peer_qx[offset++ - 32];
2557         }
2558         size--;
2559     }
2560     setup->sm_passkey_bit = offset;
2561     return 0;
2562 }
2563 #endif
2564 
2565 // note: random generator is ready. this doesn NOT imply that aes engine is unused!
2566 static void sm_handle_random_result(uint8_t * data){
2567 
2568 #ifdef USE_MBEDTLS_FOR_ECDH
2569     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
2570         int num_bytes = setup->sm_passkey_bit;
2571         if (num_bytes < 32){
2572             memcpy(&setup->sm_peer_qx[num_bytes], data, 8);
2573         } else {
2574             memcpy(&setup->sm_peer_qx[num_bytes-32], data, 8);
2575         }
2576         num_bytes += 8;
2577         setup->sm_passkey_bit = num_bytes;
2578 
2579         if (num_bytes >= 64){
2580             // generate EC key
2581             setup->sm_passkey_bit = 0;
2582             mbedtls_ecp_gen_key(MBEDTLS_ECP_DP_SECP256R1, &le_keypair, &sm_generate_f_rng, NULL);
2583             sm_log_ec_keypair();
2584             ec_key_generation_state = EC_KEY_GENERATION_DONE;
2585         }
2586     }
2587 #endif
2588 
2589     switch (rau_state){
2590         case RAU_W4_RANDOM:
2591             // non-resolvable vs. resolvable
2592             switch (gap_random_adress_type){
2593                 case GAP_RANDOM_ADDRESS_RESOLVABLE:
2594                     // resolvable: use random as prand and calc address hash
2595                     // "The two most significant bits of prand shall be equal to ‘0’ and ‘1"
2596                     memcpy(sm_random_address, data, 3);
2597                     sm_random_address[0] &= 0x3f;
2598                     sm_random_address[0] |= 0x40;
2599                     rau_state = RAU_GET_ENC;
2600                     break;
2601                 case GAP_RANDOM_ADDRESS_NON_RESOLVABLE:
2602                 default:
2603                     // "The two most significant bits of the address shall be equal to ‘0’""
2604                     memcpy(sm_random_address, data, 6);
2605                     sm_random_address[0] &= 0x3f;
2606                     rau_state = RAU_SET_ADDRESS;
2607                     break;
2608             }
2609             return;
2610         default:
2611             break;
2612     }
2613 
2614     // retrieve sm_connection provided to sm_random_start
2615     sm_connection_t * connection = (sm_connection_t *) sm_random_context;
2616     if (!connection) return;
2617     switch (connection->sm_engine_state){
2618 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2619         case SM_SC_W4_GET_RANDOM_A:
2620             memcpy(&setup->sm_local_nonce[0], data, 8);
2621             connection->sm_engine_state = SM_SC_W2_GET_RANDOM_B;
2622             break;
2623         case SM_SC_W4_GET_RANDOM_B:
2624             memcpy(&setup->sm_local_nonce[8], data, 8);
2625             // TODO: next state
2626 
2627             // initiator & jw/nc -> send pairing random
2628             if (connection->sm_role == 0 && sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
2629                 connection->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
2630                 break;
2631             }
2632             log_error("SM_SC_W4_GET_RANDOM_B: next state not defined");
2633             break;
2634 #endif
2635 
2636         case SM_PH2_W4_RANDOM_TK:
2637         {
2638             // map random to 0-999999 without speding much cycles on a modulus operation
2639             uint32_t tk = little_endian_read_32(data,0);
2640             tk = tk & 0xfffff;  // 1048575
2641             if (tk >= 999999){
2642                 tk = tk - 999999;
2643             }
2644             sm_reset_tk();
2645             big_endian_store_32(setup->sm_tk, 12, tk);
2646             if (connection->sm_role){
2647                 connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
2648             } else {
2649                 connection->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
2650                 sm_trigger_user_response(connection);
2651                 // response_idle == nothing <--> sm_trigger_user_response() did not require response
2652                 if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
2653                     connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
2654                 }
2655             }
2656             return;
2657         }
2658         case SM_PH2_C1_W4_RANDOM_A:
2659             memcpy(&setup->sm_local_random[0], data, 8); // random endinaness
2660             connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_B;
2661             return;
2662         case SM_PH2_C1_W4_RANDOM_B:
2663             memcpy(&setup->sm_local_random[8], data, 8); // random endinaness
2664             connection->sm_engine_state = SM_PH2_C1_GET_ENC_A;
2665             return;
2666         case SM_PH3_W4_RANDOM:
2667             reverse_64(data, setup->sm_local_rand);
2668             // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
2669             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xf0) + (connection->sm_actual_encryption_key_size - 1);
2670             // no db for authenticated flag hack: store flag in bit 4 of LSB
2671             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xef) + (connection->sm_connection_authenticated << 4);
2672             connection->sm_engine_state = SM_PH3_GET_DIV;
2673             return;
2674         case SM_PH3_W4_DIV:
2675             // use 16 bit from random value as div
2676             setup->sm_local_div = big_endian_read_16(data, 0);
2677             log_info_hex16("div", setup->sm_local_div);
2678             connection->sm_engine_state = SM_PH3_Y_GET_ENC;
2679             return;
2680         default:
2681             break;
2682     }
2683 }
2684 
2685 static void sm_event_packet_handler (uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
2686 
2687     sm_connection_t  * sm_conn;
2688     hci_con_handle_t con_handle;
2689 
2690     switch (packet_type) {
2691 
2692 		case HCI_EVENT_PACKET:
2693 			switch (hci_event_packet_get_type(packet)) {
2694 
2695                 case BTSTACK_EVENT_STATE:
2696 					// bt stack activated, get started
2697 					if (btstack_event_state_get_state(packet) == HCI_STATE_WORKING){
2698                         log_info("HCI Working!");
2699                         dkg_state = sm_persistent_irk_ready ? DKG_CALC_DHK : DKG_CALC_IRK;
2700                         rau_state = RAU_IDLE;
2701 #ifdef USE_MBEDTLS_FOR_ECDH
2702                         if (!test_use_fixed_ec_keypair){
2703                             setup->sm_passkey_bit = 0;
2704                             ec_key_generation_state = EC_KEY_GENERATION_ACTIVE;
2705                         }
2706 #endif
2707                         sm_run();
2708 					}
2709 					break;
2710 
2711                 case HCI_EVENT_LE_META:
2712                     switch (packet[2]) {
2713                         case HCI_SUBEVENT_LE_CONNECTION_COMPLETE:
2714 
2715                             log_info("sm: connected");
2716 
2717                             if (packet[3]) return; // connection failed
2718 
2719                             con_handle = little_endian_read_16(packet, 4);
2720                             sm_conn = sm_get_connection_for_handle(con_handle);
2721                             if (!sm_conn) break;
2722 
2723                             sm_conn->sm_handle = con_handle;
2724                             sm_conn->sm_role = packet[6];
2725                             sm_conn->sm_peer_addr_type = packet[7];
2726                             reverse_bd_addr(&packet[8],
2727                                             sm_conn->sm_peer_address);
2728 
2729                             log_info("New sm_conn, role %s", sm_conn->sm_role ? "slave" : "master");
2730 
2731                             // reset security properties
2732                             sm_conn->sm_connection_encrypted = 0;
2733                             sm_conn->sm_connection_authenticated = 0;
2734                             sm_conn->sm_connection_authorization_state = AUTHORIZATION_UNKNOWN;
2735                             sm_conn->sm_le_db_index = -1;
2736 
2737                             // prepare CSRK lookup (does not involve setup)
2738                             sm_conn->sm_irk_lookup_state = IRK_LOOKUP_W4_READY;
2739 
2740                             // just connected -> everything else happens in sm_run()
2741                             if (sm_conn->sm_role){
2742                                 // slave - state already could be SM_RESPONDER_SEND_SECURITY_REQUEST instead
2743                                 if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
2744                                     if (sm_slave_request_security) {
2745                                         // request security if requested by app
2746                                         sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
2747                                     } else {
2748                                         // otherwise, wait for pairing request
2749                                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
2750                                     }
2751                                 }
2752                                 break;
2753                             } else {
2754                                 // master
2755                                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2756                             }
2757                             break;
2758 
2759                         case HCI_SUBEVENT_LE_LONG_TERM_KEY_REQUEST:
2760                             con_handle = little_endian_read_16(packet, 3);
2761                             sm_conn = sm_get_connection_for_handle(con_handle);
2762                             if (!sm_conn) break;
2763 
2764                             log_info("LTK Request: state %u", sm_conn->sm_engine_state);
2765                             if (sm_conn->sm_engine_state == SM_RESPONDER_PH2_W4_LTK_REQUEST){
2766                                 sm_conn->sm_engine_state = SM_PH2_CALC_STK;
2767                                 break;
2768                             }
2769                             if (sm_conn->sm_engine_state == SM_SC_W4_LTK_REQUEST_SC){
2770                                 sm_conn->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2771                                 break;
2772                             }
2773 
2774                             // assume that we don't have a LTK for ediv == 0 and random == null
2775                             if (little_endian_read_16(packet, 13) == 0 && sm_is_null_random(&packet[5])){
2776                                 log_info("LTK Request: ediv & random are empty");
2777                                 sm_conn->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
2778                                 break;
2779                             }
2780 
2781                             // store rand and ediv
2782                             reverse_64(&packet[5], sm_conn->sm_local_rand);
2783                             sm_conn->sm_local_ediv   = little_endian_read_16(packet, 13);
2784                             sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK;
2785                             break;
2786 
2787                         default:
2788                             break;
2789                     }
2790                     break;
2791 
2792                 case HCI_EVENT_ENCRYPTION_CHANGE:
2793                     con_handle = little_endian_read_16(packet, 3);
2794                     sm_conn = sm_get_connection_for_handle(con_handle);
2795                     if (!sm_conn) break;
2796 
2797                     sm_conn->sm_connection_encrypted = packet[5];
2798                     log_info("Encryption state change: %u, key size %u", sm_conn->sm_connection_encrypted,
2799                         sm_conn->sm_actual_encryption_key_size);
2800                     log_info("event handler, state %u", sm_conn->sm_engine_state);
2801                     if (!sm_conn->sm_connection_encrypted) break;
2802                     // continue if part of initial pairing
2803                     switch (sm_conn->sm_engine_state){
2804                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
2805                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2806                             sm_done_for_handle(sm_conn->sm_handle);
2807                             break;
2808                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
2809                             if (sm_conn->sm_role){
2810                                 // slave
2811                                 sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
2812                             } else {
2813                                 // master
2814                                 if (sm_key_distribution_all_received(sm_conn)){
2815                                     // skip receiving keys as there are none
2816                                     sm_key_distribution_handle_all_received(sm_conn);
2817                                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
2818                                 } else {
2819                                     sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2820                                 }
2821                             }
2822                             break;
2823                         default:
2824                             break;
2825                     }
2826                     break;
2827 
2828                 case HCI_EVENT_ENCRYPTION_KEY_REFRESH_COMPLETE:
2829                     con_handle = little_endian_read_16(packet, 3);
2830                     sm_conn = sm_get_connection_for_handle(con_handle);
2831                     if (!sm_conn) break;
2832 
2833                     log_info("Encryption key refresh complete, key size %u", sm_conn->sm_actual_encryption_key_size);
2834                     log_info("event handler, state %u", sm_conn->sm_engine_state);
2835                     // continue if part of initial pairing
2836                     switch (sm_conn->sm_engine_state){
2837                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
2838                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
2839                             sm_done_for_handle(sm_conn->sm_handle);
2840                             break;
2841                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
2842                             if (sm_conn->sm_role){
2843                                 // slave
2844                                 sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
2845                             } else {
2846                                 // master
2847                                 sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2848                             }
2849                             break;
2850                         default:
2851                             break;
2852                     }
2853                     break;
2854 
2855 
2856                 case HCI_EVENT_DISCONNECTION_COMPLETE:
2857                     con_handle = little_endian_read_16(packet, 3);
2858                     sm_done_for_handle(con_handle);
2859                     sm_conn = sm_get_connection_for_handle(con_handle);
2860                     if (!sm_conn) break;
2861 
2862                     // delete stored bonding on disconnect with authentication failure in ph0
2863                     if (sm_conn->sm_role == 0
2864                         && sm_conn->sm_engine_state == SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED
2865                         && packet[2] == ERROR_CODE_AUTHENTICATION_FAILURE){
2866                         le_device_db_remove(sm_conn->sm_le_db_index);
2867                     }
2868 
2869                     sm_conn->sm_engine_state = SM_GENERAL_IDLE;
2870                     sm_conn->sm_handle = 0;
2871                     break;
2872 
2873 				case HCI_EVENT_COMMAND_COMPLETE:
2874                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_encrypt)){
2875                         sm_handle_encryption_result(&packet[6]);
2876                         break;
2877                     }
2878                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_rand)){
2879                         sm_handle_random_result(&packet[6]);
2880                         break;
2881                     }
2882                     break;
2883                 default:
2884                     break;
2885 			}
2886             break;
2887         default:
2888             break;
2889 	}
2890 
2891     sm_run();
2892 }
2893 
2894 static inline int sm_calc_actual_encryption_key_size(int other){
2895     if (other < sm_min_encryption_key_size) return 0;
2896     if (other < sm_max_encryption_key_size) return other;
2897     return sm_max_encryption_key_size;
2898 }
2899 
2900 
2901 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method){
2902     switch (method){
2903         case JUST_WORKS:
2904         case NK_BOTH_INPUT:
2905             return 1;
2906         default:
2907             return 0;
2908     }
2909 }
2910 
2911 static int sm_passkey_used(stk_generation_method_t method){
2912     switch (method){
2913         case PK_RESP_INPUT:
2914         case PK_INIT_INPUT:
2915         case OK_BOTH_INPUT:
2916             return 1;
2917         default:
2918             return 0;
2919     }
2920 }
2921 
2922 /**
2923  * @return ok
2924  */
2925 static int sm_validate_stk_generation_method(void){
2926     // check if STK generation method is acceptable by client
2927     switch (setup->sm_stk_generation_method){
2928         case JUST_WORKS:
2929             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_JUST_WORKS) != 0;
2930         case PK_RESP_INPUT:
2931         case PK_INIT_INPUT:
2932         case OK_BOTH_INPUT:
2933             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_PASSKEY) != 0;
2934         case OOB:
2935             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_OOB) != 0;
2936         case NK_BOTH_INPUT:
2937             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON) != 0;
2938             return 1;
2939         default:
2940             return 0;
2941     }
2942 }
2943 
2944 static void sm_pdu_handler(uint8_t packet_type, hci_con_handle_t con_handle, uint8_t *packet, uint16_t size){
2945 
2946     if (packet_type == HCI_EVENT_PACKET && packet[0] == L2CAP_EVENT_CAN_SEND_NOW){
2947         sm_run();
2948     }
2949 
2950     if (packet_type != SM_DATA_PACKET) return;
2951 
2952     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
2953     if (!sm_conn) return;
2954 
2955     if (packet[0] == SM_CODE_PAIRING_FAILED){
2956         sm_conn->sm_engine_state = sm_conn->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
2957         return;
2958     }
2959 
2960     log_debug("sm_pdu_handler: state %u, pdu 0x%02x", sm_conn->sm_engine_state, packet[0]);
2961 
2962     int err;
2963 
2964     switch (sm_conn->sm_engine_state){
2965 
2966         // a sm timeout requries a new physical connection
2967         case SM_GENERAL_TIMEOUT:
2968             return;
2969 
2970         // Initiator
2971         case SM_INITIATOR_CONNECTED:
2972             if ((packet[0] != SM_CODE_SECURITY_REQUEST) || (sm_conn->sm_role)){
2973                 sm_pdu_received_in_wrong_state(sm_conn);
2974                 break;
2975             }
2976             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_FAILED){
2977                 sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
2978                 break;
2979             }
2980             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_SUCCEEDED){
2981                 uint16_t ediv;
2982                 le_device_db_encryption_get(sm_conn->sm_le_db_index, &ediv, NULL, NULL, NULL, NULL, NULL);
2983                 if (ediv){
2984                     log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
2985                     sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
2986                 } else {
2987                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
2988                 }
2989                 break;
2990             }
2991             // otherwise, store security request
2992             sm_conn->sm_security_request_received = 1;
2993             break;
2994 
2995         case SM_INITIATOR_PH1_W4_PAIRING_RESPONSE:
2996             if (packet[0] != SM_CODE_PAIRING_RESPONSE){
2997                 sm_pdu_received_in_wrong_state(sm_conn);
2998                 break;
2999             }
3000             // store pairing request
3001             memcpy(&setup->sm_s_pres, packet, sizeof(sm_pairing_packet_t));
3002             err = sm_stk_generation_init(sm_conn);
3003             if (err){
3004                 setup->sm_pairing_failed_reason = err;
3005                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3006                 break;
3007             }
3008 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3009             if (setup->sm_use_secure_connections){
3010                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
3011                 if (setup->sm_stk_generation_method == JUST_WORKS){
3012                     sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3013                     sm_trigger_user_response(sm_conn);
3014                     if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3015                         sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3016                     }
3017                 } else {
3018                     sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3019                 }
3020                 break;
3021             }
3022 #endif
3023             // generate random number first, if we need to show passkey
3024             if (setup->sm_stk_generation_method == PK_RESP_INPUT){
3025                 sm_conn->sm_engine_state = SM_PH2_GET_RANDOM_TK;
3026                 break;
3027             }
3028             sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3029             sm_trigger_user_response(sm_conn);
3030             // response_idle == nothing <--> sm_trigger_user_response() did not require response
3031             if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3032                 sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3033             }
3034             break;
3035 
3036         case SM_INITIATOR_PH2_W4_PAIRING_CONFIRM:
3037             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3038                 sm_pdu_received_in_wrong_state(sm_conn);
3039                 break;
3040             }
3041 
3042             // store s_confirm
3043             reverse_128(&packet[1], setup->sm_peer_confirm);
3044             sm_conn->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
3045             break;
3046 
3047         case SM_INITIATOR_PH2_W4_PAIRING_RANDOM:
3048             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3049                 sm_pdu_received_in_wrong_state(sm_conn);
3050                 break;;
3051             }
3052 
3053             // received random value
3054             reverse_128(&packet[1], setup->sm_peer_random);
3055             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3056             break;
3057 
3058         // Responder
3059         case SM_RESPONDER_IDLE:
3060         case SM_RESPONDER_SEND_SECURITY_REQUEST:
3061         case SM_RESPONDER_PH1_W4_PAIRING_REQUEST:
3062             if (packet[0] != SM_CODE_PAIRING_REQUEST){
3063                 sm_pdu_received_in_wrong_state(sm_conn);
3064                 break;;
3065             }
3066 
3067             // store pairing request
3068             memcpy(&sm_conn->sm_m_preq, packet, sizeof(sm_pairing_packet_t));
3069             sm_conn->sm_engine_state = SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED;
3070             break;
3071 
3072 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3073         case SM_SC_W4_PUBLIC_KEY_COMMAND:
3074             if (packet[0] != SM_CODE_PAIRING_PUBLIC_KEY){
3075                 sm_pdu_received_in_wrong_state(sm_conn);
3076                 break;
3077             }
3078 
3079             // store public key for DH Key calculation
3080             reverse_256(&packet[01], setup->sm_peer_qx);
3081             reverse_256(&packet[33], setup->sm_peer_qy);
3082 
3083 #ifdef USE_MBEDTLS_FOR_ECDH
3084             // validate public key
3085             mbedtls_ecp_group grp;
3086             mbedtls_ecp_group_init( &grp );
3087             mbedtls_ecp_group_load(&grp, MBEDTLS_ECP_DP_SECP256R1);
3088 
3089             mbedtls_ecp_point Q;
3090             mbedtls_ecp_point_init( &Q );
3091             mbedtls_mpi_read_binary(&Q.X, setup->sm_peer_qx, 32);
3092             mbedtls_mpi_read_binary(&Q.Y, setup->sm_peer_qy, 32);
3093             mbedtls_mpi_read_string(&Q.Z, 16, "1" );
3094             err = mbedtls_ecp_check_pubkey(&grp, &Q);
3095             if (err){
3096                 log_error("sm: peer public key invalid %x", err);
3097                 // uses "unspecified reason", there is no "public key invalid" error code
3098                 sm_pdu_received_in_wrong_state(sm_conn);
3099                 break;
3100             }
3101 #endif
3102             if (sm_conn->sm_role){
3103                 // responder
3104                 sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3105             } else {
3106                 // initiator
3107                 // stk generation method
3108                 // passkey entry: notify app to show passkey or to request passkey
3109                 switch (setup->sm_stk_generation_method){
3110                     case JUST_WORKS:
3111                     case NK_BOTH_INPUT:
3112                         sm_conn->sm_engine_state = SM_SC_W4_CONFIRMATION;
3113                         break;
3114                     case PK_INIT_INPUT:
3115                     case PK_RESP_INPUT:
3116                     case OK_BOTH_INPUT:
3117                         sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
3118                         break;
3119                     case OOB:
3120                         // TODO: implement SC OOB
3121                         break;
3122                 }
3123             }
3124             break;
3125 
3126         case SM_SC_W4_CONFIRMATION:
3127             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3128                 sm_pdu_received_in_wrong_state(sm_conn);
3129                 break;
3130             }
3131             // received confirm value
3132             reverse_128(&packet[1], setup->sm_peer_confirm);
3133 
3134             if (sm_conn->sm_role){
3135                 // responder
3136                 sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
3137             } else {
3138                 // initiator
3139                 if (sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
3140                     sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
3141                 } else {
3142                     sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
3143                 }
3144             }
3145             break;
3146 
3147         case SM_SC_W4_PAIRING_RANDOM:
3148             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3149                 sm_pdu_received_in_wrong_state(sm_conn);
3150                 break;
3151             }
3152 
3153             // received random value
3154             reverse_128(&packet[1], setup->sm_peer_nonce);
3155 
3156             // validate confirm value if Cb = f4(Pkb, Pka, Nb, z)
3157             // only check for JUST WORK/NC in initiator role AND passkey entry
3158             int passkey_entry = sm_passkey_used(setup->sm_stk_generation_method);
3159             if (sm_conn->sm_role || passkey_entry) {
3160                  sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION;
3161             }
3162 
3163             sm_sc_state_after_receiving_random(sm_conn);
3164             break;
3165 
3166         case SM_SC_W2_CALCULATE_G2:
3167         case SM_SC_W4_CALCULATE_G2:
3168         case SM_SC_W2_CALCULATE_F5_SALT:
3169         case SM_SC_W4_CALCULATE_F5_SALT:
3170         case SM_SC_W2_CALCULATE_F5_MACKEY:
3171         case SM_SC_W4_CALCULATE_F5_MACKEY:
3172         case SM_SC_W2_CALCULATE_F5_LTK:
3173         case SM_SC_W4_CALCULATE_F5_LTK:
3174         case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
3175         case SM_SC_W4_DHKEY_CHECK_COMMAND:
3176         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
3177             if (packet[0] != SM_CODE_PAIRING_DHKEY_CHECK){
3178                 sm_pdu_received_in_wrong_state(sm_conn);
3179                 break;
3180             }
3181             // store DHKey Check
3182             setup->sm_state_vars |= SM_STATE_VAR_DHKEY_COMMAND_RECEIVED;
3183             reverse_128(&packet[01], setup->sm_peer_dhkey_check);
3184 
3185             // have we been only waiting for dhkey check command?
3186             if (sm_conn->sm_engine_state == SM_SC_W4_DHKEY_CHECK_COMMAND){
3187                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
3188             }
3189             break;
3190 #endif
3191 
3192         case SM_RESPONDER_PH1_W4_PAIRING_CONFIRM:
3193             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3194                 sm_pdu_received_in_wrong_state(sm_conn);
3195                 break;
3196             }
3197 
3198             // received confirm value
3199             reverse_128(&packet[1], setup->sm_peer_confirm);
3200 
3201             // notify client to hide shown passkey
3202             if (setup->sm_stk_generation_method == PK_INIT_INPUT){
3203                 sm_notify_client_base(SM_EVENT_PASSKEY_DISPLAY_CANCEL, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
3204             }
3205 
3206             // handle user cancel pairing?
3207             if (setup->sm_user_response == SM_USER_RESPONSE_DECLINE){
3208                 setup->sm_pairing_failed_reason = SM_REASON_PASSKEYT_ENTRY_FAILED;
3209                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3210                 break;
3211             }
3212 
3213             // wait for user action?
3214             if (setup->sm_user_response == SM_USER_RESPONSE_PENDING){
3215                 sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3216                 break;
3217             }
3218 
3219             // calculate and send local_confirm
3220             sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3221             break;
3222 
3223         case SM_RESPONDER_PH2_W4_PAIRING_RANDOM:
3224             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3225                 sm_pdu_received_in_wrong_state(sm_conn);
3226                 break;;
3227             }
3228 
3229             // received random value
3230             reverse_128(&packet[1], setup->sm_peer_random);
3231             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3232             break;
3233 
3234         case SM_PH3_RECEIVE_KEYS:
3235             switch(packet[0]){
3236                 case SM_CODE_ENCRYPTION_INFORMATION:
3237                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
3238                     reverse_128(&packet[1], setup->sm_peer_ltk);
3239                     break;
3240 
3241                 case SM_CODE_MASTER_IDENTIFICATION:
3242                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
3243                     setup->sm_peer_ediv = little_endian_read_16(packet, 1);
3244                     reverse_64(&packet[3], setup->sm_peer_rand);
3245                     break;
3246 
3247                 case SM_CODE_IDENTITY_INFORMATION:
3248                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
3249                     reverse_128(&packet[1], setup->sm_peer_irk);
3250                     break;
3251 
3252                 case SM_CODE_IDENTITY_ADDRESS_INFORMATION:
3253                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
3254                     setup->sm_peer_addr_type = packet[1];
3255                     reverse_bd_addr(&packet[2], setup->sm_peer_address);
3256                     break;
3257 
3258                 case SM_CODE_SIGNING_INFORMATION:
3259                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
3260                     reverse_128(&packet[1], setup->sm_peer_csrk);
3261                     break;
3262                 default:
3263                     // Unexpected PDU
3264                     log_info("Unexpected PDU %u in SM_PH3_RECEIVE_KEYS", packet[0]);
3265                     break;
3266             }
3267             // done with key distribution?
3268             if (sm_key_distribution_all_received(sm_conn)){
3269 
3270                 sm_key_distribution_handle_all_received(sm_conn);
3271 
3272                 if (sm_conn->sm_role){
3273                     sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
3274                     sm_done_for_handle(sm_conn->sm_handle);
3275                 } else {
3276                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3277 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3278                     if (setup->sm_use_secure_connections){
3279                         sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
3280                     }
3281 #endif
3282                 }
3283             }
3284             break;
3285         default:
3286             // Unexpected PDU
3287             log_info("Unexpected PDU %u in state %u", packet[0], sm_conn->sm_engine_state);
3288             break;
3289     }
3290 
3291     // try to send preparared packet
3292     sm_run();
3293 }
3294 
3295 // Security Manager Client API
3296 void sm_register_oob_data_callback( int (*get_oob_data_callback)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data)){
3297     sm_get_oob_data = get_oob_data_callback;
3298 }
3299 
3300 void sm_add_event_handler(btstack_packet_callback_registration_t * callback_handler){
3301     btstack_linked_list_add_tail(&sm_event_handlers, (btstack_linked_item_t*) callback_handler);
3302 }
3303 
3304 void sm_set_accepted_stk_generation_methods(uint8_t accepted_stk_generation_methods){
3305     sm_accepted_stk_generation_methods = accepted_stk_generation_methods;
3306 }
3307 
3308 void sm_set_encryption_key_size_range(uint8_t min_size, uint8_t max_size){
3309 	sm_min_encryption_key_size = min_size;
3310 	sm_max_encryption_key_size = max_size;
3311 }
3312 
3313 void sm_set_authentication_requirements(uint8_t auth_req){
3314     sm_auth_req = auth_req;
3315 }
3316 
3317 void sm_set_io_capabilities(io_capability_t io_capability){
3318     sm_io_capabilities = io_capability;
3319 }
3320 
3321 void sm_set_request_security(int enable){
3322     sm_slave_request_security = enable;
3323 }
3324 
3325 void sm_set_er(sm_key_t er){
3326     memcpy(sm_persistent_er, er, 16);
3327 }
3328 
3329 void sm_set_ir(sm_key_t ir){
3330     memcpy(sm_persistent_ir, ir, 16);
3331 }
3332 
3333 // Testing support only
3334 void sm_test_set_irk(sm_key_t irk){
3335     memcpy(sm_persistent_irk, irk, 16);
3336     sm_persistent_irk_ready = 1;
3337 }
3338 
3339 void sm_test_use_fixed_local_csrk(void){
3340     test_use_fixed_local_csrk = 1;
3341 }
3342 
3343 void sm_init(void){
3344     // set some (BTstack default) ER and IR
3345     int i;
3346     sm_key_t er;
3347     sm_key_t ir;
3348     for (i=0;i<16;i++){
3349         er[i] = 0x30 + i;
3350         ir[i] = 0x90 + i;
3351     }
3352     sm_set_er(er);
3353     sm_set_ir(ir);
3354     // defaults
3355     sm_accepted_stk_generation_methods = SM_STK_GENERATION_METHOD_JUST_WORKS
3356                                        | SM_STK_GENERATION_METHOD_OOB
3357                                        | SM_STK_GENERATION_METHOD_PASSKEY
3358                                        | SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON;
3359 
3360     sm_max_encryption_key_size = 16;
3361     sm_min_encryption_key_size = 7;
3362 
3363     sm_cmac_state  = CMAC_IDLE;
3364     dkg_state = DKG_W4_WORKING;
3365     rau_state = RAU_W4_WORKING;
3366     sm_aes128_state = SM_AES128_IDLE;
3367     sm_address_resolution_test = -1;    // no private address to resolve yet
3368     sm_address_resolution_ah_calculation_active = 0;
3369     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
3370     sm_address_resolution_general_queue = NULL;
3371 
3372     gap_random_adress_update_period = 15 * 60 * 1000L;
3373 
3374     sm_active_connection = 0;
3375 
3376     test_use_fixed_local_csrk = 0;
3377 
3378     // register for HCI Events from HCI
3379     hci_event_callback_registration.callback = &sm_event_packet_handler;
3380     hci_add_event_handler(&hci_event_callback_registration);
3381 
3382     // and L2CAP PDUs + L2CAP_EVENT_CAN_SEND_NOW
3383     l2cap_register_fixed_channel(sm_pdu_handler, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
3384 
3385 #ifdef USE_MBEDTLS_FOR_ECDH
3386     ec_key_generation_state = EC_KEY_GENERATION_IDLE;
3387 #endif
3388 }
3389 
3390 void sm_test_use_fixed_ec_keypair(void){
3391     test_use_fixed_ec_keypair = 1;
3392 #ifdef USE_MBEDTLS_FOR_ECDH
3393     // use test keypair from spec
3394     mbedtls_ecp_keypair_init(&le_keypair);
3395     mbedtls_ecp_group_load(&le_keypair.grp, MBEDTLS_ECP_DP_SECP256R1);
3396     mbedtls_mpi_read_string( &le_keypair.d,   16, "3f49f6d4a3c55f3874c9b3e3d2103f504aff607beb40b7995899b8a6cd3c1abd");
3397     mbedtls_mpi_read_string( &le_keypair.Q.X, 16, "20b003d2f297be2c5e2c83a7e9f9a5b9eff49111acf4fddbcc0301480e359de6");
3398     mbedtls_mpi_read_string( &le_keypair.Q.Y, 16, "dc809c49652aeb6d63329abf5a52155c766345c28fed3024741c8ed01589d28b");
3399     mbedtls_mpi_read_string( &le_keypair.Q.Z, 16, "1");
3400 #endif
3401 }
3402 
3403 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle){
3404     hci_connection_t * hci_con = hci_connection_for_handle(con_handle);
3405     if (!hci_con) return NULL;
3406     return &hci_con->sm_connection;
3407 }
3408 
3409 // @returns 0 if not encrypted, 7-16 otherwise
3410 int sm_encryption_key_size(hci_con_handle_t con_handle){
3411     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3412     if (!sm_conn) return 0;     // wrong connection
3413     if (!sm_conn->sm_connection_encrypted) return 0;
3414     return sm_conn->sm_actual_encryption_key_size;
3415 }
3416 
3417 int sm_authenticated(hci_con_handle_t con_handle){
3418     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3419     if (!sm_conn) return 0;     // wrong connection
3420     if (!sm_conn->sm_connection_encrypted) return 0; // unencrypted connection cannot be authenticated
3421     return sm_conn->sm_connection_authenticated;
3422 }
3423 
3424 authorization_state_t sm_authorization_state(hci_con_handle_t con_handle){
3425     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3426     if (!sm_conn) return AUTHORIZATION_UNKNOWN;     // wrong connection
3427     if (!sm_conn->sm_connection_encrypted)               return AUTHORIZATION_UNKNOWN; // unencrypted connection cannot be authorized
3428     if (!sm_conn->sm_connection_authenticated)           return AUTHORIZATION_UNKNOWN; // unauthenticatd connection cannot be authorized
3429     return sm_conn->sm_connection_authorization_state;
3430 }
3431 
3432 static void sm_send_security_request_for_connection(sm_connection_t * sm_conn){
3433     switch (sm_conn->sm_engine_state){
3434         case SM_GENERAL_IDLE:
3435         case SM_RESPONDER_IDLE:
3436             sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
3437             sm_run();
3438             break;
3439         default:
3440             break;
3441     }
3442 }
3443 
3444 /**
3445  * @brief Trigger Security Request
3446  */
3447 void sm_send_security_request(hci_con_handle_t con_handle){
3448     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3449     if (!sm_conn) return;
3450     sm_send_security_request_for_connection(sm_conn);
3451 }
3452 
3453 // request pairing
3454 void sm_request_pairing(hci_con_handle_t con_handle){
3455     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3456     if (!sm_conn) return;     // wrong connection
3457 
3458     log_info("sm_request_pairing in role %u, state %u", sm_conn->sm_role, sm_conn->sm_engine_state);
3459     if (sm_conn->sm_role){
3460         sm_send_security_request_for_connection(sm_conn);
3461     } else {
3462         // used as a trigger to start central/master/initiator security procedures
3463         uint16_t ediv;
3464         if (sm_conn->sm_engine_state == SM_INITIATOR_CONNECTED){
3465             switch (sm_conn->sm_irk_lookup_state){
3466                 case IRK_LOOKUP_FAILED:
3467                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3468                     break;
3469                 case IRK_LOOKUP_SUCCEEDED:
3470                         le_device_db_encryption_get(sm_conn->sm_le_db_index, &ediv, NULL, NULL, NULL, NULL, NULL);
3471                         if (ediv){
3472                             log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3473                             sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3474                         } else {
3475                             sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3476                         }
3477                         break;
3478                 default:
3479                     sm_conn->sm_bonding_requested = 1;
3480                     break;
3481             }
3482         } else if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
3483             sm_conn->sm_bonding_requested = 1;
3484         }
3485     }
3486     sm_run();
3487 }
3488 
3489 // called by client app on authorization request
3490 void sm_authorization_decline(hci_con_handle_t con_handle){
3491     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3492     if (!sm_conn) return;     // wrong connection
3493     sm_conn->sm_connection_authorization_state = AUTHORIZATION_DECLINED;
3494     sm_notify_client_authorization(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 0);
3495 }
3496 
3497 void sm_authorization_grant(hci_con_handle_t con_handle){
3498     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3499     if (!sm_conn) return;     // wrong connection
3500     sm_conn->sm_connection_authorization_state = AUTHORIZATION_GRANTED;
3501     sm_notify_client_authorization(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 1);
3502 }
3503 
3504 // GAP Bonding API
3505 
3506 void sm_bonding_decline(hci_con_handle_t con_handle){
3507     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3508     if (!sm_conn) return;     // wrong connection
3509     setup->sm_user_response = SM_USER_RESPONSE_DECLINE;
3510 
3511     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3512         switch (setup->sm_stk_generation_method){
3513             case PK_RESP_INPUT:
3514             case PK_INIT_INPUT:
3515             case OK_BOTH_INPUT:
3516                 sm_pairing_error(sm_conn, SM_GENERAL_SEND_PAIRING_FAILED);
3517                 break;
3518             case NK_BOTH_INPUT:
3519                 sm_pairing_error(sm_conn, SM_REASON_NUMERIC_COMPARISON_FAILED);
3520                 break;
3521             case JUST_WORKS:
3522             case OOB:
3523                 sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
3524                 break;
3525         }
3526     }
3527     sm_run();
3528 }
3529 
3530 void sm_just_works_confirm(hci_con_handle_t con_handle){
3531     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3532     if (!sm_conn) return;     // wrong connection
3533     setup->sm_user_response = SM_USER_RESPONSE_CONFIRM;
3534     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3535         sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3536 
3537 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3538         if (setup->sm_use_secure_connections){
3539             sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3540         }
3541 #endif
3542     }
3543 
3544 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3545     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
3546         sm_sc_prepare_dhkey_check(sm_conn);
3547     }
3548 #endif
3549 
3550     sm_run();
3551 }
3552 
3553 void sm_numeric_comparison_confirm(hci_con_handle_t con_handle){
3554     // for now, it's the same
3555     sm_just_works_confirm(con_handle);
3556 }
3557 
3558 void sm_passkey_input(hci_con_handle_t con_handle, uint32_t passkey){
3559     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3560     if (!sm_conn) return;     // wrong connection
3561     sm_reset_tk();
3562     big_endian_store_32(setup->sm_tk, 12, passkey);
3563     setup->sm_user_response = SM_USER_RESPONSE_PASSKEY;
3564     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
3565         sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3566     }
3567 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3568     // if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
3569     //     sm_sc_prepare_dhkey_check(sm_conn);
3570     // }
3571 #endif
3572     sm_run();
3573 }
3574 
3575 /**
3576  * @brief Identify device in LE Device DB
3577  * @param handle
3578  * @returns index from le_device_db or -1 if not found/identified
3579  */
3580 int sm_le_device_index(hci_con_handle_t con_handle ){
3581     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3582     if (!sm_conn) return -1;
3583     return sm_conn->sm_le_db_index;
3584 }
3585 
3586 // GAP LE API
3587 void gap_random_address_set_mode(gap_random_address_type_t random_address_type){
3588     gap_random_address_update_stop();
3589     gap_random_adress_type = random_address_type;
3590     if (random_address_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return;
3591     gap_random_address_update_start();
3592     gap_random_address_trigger();
3593 }
3594 
3595 gap_random_address_type_t gap_random_address_get_mode(void){
3596     return gap_random_adress_type;
3597 }
3598 
3599 void gap_random_address_set_update_period(int period_ms){
3600     gap_random_adress_update_period = period_ms;
3601     if (gap_random_adress_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return;
3602     gap_random_address_update_stop();
3603     gap_random_address_update_start();
3604 }
3605 
3606 void gap_random_address_set(bd_addr_t addr){
3607     gap_random_address_set_mode(GAP_RANDOM_ADDRESS_TYPE_OFF);
3608     memcpy(sm_random_address, addr, 6);
3609     rau_state = RAU_SET_ADDRESS;
3610     sm_run();
3611 }
3612 
3613 /*
3614  * @brief Set Advertisement Paramters
3615  * @param adv_int_min
3616  * @param adv_int_max
3617  * @param adv_type
3618  * @param direct_address_type
3619  * @param direct_address
3620  * @param channel_map
3621  * @param filter_policy
3622  *
3623  * @note own_address_type is used from gap_random_address_set_mode
3624  */
3625 void gap_advertisements_set_params(uint16_t adv_int_min, uint16_t adv_int_max, uint8_t adv_type,
3626     uint8_t direct_address_typ, bd_addr_t direct_address, uint8_t channel_map, uint8_t filter_policy){
3627     hci_le_advertisements_set_params(adv_int_min, adv_int_max, adv_type, gap_random_adress_type,
3628         direct_address_typ, direct_address, channel_map, filter_policy);
3629 }
3630 
3631