BLE privacy, signing, persistent security database #6932

paul-szczepanek-arm · 2018-05-16T15:23:36Z

Description

This branch adds several feature to the security manager and updates features in other layers connected to it:

Support of lesc pairing
Support of Gap privacy
Support GATT signing
Support of GATT permissions
Database persistence

Implementations of these features targets the various Nordic boards and the cordio stack.

LE Secure Connection pairing

LE Secure Connection pairing is a new pairing method that has been introduced with Bluetooth 4.2. It uses Elyptic Curve Cryptography and offer better protection against eavesdropping.

Pull Requests:

OOB: 1, 2, 3
Nordic implementation: 1, 2
Cordio Implementation: 1

Gap Privacy

This feature allows a device to sends advertisements packets, scan requests and connections requests with a private address. The goal being to avoid devices tracking. A known peer (bonded) can retrieve the identity of a the by resolving its private address.

Pull Requests:

Interfaces: 1
Nordic implementation: 1 2
Cordio: 1, 2
Backwards compatibility: 1

Gatt Signing and permission

This feature allows the authentication of a known peer sending a write command on an unencrypted link.
To support this feature, the GATT server had to support proper security requirements per attributes.

Pull Requests:

SecurityManager: 1
GenericGattClient: 1
Nordic: 1 Note that these are stub as this feature is not supported by Nordic softdevices.
Cordio: 1
GattServer: 1

DataBase persistence

This addition allow a user to specify a path to a file that will store the secure database.

Pull Requests: 1 2

Documentation

Handbook (not part of this PR) pull request: 1

Pull request type

[ ] Fix
[ ] Refactor
[ ] New target
[x] Feature
[ ] Breaking change

(github client fail)

into signing

signing integration between gatt and sm

This change allow vendor pal code to use its own array format.

With this change, it is possible to encode the size of the array viewed by an ArrayView into the type itself: ArrayView<T, Size>. Such objects are lighter than ArrayView of arbitrary size and allows verification of the size at compile time. This change also fix operator== and bring new make_ArrayView overloads.

- Rename LescCrypto into CryptoToolbox - Use ArrayView of fixed size as parameters - Add licence

…anek-arm/mbed-os into sc-nordic

LE Secure Connections Nordic

cmonr · 2018-05-22T19:13:57Z

@paul-szczepanek-arm Please rebase instead of merging mbed-os into the PR.

Merging mbed-os blows up the change set and file changes.

paul-szczepanek-arm · 2018-05-23T09:02:54Z

merged with permission because rebase is problematic

Fix privacy backward compatibility

filtering out individual reports instead of all

adbridge · 2018-05-23T14:54:03Z

/morph build

mbed-ci · 2018-05-23T16:13:07Z

Build : FAILURE

Build number : 2128
Build artifacts/logs : http://mbed-os.s3-website-eu-west-1.amazonaws.com/?prefix=builds/6932/

cmonr · 2018-05-23T16:16:15Z

@paul-szczepanek-arm Head up ^^^

The function that gets the address doesn't work when privacy is enabled; report own address as private resolvable.

BLE: Fix wrong macro name for IAR

Fix privacy nrf52

cmonr · 2018-05-23T17:30:59Z

Arm License checkout issues with pr-head. Assuming the rebuild is good, will start CI.

cmonr · 2018-05-23T20:34:18Z

/morph build

pan-

Every ble tests passes on all targets with this change set; its all green for me.

donatieng · 2018-05-23T21:52:37Z

I can confirm IAR compilation issues have been fixed, validated locally.

mbed-ci · 2018-05-23T22:19:29Z

Build : SUCCESS

Build number : 2132
Build artifacts/logs : http://mbed-os.s3-website-eu-west-1.amazonaws.com/?prefix=builds/6932/

Triggering tests

/morph test
/morph uvisor-test
/morph export-build
/morph mbed2-build

mbed-ci · 2018-05-24T04:53:27Z

Exporter Build : SUCCESS

Build number : 1756
Build artifacts/logs : http://mbed-os.s3-website-eu-west-1.amazonaws.com/?prefix=builds/exporter/6932/

mbed-ci · 2018-05-24T06:06:03Z

Test : SUCCESS

Build number : 1926
Test logs :http://mbed-os-logs.s3-website-us-west-1.amazonaws.com/?prefix=logs/6932/1926

paul-szczepanek-arm and others added 30 commits April 3, 2018 15:41

set peer csrk on pal

5ae9cc3

invalid mic event

8d966db

signing only for the slave, unless keys requested to be sent by master

511135f

let the stack know whether csrk is authenticated

780d8a4

count failures, trigger reparing when verification fails

9283413

fixed naming for sig failure count

f5fee68

only bother reacting to verification failures if we want to use signing

e276478

style fix

dfdfcfb

style fix

15c06ac

missing line from commit

c1e2e07

(github client fail)

typos, style and other review fixes

cbf80e9

Merge branch 'signing' of https://github.com/paul-szczepanek-arm/mbed-os

08c9ac5

into signing

Merge pull request #26 from paul-szczepanek-arm/signing

0833827

signing integration between gatt and sm

BLE: use ArrayView to pass and get parameters in Crypto API

7bf0eb0

This change allow vendor pal code to use its own array format.

BLE: Export byte_array_t size exploitable at compile time.

bf41bb3

BLE: provide non const overload of byte_array_t::data member function.

d8f3d9c

BLE: Fix byte_array_t subscript operator

9e1f0b3

BLE: Add conversion function from byte_array_t to ArrayView.

cd39406

BLE: CryptoToolbox enhancement

59a301a

- Rename LescCrypto into CryptoToolbox - Use ArrayView of fixed size as parameters - Add licence

BLE: Add documentation to CryptoToolbox.

04ab07f

BLE: remove trace in Nordic PAL security manager

17b3e26

sign counter added

539a11e

completely redundant

2e1c5fc

set cordio csrk and counter

acfc5b2

BLE: replace byte_array_t::buffer with byte_array_t::data

dcff810

redundant funcs removed

1d74dfa

monitor for signing events and set local counter

57149b6

Merge branch 'security-manager-dev' of https://github.com/paul-szczep…

f53a0e4

…anek-arm/mbed-os into sc-nordic

Merge pull request #27 from pan-/sc-nordic

fc27369

LE Secure Connections Nordic

paul-szczepanek-arm force-pushed the security-manager-dev branch from acee983 to 69a0c10 Compare May 23, 2018 08:11

Merge https://github.com/ARMmbed/mbed-os into security-manager-dev

80137be

paul-szczepanek-arm added 2 commits May 23, 2018 14:20

Merge pull request #49 from pan-/fix-privacy-backward-compatibility

f4b7f32

Fix privacy backward compatibility

Fix not processing all advertising reports if one is filtered out

de41355

filtering out individual reports instead of all

adbridge added needs: CI and removed do not merge needs: review labels May 23, 2018

BLE: Fix wrong macro name for IAR

1ba5a11

pan- and others added 5 commits May 23, 2018 17:27

BLE NRF52: Fix identity address flag in connection request.

30dac7c

BLE NRF52: Report correct own address type for connection

ef20891

The function that gets the address doesn't work when privacy is enabled; report own address as private resolvable.

BLE NRF52: Fix advertising filtering when no bonds are present.

db4d14c

Merge pull request #51 from pan-/fix-iar-compilation

fa9ab03

BLE: Fix wrong macro name for IAR

Merge pull request #52 from pan-/fix-privacy-nrf52

f08ac2e

Fix privacy nrf52

pan- approved these changes May 23, 2018

View reviewed changes

0xc0170 added ready for merge and removed needs: CI labels May 24, 2018

pan- mentioned this pull request May 24, 2018

Nordic BLE: Allow configuration of softdevice parameters #6860

Merged

cmonr merged commit 791620c into ARMmbed:master May 24, 2018

cmonr removed the ready for merge label May 24, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

BLE privacy, signing, persistent security database #6932

BLE privacy, signing, persistent security database #6932

Uh oh!

paul-szczepanek-arm commented May 16, 2018 •

edited

Loading

Uh oh!

cmonr commented May 22, 2018

Uh oh!

paul-szczepanek-arm commented May 23, 2018

Uh oh!

adbridge commented May 23, 2018

Uh oh!

mbed-ci commented May 23, 2018

Uh oh!

cmonr commented May 23, 2018

Uh oh!

cmonr commented May 23, 2018

Uh oh!

cmonr commented May 23, 2018

Uh oh!

pan- left a comment

Uh oh!

donatieng commented May 23, 2018

Uh oh!

mbed-ci commented May 23, 2018

Uh oh!

mbed-ci commented May 24, 2018

Uh oh!

mbed-ci commented May 24, 2018

Uh oh!

Uh oh!

BLE privacy, signing, persistent security database #6932

BLE privacy, signing, persistent security database #6932

Uh oh!

Conversation

paul-szczepanek-arm commented May 16, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

LE Secure Connection pairing

Gap Privacy

Gatt Signing and permission

DataBase persistence

Documentation

Pull request type

Uh oh!

cmonr commented May 22, 2018

Uh oh!

paul-szczepanek-arm commented May 23, 2018

Uh oh!

adbridge commented May 23, 2018

Uh oh!

mbed-ci commented May 23, 2018

Build : FAILURE

Uh oh!

cmonr commented May 23, 2018

Uh oh!

cmonr commented May 23, 2018

Uh oh!

cmonr commented May 23, 2018

Uh oh!

pan- left a comment

Choose a reason for hiding this comment

Uh oh!

donatieng commented May 23, 2018

Uh oh!

mbed-ci commented May 23, 2018

Build : SUCCESS

Triggering tests

Uh oh!

mbed-ci commented May 24, 2018

Exporter Build : SUCCESS

Uh oh!

mbed-ci commented May 24, 2018

Test : SUCCESS

Uh oh!

Uh oh!

paul-szczepanek-arm commented May 16, 2018 •

edited

Loading