michaelh/zephyr
1
0
Fork 0
Code Releases Activity

Bluetooth: SMP_BR: Avoid to derive LTK from invalid BR LK

Browse source 
The LTK should not be generated from BR link key if there is a LTK
exists and BR LK is weaker.

Do not drive LTK from BR LK in the case.

Signed-off-by: Lyle Zhu <lyle.zhu@nxp.com>
This commit is contained in:
Lyle Zhu 2025-03-09 14:07:25 +08:00 • committed by Benjamin Cabé
commit af86a35b61
1 changed files with 33 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

36
subsys/bluetooth/host/smp.c
View file

@ -1133,12 +1133,42 @@ static void smp_br_distribute_keys(struct bt_smp_br *smp)
static bool smp_br_pairing_allowed(struct bt_smp_br *smp)
{
if (smp->chan.chan.conn->encrypt == 0x02) {
bt_addr_le_t addr;
struct bt_conn *conn;
struct bt_keys_link_key *key;
bool le_bonded;
if (!smp->chan.chan.conn) {
return false;
}
conn = smp->chan.chan.conn;
addr.type = BT_ADDR_LE_PUBLIC;
bt_addr_copy(&addr.a, &conn->br.dst);
le_bonded = bt_le_bond_exists(BT_ID_DEFAULT, &addr);
key = bt_keys_find_link_key(&conn->br.dst);
if (!key) {
return false;
}
/**
* Core v6.0, Vol 3, Part C, 14.1 Cross-transport key derivation
*
* If an LE LTK already exists and the BR/EDR link key is weaker in either strength
* or MITM protection, then neither device shall generate an LE LTK using cross-transport
* key derivation from a BR/EDR link key.
*/
if (le_bonded && !(key->flags & BT_LINK_KEY_AUTHENTICATED)) {
return false;
}
if (conn->encrypt == 0x02) {
return true;
}
if (IS_ENABLED(CONFIG_BT_SMP_FORCE_BREDR) &&
smp->chan.chan.conn->encrypt == 0x01) {
if (IS_ENABLED(CONFIG_BT_SMP_FORCE_BREDR) && conn->encrypt == 0x01) {
LOG_WRN("Allowing BR/EDR SMP with P-192 key");
return true;
}