xref: /btstack/src/ble/sm.c (revision 3e3fbf3df68dce1ab27af5efcdf0ea980eb93f6c)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define __BTSTACK_FILE__ "sm.c"
39 
40 #include <stdio.h>
41 #include <string.h>
42 #include <inttypes.h>
43 
44 #include "ble/le_device_db.h"
45 #include "ble/core.h"
46 #include "ble/sm.h"
47 #include "bluetooth_company_id.h"
48 #include "btstack_debug.h"
49 #include "btstack_event.h"
50 #include "btstack_linked_list.h"
51 #include "btstack_memory.h"
52 #include "gap.h"
53 #include "hci.h"
54 #include "hci_dump.h"
55 #include "l2cap.h"
56 
57 #if !defined(ENABLE_LE_PERIPHERAL) && !defined(ENABLE_LE_CENTRAL)
58 #error "LE Security Manager used, but neither ENABLE_LE_PERIPHERAL nor ENABLE_LE_CENTRAL defined. Please add at least one to btstack_config.h."
59 #endif
60 
61 #if defined(ENABLE_LE_PERIPHERAL) && defined(ENABLE_LE_CENTRAL)
62 #define IS_RESPONDER(role) (role)
63 #else
64 #ifdef ENABLE_LE_CENTRAL
65 // only central - never responder (avoid 'unused variable' warnings)
66 #define IS_RESPONDER(role) (0 && role)
67 #else
68 // only peripheral - always responder (avoid 'unused variable' warnings)
69 #define IS_RESPONDER(role) (1 || role)
70 #endif
71 #endif
72 
73 #ifdef ENABLE_LE_SECURE_CONNECTIONS
74 // assert SM Public Key can be sent/received
75 #if HCI_ACL_PAYLOAD_SIZE < 69
76 #error "HCI_ACL_PAYLOAD_SIZE must be at least 69 bytes when using LE Secure Conection. Please increase HCI_ACL_PAYLOAD_SIZE or disable ENABLE_LE_SECURE_CONNECTIONS"
77 #endif
78 
79 #ifdef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
80 #error "Support for DHKEY Support in HCI Controller not implemented yet. Please use software implementation"
81 #else
82 // #define USE_MBEDTLS_FOR_ECDH
83 #define USE_MICROECC_FOR_ECDH
84 #endif
85 #endif
86 
87 // Software ECDH implementation provided by mbedtls
88 #ifdef USE_MBEDTLS_FOR_ECDH
89 #include "mbedtls/config.h"
90 #include "mbedtls/platform.h"
91 #include "mbedtls/ecp.h"
92 #include "sm_mbedtls_allocator.h"
93 #endif
94 
95 // Software ECDH implementation provided by micro-ecc
96 #ifdef USE_MICROECC_FOR_ECDH
97 #include "uECC.h"
98 #endif
99 
100 #if defined(ENABLE_LE_SIGNED_WRITE) || defined(ENABLE_LE_SECURE_CONNECTIONS)
101 #define ENABLE_CMAC_ENGINE
102 #endif
103 
104 //
105 // SM internal types and globals
106 //
107 
108 typedef enum {
109     DKG_W4_WORKING,
110     DKG_CALC_IRK,
111     DKG_W4_IRK,
112     DKG_CALC_DHK,
113     DKG_W4_DHK,
114     DKG_READY
115 } derived_key_generation_t;
116 
117 typedef enum {
118     RAU_W4_WORKING,
119     RAU_IDLE,
120     RAU_GET_RANDOM,
121     RAU_W4_RANDOM,
122     RAU_GET_ENC,
123     RAU_W4_ENC,
124     RAU_SET_ADDRESS,
125 } random_address_update_t;
126 
127 typedef enum {
128     CMAC_IDLE,
129     CMAC_CALC_SUBKEYS,
130     CMAC_W4_SUBKEYS,
131     CMAC_CALC_MI,
132     CMAC_W4_MI,
133     CMAC_CALC_MLAST,
134     CMAC_W4_MLAST
135 } cmac_state_t;
136 
137 typedef enum {
138     JUST_WORKS,
139     PK_RESP_INPUT,  // Initiator displays PK, responder inputs PK
140     PK_INIT_INPUT,  // Responder displays PK, initiator inputs PK
141     OK_BOTH_INPUT,  // Only input on both, both input PK
142     NK_BOTH_INPUT,  // Only numerical compparison (yes/no) on on both sides
143     OOB             // OOB available on both sides
144 } stk_generation_method_t;
145 
146 typedef enum {
147     SM_USER_RESPONSE_IDLE,
148     SM_USER_RESPONSE_PENDING,
149     SM_USER_RESPONSE_CONFIRM,
150     SM_USER_RESPONSE_PASSKEY,
151     SM_USER_RESPONSE_DECLINE
152 } sm_user_response_t;
153 
154 typedef enum {
155     SM_AES128_IDLE,
156     SM_AES128_ACTIVE
157 } sm_aes128_state_t;
158 
159 typedef enum {
160     ADDRESS_RESOLUTION_IDLE,
161     ADDRESS_RESOLUTION_GENERAL,
162     ADDRESS_RESOLUTION_FOR_CONNECTION,
163 } address_resolution_mode_t;
164 
165 typedef enum {
166     ADDRESS_RESOLUTION_SUCEEDED,
167     ADDRESS_RESOLUTION_FAILED,
168 } address_resolution_event_t;
169 
170 typedef enum {
171     EC_KEY_GENERATION_IDLE,
172     EC_KEY_GENERATION_ACTIVE,
173     EC_KEY_GENERATION_W4_KEY,
174     EC_KEY_GENERATION_DONE,
175 } ec_key_generation_state_t;
176 
177 typedef enum {
178     SM_STATE_VAR_DHKEY_COMMAND_RECEIVED = 1 << 0
179 } sm_state_var_t;
180 
181 //
182 // GLOBAL DATA
183 //
184 
185 static uint8_t test_use_fixed_local_csrk;
186 
187 // configuration
188 static uint8_t sm_accepted_stk_generation_methods;
189 static uint8_t sm_max_encryption_key_size;
190 static uint8_t sm_min_encryption_key_size;
191 static uint8_t sm_auth_req = 0;
192 static uint8_t sm_io_capabilities = IO_CAPABILITY_NO_INPUT_NO_OUTPUT;
193 static uint8_t sm_slave_request_security;
194 #ifdef ENABLE_LE_SECURE_CONNECTIONS
195 static uint8_t sm_have_ec_keypair;
196 #endif
197 
198 // Security Manager Master Keys, please use sm_set_er(er) and sm_set_ir(ir) with your own 128 bit random values
199 static sm_key_t sm_persistent_er;
200 static sm_key_t sm_persistent_ir;
201 
202 // derived from sm_persistent_ir
203 static sm_key_t sm_persistent_dhk;
204 static sm_key_t sm_persistent_irk;
205 static uint8_t  sm_persistent_irk_ready = 0;    // used for testing
206 static derived_key_generation_t dkg_state;
207 
208 // derived from sm_persistent_er
209 // ..
210 
211 // random address update
212 static random_address_update_t rau_state;
213 static bd_addr_t sm_random_address;
214 
215 // CMAC Calculation: General
216 #ifdef ENABLE_CMAC_ENGINE
217 static cmac_state_t sm_cmac_state;
218 static uint16_t     sm_cmac_message_len;
219 static sm_key_t     sm_cmac_k;
220 static sm_key_t     sm_cmac_x;
221 static sm_key_t     sm_cmac_m_last;
222 static uint8_t      sm_cmac_block_current;
223 static uint8_t      sm_cmac_block_count;
224 static uint8_t      (*sm_cmac_get_byte)(uint16_t offset);
225 static void         (*sm_cmac_done_handler)(uint8_t * hash);
226 #endif
227 
228 // CMAC for ATT Signed Writes
229 #ifdef ENABLE_LE_SIGNED_WRITE
230 static uint8_t      sm_cmac_header[3];
231 static const uint8_t * sm_cmac_message;
232 static uint8_t      sm_cmac_sign_counter[4];
233 #endif
234 
235 // CMAC for Secure Connection functions
236 #ifdef ENABLE_LE_SECURE_CONNECTIONS
237 static sm_connection_t * sm_cmac_connection;
238 static uint8_t           sm_cmac_sc_buffer[80];
239 #endif
240 
241 // resolvable private address lookup / CSRK calculation
242 static int       sm_address_resolution_test;
243 static int       sm_address_resolution_ah_calculation_active;
244 static uint8_t   sm_address_resolution_addr_type;
245 static bd_addr_t sm_address_resolution_address;
246 static void *    sm_address_resolution_context;
247 static address_resolution_mode_t sm_address_resolution_mode;
248 static btstack_linked_list_t sm_address_resolution_general_queue;
249 
250 // aes128 crypto engine. store current sm_connection_t in sm_aes128_context
251 static sm_aes128_state_t  sm_aes128_state;
252 static void *             sm_aes128_context;
253 
254 // use aes128 provided by MCU - not needed usually
255 #ifdef HAVE_AES128
256 static uint8_t                aes128_result_flipped[16];
257 static btstack_timer_source_t aes128_timer;
258 void btstack_aes128_calc(uint8_t * key, uint8_t * plaintext, uint8_t * result);
259 #endif
260 
261 // random engine. store context (ususally sm_connection_t)
262 static void * sm_random_context;
263 
264 // to receive hci events
265 static btstack_packet_callback_registration_t hci_event_callback_registration;
266 
267 /* to dispatch sm event */
268 static btstack_linked_list_t sm_event_handlers;
269 
270 // LE Secure Connections
271 #ifdef ENABLE_LE_SECURE_CONNECTIONS
272 static ec_key_generation_state_t ec_key_generation_state;
273 static uint8_t ec_d[32];
274 static uint8_t ec_q[64];
275 #endif
276 
277 // Software ECDH implementation provided by mbedtls
278 #ifdef USE_MBEDTLS_FOR_ECDH
279 // group is always valid
280 static mbedtls_ecp_group   mbedtls_ec_group;
281 #ifndef HAVE_MALLOC
282 // COMP Method with Window 2
283 // 1300 bytes with 23 allocations
284 // #define MBEDTLS_ALLOC_BUFFER_SIZE (1300+23*sizeof(void *))
285 // NAIVE Method with safe cond assignments (without safe cond, order changes and allocations fail)
286 #define MBEDTLS_ALLOC_BUFFER_SIZE (700+18*sizeof(void *))
287 static uint8_t mbedtls_memory_buffer[MBEDTLS_ALLOC_BUFFER_SIZE];
288 #endif
289 #endif
290 
291 //
292 // Volume 3, Part H, Chapter 24
293 // "Security shall be initiated by the Security Manager in the device in the master role.
294 // The device in the slave role shall be the responding device."
295 // -> master := initiator, slave := responder
296 //
297 
298 // data needed for security setup
299 typedef struct sm_setup_context {
300 
301     btstack_timer_source_t sm_timeout;
302 
303     // used in all phases
304     uint8_t   sm_pairing_failed_reason;
305 
306     // user response, (Phase 1 and/or 2)
307     uint8_t   sm_user_response;
308     uint8_t   sm_keypress_notification;
309 
310     // defines which keys will be send after connection is encrypted - calculated during Phase 1, used Phase 3
311     int       sm_key_distribution_send_set;
312     int       sm_key_distribution_received_set;
313 
314     // Phase 2 (Pairing over SMP)
315     stk_generation_method_t sm_stk_generation_method;
316     sm_key_t  sm_tk;
317     uint8_t   sm_use_secure_connections;
318 
319     sm_key_t  sm_c1_t3_value;   // c1 calculation
320     sm_pairing_packet_t sm_m_preq; // pairing request - needed only for c1
321     sm_pairing_packet_t sm_s_pres; // pairing response - needed only for c1
322     sm_key_t  sm_local_random;
323     sm_key_t  sm_local_confirm;
324     sm_key_t  sm_peer_random;
325     sm_key_t  sm_peer_confirm;
326     uint8_t   sm_m_addr_type;   // address and type can be removed
327     uint8_t   sm_s_addr_type;   //  ''
328     bd_addr_t sm_m_address;     //  ''
329     bd_addr_t sm_s_address;     //  ''
330     sm_key_t  sm_ltk;
331 
332     uint8_t   sm_state_vars;
333 #ifdef ENABLE_LE_SECURE_CONNECTIONS
334     uint8_t   sm_peer_q[64];    // also stores random for EC key generation during init
335     sm_key_t  sm_peer_nonce;    // might be combined with sm_peer_random
336     sm_key_t  sm_local_nonce;   // might be combined with sm_local_random
337     sm_key_t  sm_peer_dhkey_check;
338     sm_key_t  sm_local_dhkey_check;
339     sm_key_t  sm_ra;
340     sm_key_t  sm_rb;
341     sm_key_t  sm_t;             // used for f5 and h6
342     sm_key_t  sm_mackey;
343     uint8_t   sm_passkey_bit;   // also stores number of generated random bytes for EC key generation
344 #endif
345 
346     // Phase 3
347 
348     // key distribution, we generate
349     uint16_t  sm_local_y;
350     uint16_t  sm_local_div;
351     uint16_t  sm_local_ediv;
352     uint8_t   sm_local_rand[8];
353     sm_key_t  sm_local_ltk;
354     sm_key_t  sm_local_csrk;
355     sm_key_t  sm_local_irk;
356     // sm_local_address/addr_type not needed
357 
358     // key distribution, received from peer
359     uint16_t  sm_peer_y;
360     uint16_t  sm_peer_div;
361     uint16_t  sm_peer_ediv;
362     uint8_t   sm_peer_rand[8];
363     sm_key_t  sm_peer_ltk;
364     sm_key_t  sm_peer_irk;
365     sm_key_t  sm_peer_csrk;
366     uint8_t   sm_peer_addr_type;
367     bd_addr_t sm_peer_address;
368 
369 } sm_setup_context_t;
370 
371 //
372 static sm_setup_context_t the_setup;
373 static sm_setup_context_t * setup = &the_setup;
374 
375 // active connection - the one for which the_setup is used for
376 static uint16_t sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
377 
378 // @returns 1 if oob data is available
379 // stores oob data in provided 16 byte buffer if not null
380 static int (*sm_get_oob_data)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data) = NULL;
381 
382 // horizontal: initiator capabilities
383 // vertial:    responder capabilities
384 static const stk_generation_method_t stk_generation_method [5] [5] = {
385     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
386     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
387     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
388     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
389     { PK_RESP_INPUT,   PK_RESP_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
390 };
391 
392 // uses numeric comparison if one side has DisplayYesNo and KeyboardDisplay combinations
393 #ifdef ENABLE_LE_SECURE_CONNECTIONS
394 static const stk_generation_method_t stk_generation_method_with_secure_connection[5][5] = {
395     { JUST_WORKS,      JUST_WORKS,       PK_INIT_INPUT,   JUST_WORKS,    PK_INIT_INPUT },
396     { JUST_WORKS,      NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
397     { PK_RESP_INPUT,   PK_RESP_INPUT,    OK_BOTH_INPUT,   JUST_WORKS,    PK_RESP_INPUT },
398     { JUST_WORKS,      JUST_WORKS,       JUST_WORKS,      JUST_WORKS,    JUST_WORKS    },
399     { PK_RESP_INPUT,   NK_BOTH_INPUT,    PK_INIT_INPUT,   JUST_WORKS,    NK_BOTH_INPUT },
400 };
401 #endif
402 
403 static void sm_run(void);
404 static void sm_done_for_handle(hci_con_handle_t con_handle);
405 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle);
406 static inline int sm_calc_actual_encryption_key_size(int other);
407 static int sm_validate_stk_generation_method(void);
408 static void sm_handle_encryption_result(uint8_t * data);
409 
410 static void log_info_hex16(const char * name, uint16_t value){
411     log_info("%-6s 0x%04x", name, value);
412 }
413 
414 // @returns 1 if all bytes are 0
415 static int sm_is_null(uint8_t * data, int size){
416     int i;
417     for (i=0; i < size ; i++){
418         if (data[i]) return 0;
419     }
420     return 1;
421 }
422 
423 static int sm_is_null_random(uint8_t random[8]){
424     return sm_is_null(random, 8);
425 }
426 
427 static int sm_is_null_key(uint8_t * key){
428     return sm_is_null(key, 16);
429 }
430 
431 // Key utils
432 static void sm_reset_tk(void){
433     int i;
434     for (i=0;i<16;i++){
435         setup->sm_tk[i] = 0;
436     }
437 }
438 
439 // "For example, if a 128-bit encryption key is 0x123456789ABCDEF0123456789ABCDEF0
440 // and it is reduced to 7 octets (56 bits), then the resulting key is 0x0000000000000000003456789ABCDEF0.""
441 static void sm_truncate_key(sm_key_t key, int max_encryption_size){
442     int i;
443     for (i = max_encryption_size ; i < 16 ; i++){
444         key[15-i] = 0;
445     }
446 }
447 
448 // SMP Timeout implementation
449 
450 // Upon transmission of the Pairing Request command or reception of the Pairing Request command,
451 // the Security Manager Timer shall be reset and started.
452 //
453 // The Security Manager Timer shall be reset when an L2CAP SMP command is queued for transmission.
454 //
455 // If the Security Manager Timer reaches 30 seconds, the procedure shall be considered to have failed,
456 // and the local higher layer shall be notified. No further SMP commands shall be sent over the L2CAP
457 // Security Manager Channel. A new SM procedure shall only be performed when a new physical link has been
458 // established.
459 
460 static void sm_timeout_handler(btstack_timer_source_t * timer){
461     log_info("SM timeout");
462     sm_connection_t * sm_conn = (sm_connection_t*) btstack_run_loop_get_timer_context(timer);
463     sm_conn->sm_engine_state = SM_GENERAL_TIMEOUT;
464     sm_done_for_handle(sm_conn->sm_handle);
465 
466     // trigger handling of next ready connection
467     sm_run();
468 }
469 static void sm_timeout_start(sm_connection_t * sm_conn){
470     btstack_run_loop_remove_timer(&setup->sm_timeout);
471     btstack_run_loop_set_timer_context(&setup->sm_timeout, sm_conn);
472     btstack_run_loop_set_timer_handler(&setup->sm_timeout, sm_timeout_handler);
473     btstack_run_loop_set_timer(&setup->sm_timeout, 30000); // 30 seconds sm timeout
474     btstack_run_loop_add_timer(&setup->sm_timeout);
475 }
476 static void sm_timeout_stop(void){
477     btstack_run_loop_remove_timer(&setup->sm_timeout);
478 }
479 static void sm_timeout_reset(sm_connection_t * sm_conn){
480     sm_timeout_stop();
481     sm_timeout_start(sm_conn);
482 }
483 
484 // end of sm timeout
485 
486 // GAP Random Address updates
487 static gap_random_address_type_t gap_random_adress_type;
488 static btstack_timer_source_t gap_random_address_update_timer;
489 static uint32_t gap_random_adress_update_period;
490 
491 static void gap_random_address_trigger(void){
492     if (rau_state != RAU_IDLE) return;
493     log_info("gap_random_address_trigger");
494     rau_state = RAU_GET_RANDOM;
495     sm_run();
496 }
497 
498 static void gap_random_address_update_handler(btstack_timer_source_t * timer){
499     UNUSED(timer);
500 
501     log_info("GAP Random Address Update due");
502     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
503     btstack_run_loop_add_timer(&gap_random_address_update_timer);
504     gap_random_address_trigger();
505 }
506 
507 static void gap_random_address_update_start(void){
508     btstack_run_loop_set_timer_handler(&gap_random_address_update_timer, gap_random_address_update_handler);
509     btstack_run_loop_set_timer(&gap_random_address_update_timer, gap_random_adress_update_period);
510     btstack_run_loop_add_timer(&gap_random_address_update_timer);
511 }
512 
513 static void gap_random_address_update_stop(void){
514     btstack_run_loop_remove_timer(&gap_random_address_update_timer);
515 }
516 
517 
518 static void sm_random_start(void * context){
519     sm_random_context = context;
520     hci_send_cmd(&hci_le_rand);
521 }
522 
523 #ifdef HAVE_AES128
524 static void aes128_completed(btstack_timer_source_t * ts){
525     UNUSED(ts);
526     sm_handle_encryption_result(&aes128_result_flipped[0]);
527     sm_run();
528 }
529 #endif
530 
531 // pre: sm_aes128_state != SM_AES128_ACTIVE, hci_can_send_command == 1
532 // context is made availabe to aes128 result handler by this
533 static void sm_aes128_start(sm_key_t key, sm_key_t plaintext, void * context){
534     sm_aes128_state = SM_AES128_ACTIVE;
535     sm_aes128_context = context;
536 
537 #ifdef HAVE_AES128
538     // calc result directly
539     sm_key_t result;
540     btstack_aes128_calc(key, plaintext, result);
541 
542     // log
543     log_info_key("key", key);
544     log_info_key("txt", plaintext);
545     log_info_key("res", result);
546 
547     // flip
548     reverse_128(&result[0], &aes128_result_flipped[0]);
549 
550     // deliver via timer
551     btstack_run_loop_set_timer_handler(&aes128_timer, &aes128_completed);
552     btstack_run_loop_set_timer(&aes128_timer, 0);    // no delay
553     btstack_run_loop_add_timer(&aes128_timer);
554 #else
555     sm_key_t key_flipped, plaintext_flipped;
556     reverse_128(key, key_flipped);
557     reverse_128(plaintext, plaintext_flipped);
558     hci_send_cmd(&hci_le_encrypt, key_flipped, plaintext_flipped);
559 #endif
560 }
561 
562 // ah(k,r) helper
563 // r = padding || r
564 // r - 24 bit value
565 static void sm_ah_r_prime(uint8_t r[3], uint8_t * r_prime){
566     // r'= padding || r
567     memset(r_prime, 0, 16);
568     memcpy(&r_prime[13], r, 3);
569 }
570 
571 // d1 helper
572 // d' = padding || r || d
573 // d,r - 16 bit values
574 static void sm_d1_d_prime(uint16_t d, uint16_t r, uint8_t * d1_prime){
575     // d'= padding || r || d
576     memset(d1_prime, 0, 16);
577     big_endian_store_16(d1_prime, 12, r);
578     big_endian_store_16(d1_prime, 14, d);
579 }
580 
581 // dm helper
582 // r’ = padding || r
583 // r - 64 bit value
584 static void sm_dm_r_prime(uint8_t r[8], uint8_t * r_prime){
585     memset(r_prime, 0, 16);
586     memcpy(&r_prime[8], r, 8);
587 }
588 
589 // calculate arguments for first AES128 operation in C1 function
590 static void sm_c1_t1(sm_key_t r, uint8_t preq[7], uint8_t pres[7], uint8_t iat, uint8_t rat, uint8_t * t1){
591 
592     // p1 = pres || preq || rat’ || iat’
593     // "The octet of iat’ becomes the least significant octet of p1 and the most signifi-
594     // cant octet of pres becomes the most significant octet of p1.
595     // For example, if the 8-bit iat’ is 0x01, the 8-bit rat’ is 0x00, the 56-bit preq
596     // is 0x07071000000101 and the 56 bit pres is 0x05000800000302 then
597     // p1 is 0x05000800000302070710000001010001."
598 
599     sm_key_t p1;
600     reverse_56(pres, &p1[0]);
601     reverse_56(preq, &p1[7]);
602     p1[14] = rat;
603     p1[15] = iat;
604     log_info_key("p1", p1);
605     log_info_key("r", r);
606 
607     // t1 = r xor p1
608     int i;
609     for (i=0;i<16;i++){
610         t1[i] = r[i] ^ p1[i];
611     }
612     log_info_key("t1", t1);
613 }
614 
615 // calculate arguments for second AES128 operation in C1 function
616 static void sm_c1_t3(sm_key_t t2, bd_addr_t ia, bd_addr_t ra, uint8_t * t3){
617      // p2 = padding || ia || ra
618     // "The least significant octet of ra becomes the least significant octet of p2 and
619     // the most significant octet of padding becomes the most significant octet of p2.
620     // For example, if 48-bit ia is 0xA1A2A3A4A5A6 and the 48-bit ra is
621     // 0xB1B2B3B4B5B6 then p2 is 0x00000000A1A2A3A4A5A6B1B2B3B4B5B6.
622 
623     sm_key_t p2;
624     memset(p2, 0, 16);
625     memcpy(&p2[4],  ia, 6);
626     memcpy(&p2[10], ra, 6);
627     log_info_key("p2", p2);
628 
629     // c1 = e(k, t2_xor_p2)
630     int i;
631     for (i=0;i<16;i++){
632         t3[i] = t2[i] ^ p2[i];
633     }
634     log_info_key("t3", t3);
635 }
636 
637 static void sm_s1_r_prime(sm_key_t r1, sm_key_t r2, uint8_t * r_prime){
638     log_info_key("r1", r1);
639     log_info_key("r2", r2);
640     memcpy(&r_prime[8], &r2[8], 8);
641     memcpy(&r_prime[0], &r1[8], 8);
642 }
643 
644 #ifdef ENABLE_LE_SECURE_CONNECTIONS
645 // Software implementations of crypto toolbox for LE Secure Connection
646 // TODO: replace with code to use AES Engine of HCI Controller
647 typedef uint8_t sm_key24_t[3];
648 typedef uint8_t sm_key56_t[7];
649 typedef uint8_t sm_key256_t[32];
650 
651 #if 0
652 static void aes128_calc_cyphertext(const uint8_t key[16], const uint8_t plaintext[16], uint8_t cyphertext[16]){
653     uint32_t rk[RKLENGTH(KEYBITS)];
654     int nrounds = rijndaelSetupEncrypt(rk, &key[0], KEYBITS);
655     rijndaelEncrypt(rk, nrounds, plaintext, cyphertext);
656 }
657 
658 static void calc_subkeys(sm_key_t k0, sm_key_t k1, sm_key_t k2){
659     memcpy(k1, k0, 16);
660     sm_shift_left_by_one_bit_inplace(16, k1);
661     if (k0[0] & 0x80){
662         k1[15] ^= 0x87;
663     }
664     memcpy(k2, k1, 16);
665     sm_shift_left_by_one_bit_inplace(16, k2);
666     if (k1[0] & 0x80){
667         k2[15] ^= 0x87;
668     }
669 }
670 
671 static void aes_cmac(sm_key_t aes_cmac, const sm_key_t key, const uint8_t * data, int cmac_message_len){
672     sm_key_t k0, k1, k2, zero;
673     memset(zero, 0, 16);
674 
675     aes128_calc_cyphertext(key, zero, k0);
676     calc_subkeys(k0, k1, k2);
677 
678     int cmac_block_count = (cmac_message_len + 15) / 16;
679 
680     // step 3: ..
681     if (cmac_block_count==0){
682         cmac_block_count = 1;
683     }
684 
685     // step 4: set m_last
686     sm_key_t cmac_m_last;
687     int sm_cmac_last_block_complete = cmac_message_len != 0 && (cmac_message_len & 0x0f) == 0;
688     int i;
689     if (sm_cmac_last_block_complete){
690         for (i=0;i<16;i++){
691             cmac_m_last[i] = data[cmac_message_len - 16 + i] ^ k1[i];
692         }
693     } else {
694         int valid_octets_in_last_block = cmac_message_len & 0x0f;
695         for (i=0;i<16;i++){
696             if (i < valid_octets_in_last_block){
697                 cmac_m_last[i] = data[(cmac_message_len & 0xfff0) + i] ^ k2[i];
698                 continue;
699             }
700             if (i == valid_octets_in_last_block){
701                 cmac_m_last[i] = 0x80 ^ k2[i];
702                 continue;
703             }
704             cmac_m_last[i] = k2[i];
705         }
706     }
707 
708     // printf("sm_cmac_start: len %u, block count %u\n", cmac_message_len, cmac_block_count);
709     // LOG_KEY(cmac_m_last);
710 
711     // Step 5
712     sm_key_t cmac_x;
713     memset(cmac_x, 0, 16);
714 
715     // Step 6
716     sm_key_t sm_cmac_y;
717     for (int block = 0 ; block < cmac_block_count-1 ; block++){
718         for (i=0;i<16;i++){
719             sm_cmac_y[i] = cmac_x[i] ^ data[block * 16 + i];
720         }
721         aes128_calc_cyphertext(key, sm_cmac_y, cmac_x);
722     }
723     for (i=0;i<16;i++){
724         sm_cmac_y[i] = cmac_x[i] ^ cmac_m_last[i];
725     }
726 
727     // Step 7
728     aes128_calc_cyphertext(key, sm_cmac_y, aes_cmac);
729 }
730 #endif
731 #endif
732 
733 static void sm_setup_event_base(uint8_t * event, int event_size, uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
734     event[0] = type;
735     event[1] = event_size - 2;
736     little_endian_store_16(event, 2, con_handle);
737     event[4] = addr_type;
738     reverse_bd_addr(address, &event[5]);
739 }
740 
741 static void sm_dispatch_event(uint8_t packet_type, uint16_t channel, uint8_t * packet, uint16_t size){
742     UNUSED(channel);
743 
744     // log event
745     hci_dump_packet(packet_type, 1, packet, size);
746     // dispatch to all event handlers
747     btstack_linked_list_iterator_t it;
748     btstack_linked_list_iterator_init(&it, &sm_event_handlers);
749     while (btstack_linked_list_iterator_has_next(&it)){
750         btstack_packet_callback_registration_t * entry = (btstack_packet_callback_registration_t*) btstack_linked_list_iterator_next(&it);
751         entry->callback(packet_type, 0, packet, size);
752     }
753 }
754 
755 static void sm_notify_client_base(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address){
756     uint8_t event[11];
757     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
758     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
759 }
760 
761 static void sm_notify_client_passkey(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint32_t passkey){
762     uint8_t event[15];
763     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
764     little_endian_store_32(event, 11, passkey);
765     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
766 }
767 
768 static void sm_notify_client_index(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint16_t index){
769     // fetch addr and addr type from db
770     bd_addr_t identity_address;
771     int identity_address_type;
772     le_device_db_info(index, &identity_address_type, identity_address, NULL);
773 
774     uint8_t event[19];
775     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
776     event[11] = identity_address_type;
777     reverse_bd_addr(identity_address, &event[12]);
778     event[18] = index;
779     sm_dispatch_event(HCI_EVENT_PACKET, 0, event, sizeof(event));
780 }
781 
782 static void sm_notify_client_authorization(uint8_t type, hci_con_handle_t con_handle, uint8_t addr_type, bd_addr_t address, uint8_t result){
783 
784     uint8_t event[18];
785     sm_setup_event_base(event, sizeof(event), type, con_handle, addr_type, address);
786     event[11] = result;
787     sm_dispatch_event(HCI_EVENT_PACKET, 0, (uint8_t*) &event, sizeof(event));
788 }
789 
790 // decide on stk generation based on
791 // - pairing request
792 // - io capabilities
793 // - OOB data availability
794 static void sm_setup_tk(void){
795 
796     // default: just works
797     setup->sm_stk_generation_method = JUST_WORKS;
798 
799 #ifdef ENABLE_LE_SECURE_CONNECTIONS
800     setup->sm_use_secure_connections = ( sm_pairing_packet_get_auth_req(setup->sm_m_preq)
801                                        & sm_pairing_packet_get_auth_req(setup->sm_s_pres)
802                                        & SM_AUTHREQ_SECURE_CONNECTION ) != 0;
803     memset(setup->sm_ra, 0, 16);
804     memset(setup->sm_rb, 0, 16);
805 #else
806     setup->sm_use_secure_connections = 0;
807 #endif
808 
809     // If both devices have not set the MITM option in the Authentication Requirements
810     // Flags, then the IO capabilities shall be ignored and the Just Works association
811     // model shall be used.
812     if (((sm_pairing_packet_get_auth_req(setup->sm_m_preq) & SM_AUTHREQ_MITM_PROTECTION) == 0)
813     &&  ((sm_pairing_packet_get_auth_req(setup->sm_s_pres) & SM_AUTHREQ_MITM_PROTECTION) == 0)){
814         log_info("SM: MITM not required by both -> JUST WORKS");
815         return;
816     }
817 
818     // TODO: with LE SC, OOB is used to transfer data OOB during pairing, single device with OOB is sufficient
819 
820     // If both devices have out of band authentication data, then the Authentication
821     // Requirements Flags shall be ignored when selecting the pairing method and the
822     // Out of Band pairing method shall be used.
823     if (sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq)
824     &&  sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres)){
825         log_info("SM: have OOB data");
826         log_info_key("OOB", setup->sm_tk);
827         setup->sm_stk_generation_method = OOB;
828         return;
829     }
830 
831     // Reset TK as it has been setup in sm_init_setup
832     sm_reset_tk();
833 
834     // Also use just works if unknown io capabilites
835     if ((sm_pairing_packet_get_io_capability(setup->sm_m_preq) > IO_CAPABILITY_KEYBOARD_DISPLAY) || (sm_pairing_packet_get_io_capability(setup->sm_s_pres) > IO_CAPABILITY_KEYBOARD_DISPLAY)){
836         return;
837     }
838 
839     // Otherwise the IO capabilities of the devices shall be used to determine the
840     // pairing method as defined in Table 2.4.
841     // see http://stackoverflow.com/a/1052837/393697 for how to specify pointer to 2-dimensional array
842     const stk_generation_method_t (*generation_method)[5] = stk_generation_method;
843 
844 #ifdef ENABLE_LE_SECURE_CONNECTIONS
845     // table not define by default
846     if (setup->sm_use_secure_connections){
847         generation_method = stk_generation_method_with_secure_connection;
848     }
849 #endif
850     setup->sm_stk_generation_method = generation_method[sm_pairing_packet_get_io_capability(setup->sm_s_pres)][sm_pairing_packet_get_io_capability(setup->sm_m_preq)];
851 
852     log_info("sm_setup_tk: master io cap: %u, slave io cap: %u -> method %u",
853         sm_pairing_packet_get_io_capability(setup->sm_m_preq), sm_pairing_packet_get_io_capability(setup->sm_s_pres), setup->sm_stk_generation_method);
854 }
855 
856 static int sm_key_distribution_flags_for_set(uint8_t key_set){
857     int flags = 0;
858     if (key_set & SM_KEYDIST_ENC_KEY){
859         flags |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
860         flags |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
861     }
862     if (key_set & SM_KEYDIST_ID_KEY){
863         flags |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
864         flags |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
865     }
866     if (key_set & SM_KEYDIST_SIGN){
867         flags |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
868     }
869     return flags;
870 }
871 
872 static void sm_setup_key_distribution(uint8_t key_set){
873     setup->sm_key_distribution_received_set = 0;
874     setup->sm_key_distribution_send_set = sm_key_distribution_flags_for_set(key_set);
875 }
876 
877 // CSRK Key Lookup
878 
879 
880 static int sm_address_resolution_idle(void){
881     return sm_address_resolution_mode == ADDRESS_RESOLUTION_IDLE;
882 }
883 
884 static void sm_address_resolution_start_lookup(uint8_t addr_type, hci_con_handle_t con_handle, bd_addr_t addr, address_resolution_mode_t mode, void * context){
885     memcpy(sm_address_resolution_address, addr, 6);
886     sm_address_resolution_addr_type = addr_type;
887     sm_address_resolution_test = 0;
888     sm_address_resolution_mode = mode;
889     sm_address_resolution_context = context;
890     sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_STARTED, con_handle, addr_type, addr);
891 }
892 
893 int sm_address_resolution_lookup(uint8_t address_type, bd_addr_t address){
894     // check if already in list
895     btstack_linked_list_iterator_t it;
896     sm_lookup_entry_t * entry;
897     btstack_linked_list_iterator_init(&it, &sm_address_resolution_general_queue);
898     while(btstack_linked_list_iterator_has_next(&it)){
899         entry = (sm_lookup_entry_t *) btstack_linked_list_iterator_next(&it);
900         if (entry->address_type != address_type) continue;
901         if (memcmp(entry->address, address, 6))  continue;
902         // already in list
903         return BTSTACK_BUSY;
904     }
905     entry = btstack_memory_sm_lookup_entry_get();
906     if (!entry) return BTSTACK_MEMORY_ALLOC_FAILED;
907     entry->address_type = (bd_addr_type_t) address_type;
908     memcpy(entry->address, address, 6);
909     btstack_linked_list_add(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
910     sm_run();
911     return 0;
912 }
913 
914 // while x_state++ for an enum is possible in C, it isn't in C++. we use this helpers to avoid compile errors for now
915 static inline void sm_next_responding_state(sm_connection_t * sm_conn){
916     sm_conn->sm_engine_state = (security_manager_state_t) (((int)sm_conn->sm_engine_state) + 1);
917 }
918 static inline void dkg_next_state(void){
919     dkg_state = (derived_key_generation_t) (((int)dkg_state) + 1);
920 }
921 static inline void rau_next_state(void){
922     rau_state = (random_address_update_t) (((int)rau_state) + 1);
923 }
924 
925 // CMAC calculation using AES Engine
926 #ifdef ENABLE_CMAC_ENGINE
927 
928 static inline void sm_cmac_next_state(void){
929     sm_cmac_state = (cmac_state_t) (((int)sm_cmac_state) + 1);
930 }
931 
932 static int sm_cmac_last_block_complete(void){
933     if (sm_cmac_message_len == 0) return 0;
934     return (sm_cmac_message_len & 0x0f) == 0;
935 }
936 
937 int sm_cmac_ready(void){
938     return sm_cmac_state == CMAC_IDLE;
939 }
940 
941 // generic cmac calculation
942 void sm_cmac_general_start(const sm_key_t key, uint16_t message_len, uint8_t (*get_byte_callback)(uint16_t offset), void (*done_callback)(uint8_t hash[8])){
943     // Generalized CMAC
944     memcpy(sm_cmac_k, key, 16);
945     memset(sm_cmac_x, 0, 16);
946     sm_cmac_block_current = 0;
947     sm_cmac_message_len  = message_len;
948     sm_cmac_done_handler = done_callback;
949     sm_cmac_get_byte     = get_byte_callback;
950 
951     // step 2: n := ceil(len/const_Bsize);
952     sm_cmac_block_count = (sm_cmac_message_len + 15) / 16;
953 
954     // step 3: ..
955     if (sm_cmac_block_count==0){
956         sm_cmac_block_count = 1;
957     }
958     log_info("sm_cmac_general_start: len %u, block count %u", sm_cmac_message_len, sm_cmac_block_count);
959 
960     // first, we need to compute l for k1, k2, and m_last
961     sm_cmac_state = CMAC_CALC_SUBKEYS;
962 
963     // let's go
964     sm_run();
965 }
966 #endif
967 
968 // cmac for ATT Message signing
969 #ifdef ENABLE_LE_SIGNED_WRITE
970 static uint8_t sm_cmac_signed_write_message_get_byte(uint16_t offset){
971     if (offset >= sm_cmac_message_len) {
972         log_error("sm_cmac_signed_write_message_get_byte. out of bounds, access %u, len %u", offset, sm_cmac_message_len);
973         return 0;
974     }
975 
976     offset = sm_cmac_message_len - 1 - offset;
977 
978     // sm_cmac_header[3] | message[] | sm_cmac_sign_counter[4]
979     if (offset < 3){
980         return sm_cmac_header[offset];
981     }
982     int actual_message_len_incl_header = sm_cmac_message_len - 4;
983     if (offset <  actual_message_len_incl_header){
984         return sm_cmac_message[offset - 3];
985     }
986     return sm_cmac_sign_counter[offset - actual_message_len_incl_header];
987 }
988 
989 void sm_cmac_signed_write_start(const sm_key_t k, uint8_t opcode, hci_con_handle_t con_handle, uint16_t message_len, const uint8_t * message, uint32_t sign_counter, void (*done_handler)(uint8_t * hash)){
990     // ATT Message Signing
991     sm_cmac_header[0] = opcode;
992     little_endian_store_16(sm_cmac_header, 1, con_handle);
993     little_endian_store_32(sm_cmac_sign_counter, 0, sign_counter);
994     uint16_t total_message_len = 3 + message_len + 4;  // incl. virtually prepended att opcode, handle and appended sign_counter in LE
995     sm_cmac_message = message;
996     sm_cmac_general_start(k, total_message_len, &sm_cmac_signed_write_message_get_byte, done_handler);
997 }
998 #endif
999 
1000 #ifdef ENABLE_CMAC_ENGINE
1001 static void sm_cmac_handle_aes_engine_ready(void){
1002     switch (sm_cmac_state){
1003         case CMAC_CALC_SUBKEYS: {
1004             sm_key_t const_zero;
1005             memset(const_zero, 0, 16);
1006             sm_cmac_next_state();
1007             sm_aes128_start(sm_cmac_k, const_zero, NULL);
1008             break;
1009         }
1010         case CMAC_CALC_MI: {
1011             int j;
1012             sm_key_t y;
1013             for (j=0;j<16;j++){
1014                 y[j] = sm_cmac_x[j] ^ sm_cmac_get_byte(sm_cmac_block_current*16 + j);
1015             }
1016             sm_cmac_block_current++;
1017             sm_cmac_next_state();
1018             sm_aes128_start(sm_cmac_k, y, NULL);
1019             break;
1020         }
1021         case CMAC_CALC_MLAST: {
1022             int i;
1023             sm_key_t y;
1024             for (i=0;i<16;i++){
1025                 y[i] = sm_cmac_x[i] ^ sm_cmac_m_last[i];
1026             }
1027             log_info_key("Y", y);
1028             sm_cmac_block_current++;
1029             sm_cmac_next_state();
1030             sm_aes128_start(sm_cmac_k, y, NULL);
1031             break;
1032         }
1033         default:
1034             log_info("sm_cmac_handle_aes_engine_ready called in state %u", sm_cmac_state);
1035             break;
1036     }
1037 }
1038 
1039 // CMAC Implementation using AES128 engine
1040 static void sm_shift_left_by_one_bit_inplace(int len, uint8_t * data){
1041     int i;
1042     int carry = 0;
1043     for (i=len-1; i >= 0 ; i--){
1044         int new_carry = data[i] >> 7;
1045         data[i] = data[i] << 1 | carry;
1046         carry = new_carry;
1047     }
1048 }
1049 
1050 static void sm_cmac_handle_encryption_result(sm_key_t data){
1051     switch (sm_cmac_state){
1052         case CMAC_W4_SUBKEYS: {
1053             sm_key_t k1;
1054             memcpy(k1, data, 16);
1055             sm_shift_left_by_one_bit_inplace(16, k1);
1056             if (data[0] & 0x80){
1057                 k1[15] ^= 0x87;
1058             }
1059             sm_key_t k2;
1060             memcpy(k2, k1, 16);
1061             sm_shift_left_by_one_bit_inplace(16, k2);
1062             if (k1[0] & 0x80){
1063                 k2[15] ^= 0x87;
1064             }
1065 
1066             log_info_key("k", sm_cmac_k);
1067             log_info_key("k1", k1);
1068             log_info_key("k2", k2);
1069 
1070             // step 4: set m_last
1071             int i;
1072             if (sm_cmac_last_block_complete()){
1073                 for (i=0;i<16;i++){
1074                     sm_cmac_m_last[i] = sm_cmac_get_byte(sm_cmac_message_len - 16 + i) ^ k1[i];
1075                 }
1076             } else {
1077                 int valid_octets_in_last_block = sm_cmac_message_len & 0x0f;
1078                 for (i=0;i<16;i++){
1079                     if (i < valid_octets_in_last_block){
1080                         sm_cmac_m_last[i] = sm_cmac_get_byte((sm_cmac_message_len & 0xfff0) + i) ^ k2[i];
1081                         continue;
1082                     }
1083                     if (i == valid_octets_in_last_block){
1084                         sm_cmac_m_last[i] = 0x80 ^ k2[i];
1085                         continue;
1086                     }
1087                     sm_cmac_m_last[i] = k2[i];
1088                 }
1089             }
1090 
1091             // next
1092             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
1093             break;
1094         }
1095         case CMAC_W4_MI:
1096             memcpy(sm_cmac_x, data, 16);
1097             sm_cmac_state = sm_cmac_block_current < sm_cmac_block_count - 1 ? CMAC_CALC_MI : CMAC_CALC_MLAST;
1098             break;
1099         case CMAC_W4_MLAST:
1100             // done
1101             log_info("Setting CMAC Engine to IDLE");
1102             sm_cmac_state = CMAC_IDLE;
1103             log_info_key("CMAC", data);
1104             sm_cmac_done_handler(data);
1105             break;
1106         default:
1107             log_info("sm_cmac_handle_encryption_result called in state %u", sm_cmac_state);
1108             break;
1109     }
1110 }
1111 #endif
1112 
1113 static void sm_trigger_user_response(sm_connection_t * sm_conn){
1114     // notify client for: JUST WORKS confirm, Numeric comparison confirm, PASSKEY display or input
1115     setup->sm_user_response = SM_USER_RESPONSE_IDLE;
1116     switch (setup->sm_stk_generation_method){
1117         case PK_RESP_INPUT:
1118             if (IS_RESPONDER(sm_conn->sm_role)){
1119                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1120                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1121             } else {
1122                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1123             }
1124             break;
1125         case PK_INIT_INPUT:
1126             if (IS_RESPONDER(sm_conn->sm_role)){
1127                 sm_notify_client_passkey(SM_EVENT_PASSKEY_DISPLAY_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1128             } else {
1129                 setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1130                 sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1131             }
1132             break;
1133         case OK_BOTH_INPUT:
1134             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1135             sm_notify_client_base(SM_EVENT_PASSKEY_INPUT_NUMBER, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1136             break;
1137         case NK_BOTH_INPUT:
1138             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1139             sm_notify_client_passkey(SM_EVENT_NUMERIC_COMPARISON_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, big_endian_read_32(setup->sm_tk, 12));
1140             break;
1141         case JUST_WORKS:
1142             setup->sm_user_response = SM_USER_RESPONSE_PENDING;
1143             sm_notify_client_base(SM_EVENT_JUST_WORKS_REQUEST, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
1144             break;
1145         case OOB:
1146             // client already provided OOB data, let's skip notification.
1147             break;
1148     }
1149 }
1150 
1151 static int sm_key_distribution_all_received(sm_connection_t * sm_conn){
1152     int recv_flags;
1153     if (IS_RESPONDER(sm_conn->sm_role)){
1154         // slave / responder
1155         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres));
1156     } else {
1157         // master / initiator
1158         recv_flags = sm_key_distribution_flags_for_set(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
1159     }
1160     log_debug("sm_key_distribution_all_received: received 0x%02x, expecting 0x%02x", setup->sm_key_distribution_received_set, recv_flags);
1161     return recv_flags == setup->sm_key_distribution_received_set;
1162 }
1163 
1164 static void sm_done_for_handle(hci_con_handle_t con_handle){
1165     if (sm_active_connection_handle == con_handle){
1166         sm_timeout_stop();
1167         sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
1168         log_info("sm: connection 0x%x released setup context", con_handle);
1169     }
1170 }
1171 
1172 static int sm_key_distribution_flags_for_auth_req(void){
1173     int flags = SM_KEYDIST_ID_KEY | SM_KEYDIST_SIGN;
1174     if (sm_auth_req & SM_AUTHREQ_BONDING){
1175         // encryption information only if bonding requested
1176         flags |= SM_KEYDIST_ENC_KEY;
1177     }
1178     return flags;
1179 }
1180 
1181 static void sm_reset_setup(void){
1182     // fill in sm setup
1183     setup->sm_state_vars = 0;
1184     setup->sm_keypress_notification = 0xff;
1185     sm_reset_tk();
1186 }
1187 
1188 static void sm_init_setup(sm_connection_t * sm_conn){
1189 
1190     // fill in sm setup
1191     setup->sm_peer_addr_type = sm_conn->sm_peer_addr_type;
1192     memcpy(setup->sm_peer_address, sm_conn->sm_peer_address, 6);
1193 
1194     // query client for OOB data
1195     int have_oob_data = 0;
1196     if (sm_get_oob_data) {
1197         have_oob_data = (*sm_get_oob_data)(sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, setup->sm_tk);
1198     }
1199 
1200     sm_pairing_packet_t * local_packet;
1201     if (IS_RESPONDER(sm_conn->sm_role)){
1202         // slave
1203         local_packet = &setup->sm_s_pres;
1204         gap_le_get_own_address(&setup->sm_s_addr_type, setup->sm_s_address);
1205         setup->sm_m_addr_type = sm_conn->sm_peer_addr_type;
1206         memcpy(setup->sm_m_address, sm_conn->sm_peer_address, 6);
1207     } else {
1208         // master
1209         local_packet = &setup->sm_m_preq;
1210         gap_le_get_own_address(&setup->sm_m_addr_type, setup->sm_m_address);
1211         setup->sm_s_addr_type = sm_conn->sm_peer_addr_type;
1212         memcpy(setup->sm_s_address, sm_conn->sm_peer_address, 6);
1213 
1214         int key_distribution_flags = sm_key_distribution_flags_for_auth_req();
1215         sm_pairing_packet_set_initiator_key_distribution(setup->sm_m_preq, key_distribution_flags);
1216         sm_pairing_packet_set_responder_key_distribution(setup->sm_m_preq, key_distribution_flags);
1217     }
1218 
1219     uint8_t auth_req = sm_auth_req;
1220     sm_pairing_packet_set_io_capability(*local_packet, sm_io_capabilities);
1221     sm_pairing_packet_set_oob_data_flag(*local_packet, have_oob_data);
1222     sm_pairing_packet_set_auth_req(*local_packet, auth_req);
1223     sm_pairing_packet_set_max_encryption_key_size(*local_packet, sm_max_encryption_key_size);
1224 }
1225 
1226 static int sm_stk_generation_init(sm_connection_t * sm_conn){
1227 
1228     sm_pairing_packet_t * remote_packet;
1229     int                   remote_key_request;
1230     if (IS_RESPONDER(sm_conn->sm_role)){
1231         // slave / responder
1232         remote_packet      = &setup->sm_m_preq;
1233         remote_key_request = sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq);
1234     } else {
1235         // master / initiator
1236         remote_packet      = &setup->sm_s_pres;
1237         remote_key_request = sm_pairing_packet_get_initiator_key_distribution(setup->sm_s_pres);
1238     }
1239 
1240     // check key size
1241     sm_conn->sm_actual_encryption_key_size = sm_calc_actual_encryption_key_size(sm_pairing_packet_get_max_encryption_key_size(*remote_packet));
1242     if (sm_conn->sm_actual_encryption_key_size == 0) return SM_REASON_ENCRYPTION_KEY_SIZE;
1243 
1244     // decide on STK generation method
1245     sm_setup_tk();
1246     log_info("SMP: generation method %u", setup->sm_stk_generation_method);
1247 
1248     // check if STK generation method is acceptable by client
1249     if (!sm_validate_stk_generation_method()) return SM_REASON_AUTHENTHICATION_REQUIREMENTS;
1250 
1251     // identical to responder
1252     sm_setup_key_distribution(remote_key_request);
1253 
1254     // JUST WORKS doens't provide authentication
1255     sm_conn->sm_connection_authenticated = setup->sm_stk_generation_method == JUST_WORKS ? 0 : 1;
1256 
1257     return 0;
1258 }
1259 
1260 static void sm_address_resolution_handle_event(address_resolution_event_t event){
1261 
1262     // cache and reset context
1263     int matched_device_id = sm_address_resolution_test;
1264     address_resolution_mode_t mode = sm_address_resolution_mode;
1265     void * context = sm_address_resolution_context;
1266 
1267     // reset context
1268     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
1269     sm_address_resolution_context = NULL;
1270     sm_address_resolution_test = -1;
1271     hci_con_handle_t con_handle = 0;
1272 
1273     sm_connection_t * sm_connection;
1274 #ifdef ENABLE_LE_CENTRAL
1275     sm_key_t ltk;
1276 #endif
1277     switch (mode){
1278         case ADDRESS_RESOLUTION_GENERAL:
1279             break;
1280         case ADDRESS_RESOLUTION_FOR_CONNECTION:
1281             sm_connection = (sm_connection_t *) context;
1282             con_handle = sm_connection->sm_handle;
1283             switch (event){
1284                 case ADDRESS_RESOLUTION_SUCEEDED:
1285                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_SUCCEEDED;
1286                     sm_connection->sm_le_db_index = matched_device_id;
1287                     log_info("ADDRESS_RESOLUTION_SUCEEDED, index %d", sm_connection->sm_le_db_index);
1288 #ifdef ENABLE_LE_CENTRAL
1289                     if (sm_connection->sm_role) break;
1290                     if (!sm_connection->sm_bonding_requested && !sm_connection->sm_security_request_received) break;
1291                     sm_connection->sm_security_request_received = 0;
1292                     sm_connection->sm_bonding_requested = 0;
1293                     le_device_db_encryption_get(sm_connection->sm_le_db_index, NULL, NULL, ltk, NULL, NULL, NULL);
1294                     if (!sm_is_null_key(ltk)){
1295                         sm_connection->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
1296                     } else {
1297                         sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1298                     }
1299 #endif
1300                     break;
1301                 case ADDRESS_RESOLUTION_FAILED:
1302                     sm_connection->sm_irk_lookup_state = IRK_LOOKUP_FAILED;
1303 #ifdef ENABLE_LE_CENTRAL
1304                     if (sm_connection->sm_role) break;
1305                     if (!sm_connection->sm_bonding_requested && !sm_connection->sm_security_request_received) break;
1306                     sm_connection->sm_security_request_received = 0;
1307                     sm_connection->sm_bonding_requested = 0;
1308                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
1309 #endif
1310                     break;
1311             }
1312             break;
1313         default:
1314             break;
1315     }
1316 
1317     switch (event){
1318         case ADDRESS_RESOLUTION_SUCEEDED:
1319             sm_notify_client_index(SM_EVENT_IDENTITY_RESOLVING_SUCCEEDED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address, matched_device_id);
1320             break;
1321         case ADDRESS_RESOLUTION_FAILED:
1322             sm_notify_client_base(SM_EVENT_IDENTITY_RESOLVING_FAILED, con_handle, sm_address_resolution_addr_type, sm_address_resolution_address);
1323             break;
1324     }
1325 }
1326 
1327 static void sm_key_distribution_handle_all_received(sm_connection_t * sm_conn){
1328 
1329     int le_db_index = -1;
1330 
1331     // lookup device based on IRK
1332     if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
1333         int i;
1334         for (i=0; i < le_device_db_count(); i++){
1335             sm_key_t irk;
1336             bd_addr_t address;
1337             int address_type;
1338             le_device_db_info(i, &address_type, address, irk);
1339             if (memcmp(irk, setup->sm_peer_irk, 16) == 0){
1340                 log_info("sm: device found for IRK, updating");
1341                 le_db_index = i;
1342                 break;
1343             }
1344         }
1345     }
1346 
1347     // if not found, lookup via public address if possible
1348     log_info("sm peer addr type %u, peer addres %s", setup->sm_peer_addr_type, bd_addr_to_str(setup->sm_peer_address));
1349     if (le_db_index < 0 && setup->sm_peer_addr_type == BD_ADDR_TYPE_LE_PUBLIC){
1350         int i;
1351         for (i=0; i < le_device_db_count(); i++){
1352             bd_addr_t address;
1353             int address_type;
1354             le_device_db_info(i, &address_type, address, NULL);
1355             log_info("device %u, sm peer addr type %u, peer addres %s", i, address_type, bd_addr_to_str(address));
1356             if (address_type == BD_ADDR_TYPE_LE_PUBLIC && memcmp(address, setup->sm_peer_address, 6) == 0){
1357                 log_info("sm: device found for public address, updating");
1358                 le_db_index = i;
1359                 break;
1360             }
1361         }
1362     }
1363 
1364     // if not found, add to db
1365     if (le_db_index < 0) {
1366         le_db_index = le_device_db_add(setup->sm_peer_addr_type, setup->sm_peer_address, setup->sm_peer_irk);
1367     }
1368 
1369     sm_notify_client_index(SM_EVENT_IDENTITY_CREATED, sm_conn->sm_handle, setup->sm_peer_addr_type, setup->sm_peer_address, le_db_index);
1370 
1371     if (le_db_index >= 0){
1372 
1373 #ifdef ENABLE_LE_SIGNED_WRITE
1374         // store local CSRK
1375         if (setup->sm_key_distribution_send_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1376             log_info("sm: store local CSRK");
1377             le_device_db_local_csrk_set(le_db_index, setup->sm_local_csrk);
1378             le_device_db_local_counter_set(le_db_index, 0);
1379         }
1380 
1381         // store remote CSRK
1382         if (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
1383             log_info("sm: store remote CSRK");
1384             le_device_db_remote_csrk_set(le_db_index, setup->sm_peer_csrk);
1385             le_device_db_remote_counter_set(le_db_index, 0);
1386         }
1387 #endif
1388         // store encryption information for secure connections: LTK generated by ECDH
1389         if (setup->sm_use_secure_connections){
1390             log_info("sm: store SC LTK (key size %u, authenticatd %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
1391             uint8_t zero_rand[8];
1392             memset(zero_rand, 0, 8);
1393             le_device_db_encryption_set(le_db_index, 0, zero_rand, setup->sm_ltk, sm_conn->sm_actual_encryption_key_size,
1394                 sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
1395         }
1396 
1397         // store encryption infromation for legacy pairing: peer LTK, EDIV, RAND
1398         else if ( (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION)
1399                && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_MASTER_IDENTIFICATION )){
1400             log_info("sm: set encryption information (key size %u, authenticatd %u)", sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated);
1401             le_device_db_encryption_set(le_db_index, setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1402                 sm_conn->sm_actual_encryption_key_size, sm_conn->sm_connection_authenticated, sm_conn->sm_connection_authorization_state == AUTHORIZATION_GRANTED);
1403 
1404         }
1405     }
1406 
1407     // keep le_db_index
1408     sm_conn->sm_le_db_index = le_db_index;
1409 }
1410 
1411 static void sm_pairing_error(sm_connection_t * sm_conn, uint8_t reason){
1412     setup->sm_pairing_failed_reason = reason;
1413     sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
1414 }
1415 
1416 static inline void sm_pdu_received_in_wrong_state(sm_connection_t * sm_conn){
1417     sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
1418 }
1419 
1420 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1421 
1422 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn);
1423 static int sm_passkey_used(stk_generation_method_t method);
1424 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method);
1425 
1426 static void sm_log_ec_keypair(void){
1427     log_info("Elliptic curve: X");
1428     log_info_hexdump(&ec_q[0],32);
1429     log_info("Elliptic curve: Y");
1430     log_info_hexdump(&ec_q[32],32);
1431 }
1432 
1433 static void sm_sc_start_calculating_local_confirm(sm_connection_t * sm_conn){
1434     if (sm_passkey_used(setup->sm_stk_generation_method)){
1435         sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
1436     } else {
1437         sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
1438     }
1439 }
1440 
1441 static void sm_sc_state_after_receiving_random(sm_connection_t * sm_conn){
1442     if (IS_RESPONDER(sm_conn->sm_role)){
1443         // Responder
1444         sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
1445     } else {
1446         // Initiator role
1447         switch (setup->sm_stk_generation_method){
1448             case JUST_WORKS:
1449                 sm_sc_prepare_dhkey_check(sm_conn);
1450                 break;
1451 
1452             case NK_BOTH_INPUT:
1453                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_G2;
1454                 break;
1455             case PK_INIT_INPUT:
1456             case PK_RESP_INPUT:
1457             case OK_BOTH_INPUT:
1458                 if (setup->sm_passkey_bit < 20) {
1459                     sm_sc_start_calculating_local_confirm(sm_conn);
1460                 } else {
1461                     sm_sc_prepare_dhkey_check(sm_conn);
1462                 }
1463                 break;
1464             case OOB:
1465                 // TODO: implement SC OOB
1466                 break;
1467         }
1468     }
1469 }
1470 
1471 static uint8_t sm_sc_cmac_get_byte(uint16_t offset){
1472     return sm_cmac_sc_buffer[offset];
1473 }
1474 
1475 static void sm_sc_cmac_done(uint8_t * hash){
1476     log_info("sm_sc_cmac_done: ");
1477     log_info_hexdump(hash, 16);
1478 
1479     sm_connection_t * sm_conn = sm_cmac_connection;
1480     sm_cmac_connection = NULL;
1481     link_key_type_t link_key_type;
1482 
1483     switch (sm_conn->sm_engine_state){
1484         case SM_SC_W4_CMAC_FOR_CONFIRMATION:
1485             memcpy(setup->sm_local_confirm, hash, 16);
1486             sm_conn->sm_engine_state = SM_SC_SEND_CONFIRMATION;
1487             break;
1488         case SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION:
1489             // check
1490             if (0 != memcmp(hash, setup->sm_peer_confirm, 16)){
1491                 sm_pairing_error(sm_conn, SM_REASON_CONFIRM_VALUE_FAILED);
1492                 break;
1493             }
1494             sm_sc_state_after_receiving_random(sm_conn);
1495             break;
1496         case SM_SC_W4_CALCULATE_G2: {
1497             uint32_t vab = big_endian_read_32(hash, 12) % 1000000;
1498             big_endian_store_32(setup->sm_tk, 12, vab);
1499             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
1500             sm_trigger_user_response(sm_conn);
1501             break;
1502         }
1503         case SM_SC_W4_CALCULATE_F5_SALT:
1504             memcpy(setup->sm_t, hash, 16);
1505             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_MACKEY;
1506             break;
1507         case SM_SC_W4_CALCULATE_F5_MACKEY:
1508             memcpy(setup->sm_mackey, hash, 16);
1509             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_LTK;
1510             break;
1511         case SM_SC_W4_CALCULATE_F5_LTK:
1512             // truncate sm_ltk, but keep full LTK for cross-transport key derivation in sm_local_ltk
1513             // Errata Service Release to the Bluetooth Specification: ESR09
1514             //   E6405 – Cross transport key derivation from a key of size less than 128 bits
1515             //   Note: When the BR/EDR link key is being derived from the LTK, the derivation is done before the LTK gets masked."
1516             memcpy(setup->sm_ltk, hash, 16);
1517             memcpy(setup->sm_local_ltk, hash, 16);
1518             sm_truncate_key(setup->sm_ltk, sm_conn->sm_actual_encryption_key_size);
1519             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK;
1520             break;
1521         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
1522             memcpy(setup->sm_local_dhkey_check, hash, 16);
1523             if (IS_RESPONDER(sm_conn->sm_role)){
1524                 // responder
1525                 if (setup->sm_state_vars & SM_STATE_VAR_DHKEY_COMMAND_RECEIVED){
1526                     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
1527                 } else {
1528                     sm_conn->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
1529                 }
1530             } else {
1531                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1532             }
1533             break;
1534         case SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
1535             if (0 != memcmp(hash, setup->sm_peer_dhkey_check, 16) ){
1536                 sm_pairing_error(sm_conn, SM_REASON_DHKEY_CHECK_FAILED);
1537                 break;
1538             }
1539             if (IS_RESPONDER(sm_conn->sm_role)){
1540                 // responder
1541                 sm_conn->sm_engine_state = SM_SC_SEND_DHKEY_CHECK_COMMAND;
1542             } else {
1543                 // initiator
1544                 sm_conn->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
1545             }
1546             break;
1547         case SM_SC_W4_CALCULATE_H6_ILK:
1548             memcpy(setup->sm_t, hash, 16);
1549             sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_H6_BR_EDR_LINK_KEY;
1550             break;
1551         case SM_SC_W4_CALCULATE_H6_BR_EDR_LINK_KEY:
1552             reverse_128(hash, setup->sm_t);
1553             link_key_type = sm_conn->sm_connection_authenticated ?
1554                 AUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256 : UNAUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256;
1555             if (IS_RESPONDER(sm_conn->sm_role)){
1556 #ifdef ENABLE_CLASSIC
1557                 gap_store_link_key_for_bd_addr(setup->sm_m_address, setup->sm_t, link_key_type);
1558 #endif
1559                 sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
1560             } else {
1561 #ifdef ENABLE_CLASSIC
1562                 gap_store_link_key_for_bd_addr(setup->sm_s_address, setup->sm_t, link_key_type);
1563 #endif
1564                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
1565             }
1566             sm_done_for_handle(sm_conn->sm_handle);
1567             break;
1568         default:
1569             log_error("sm_sc_cmac_done in state %u", sm_conn->sm_engine_state);
1570             break;
1571     }
1572     sm_run();
1573 }
1574 
1575 static void f4_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, uint8_t z){
1576     const uint16_t message_len = 65;
1577     sm_cmac_connection = sm_conn;
1578     memcpy(sm_cmac_sc_buffer, u, 32);
1579     memcpy(sm_cmac_sc_buffer+32, v, 32);
1580     sm_cmac_sc_buffer[64] = z;
1581     log_info("f4 key");
1582     log_info_hexdump(x, 16);
1583     log_info("f4 message");
1584     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1585     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1586 }
1587 
1588 static const sm_key_t f5_salt = { 0x6C ,0x88, 0x83, 0x91, 0xAA, 0xF5, 0xA5, 0x38, 0x60, 0x37, 0x0B, 0xDB, 0x5A, 0x60, 0x83, 0xBE};
1589 static const uint8_t f5_key_id[] = { 0x62, 0x74, 0x6c, 0x65 };
1590 static const uint8_t f5_length[] = { 0x01, 0x00};
1591 
1592 static void sm_sc_calculate_dhkey(sm_key256_t dhkey){
1593     memset(dhkey, 0, 32);
1594 #ifdef USE_MBEDTLS_FOR_ECDH
1595     // da * Pb
1596     mbedtls_mpi d;
1597     mbedtls_ecp_point Q;
1598     mbedtls_ecp_point DH;
1599     mbedtls_mpi_init(&d);
1600     mbedtls_ecp_point_init(&Q);
1601     mbedtls_ecp_point_init(&DH);
1602     mbedtls_mpi_read_binary(&d, ec_d, 32);
1603     mbedtls_mpi_read_binary(&Q.X, &setup->sm_peer_q[0] , 32);
1604     mbedtls_mpi_read_binary(&Q.Y, &setup->sm_peer_q[32], 32);
1605     mbedtls_mpi_lset(&Q.Z, 1);
1606     mbedtls_ecp_mul(&mbedtls_ec_group, &DH, &d, &Q, NULL, NULL);
1607     mbedtls_mpi_write_binary(&DH.X, dhkey, 32);
1608     mbedtls_ecp_point_free(&DH);
1609     mbedtls_mpi_free(&d);
1610     mbedtls_ecp_point_free(&Q);
1611 #endif
1612 #ifdef USE_MICROECC_FOR_ECDH
1613 #if uECC_SUPPORTS_secp256r1
1614     // standard version
1615     uECC_shared_secret(setup->sm_peer_q, ec_d, dhkey, uECC_secp256r1());
1616 #else
1617     // static version
1618     uECC_shared_secret(setup->sm_peer_q, ec_d, dhkey);
1619 #endif
1620 #endif
1621     log_info("dhkey");
1622     log_info_hexdump(dhkey, 32);
1623 }
1624 
1625 static void f5_calculate_salt(sm_connection_t * sm_conn){
1626     // calculate DHKEY
1627     sm_key256_t dhkey;
1628     sm_sc_calculate_dhkey(dhkey);
1629 
1630     // calculate salt for f5
1631     const uint16_t message_len = 32;
1632     sm_cmac_connection = sm_conn;
1633     memcpy(sm_cmac_sc_buffer, dhkey, message_len);
1634     sm_cmac_general_start(f5_salt, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1635 }
1636 
1637 static inline void f5_mackkey(sm_connection_t * sm_conn, sm_key_t t, const sm_key_t n1, const sm_key_t n2, const sm_key56_t a1, const sm_key56_t a2){
1638     const uint16_t message_len = 53;
1639     sm_cmac_connection = sm_conn;
1640 
1641     // f5(W, N1, N2, A1, A2) = AES-CMACT (Counter = 0 || keyID || N1 || N2|| A1|| A2 || Length = 256) -- this is the MacKey
1642     sm_cmac_sc_buffer[0] = 0;
1643     memcpy(sm_cmac_sc_buffer+01, f5_key_id, 4);
1644     memcpy(sm_cmac_sc_buffer+05, n1, 16);
1645     memcpy(sm_cmac_sc_buffer+21, n2, 16);
1646     memcpy(sm_cmac_sc_buffer+37, a1, 7);
1647     memcpy(sm_cmac_sc_buffer+44, a2, 7);
1648     memcpy(sm_cmac_sc_buffer+51, f5_length, 2);
1649     log_info("f5 key");
1650     log_info_hexdump(t, 16);
1651     log_info("f5 message for MacKey");
1652     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1653     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1654 }
1655 
1656 static void f5_calculate_mackey(sm_connection_t * sm_conn){
1657     sm_key56_t bd_addr_master, bd_addr_slave;
1658     bd_addr_master[0] =  setup->sm_m_addr_type;
1659     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1660     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1661     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1662     if (IS_RESPONDER(sm_conn->sm_role)){
1663         // responder
1664         f5_mackkey(sm_conn, setup->sm_t, setup->sm_peer_nonce, setup->sm_local_nonce, bd_addr_master, bd_addr_slave);
1665     } else {
1666         // initiator
1667         f5_mackkey(sm_conn, setup->sm_t, setup->sm_local_nonce, setup->sm_peer_nonce, bd_addr_master, bd_addr_slave);
1668     }
1669 }
1670 
1671 // note: must be called right after f5_mackey, as sm_cmac_buffer[1..52] will be reused
1672 static inline void f5_ltk(sm_connection_t * sm_conn, sm_key_t t){
1673     const uint16_t message_len = 53;
1674     sm_cmac_connection = sm_conn;
1675     sm_cmac_sc_buffer[0] = 1;
1676     // 1..52 setup before
1677     log_info("f5 key");
1678     log_info_hexdump(t, 16);
1679     log_info("f5 message for LTK");
1680     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1681     sm_cmac_general_start(t, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1682 }
1683 
1684 static void f5_calculate_ltk(sm_connection_t * sm_conn){
1685     f5_ltk(sm_conn, setup->sm_t);
1686 }
1687 
1688 static void f6_engine(sm_connection_t * sm_conn, const sm_key_t w, const sm_key_t n1, const sm_key_t n2, const sm_key_t r, const sm_key24_t io_cap, const sm_key56_t a1, const sm_key56_t a2){
1689     const uint16_t message_len = 65;
1690     sm_cmac_connection = sm_conn;
1691     memcpy(sm_cmac_sc_buffer, n1, 16);
1692     memcpy(sm_cmac_sc_buffer+16, n2, 16);
1693     memcpy(sm_cmac_sc_buffer+32, r, 16);
1694     memcpy(sm_cmac_sc_buffer+48, io_cap, 3);
1695     memcpy(sm_cmac_sc_buffer+51, a1, 7);
1696     memcpy(sm_cmac_sc_buffer+58, a2, 7);
1697     log_info("f6 key");
1698     log_info_hexdump(w, 16);
1699     log_info("f6 message");
1700     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1701     sm_cmac_general_start(w, 65, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1702 }
1703 
1704 // g2(U, V, X, Y) = AES-CMACX(U || V || Y) mod 2^32
1705 // - U is 256 bits
1706 // - V is 256 bits
1707 // - X is 128 bits
1708 // - Y is 128 bits
1709 static void g2_engine(sm_connection_t * sm_conn, const sm_key256_t u, const sm_key256_t v, const sm_key_t x, const sm_key_t y){
1710     const uint16_t message_len = 80;
1711     sm_cmac_connection = sm_conn;
1712     memcpy(sm_cmac_sc_buffer, u, 32);
1713     memcpy(sm_cmac_sc_buffer+32, v, 32);
1714     memcpy(sm_cmac_sc_buffer+64, y, 16);
1715     log_info("g2 key");
1716     log_info_hexdump(x, 16);
1717     log_info("g2 message");
1718     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1719     sm_cmac_general_start(x, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1720 }
1721 
1722 static void g2_calculate(sm_connection_t * sm_conn) {
1723     // calc Va if numeric comparison
1724     if (IS_RESPONDER(sm_conn->sm_role)){
1725         // responder
1726         g2_engine(sm_conn, setup->sm_peer_q, ec_q, setup->sm_peer_nonce, setup->sm_local_nonce);;
1727     } else {
1728         // initiator
1729         g2_engine(sm_conn, ec_q, setup->sm_peer_q, setup->sm_local_nonce, setup->sm_peer_nonce);
1730     }
1731 }
1732 
1733 static void sm_sc_calculate_local_confirm(sm_connection_t * sm_conn){
1734     uint8_t z = 0;
1735     if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT){
1736         // some form of passkey
1737         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1738         z = 0x80 | ((pk >> setup->sm_passkey_bit) & 1);
1739         setup->sm_passkey_bit++;
1740     }
1741     f4_engine(sm_conn, ec_q, setup->sm_peer_q, setup->sm_local_nonce, z);
1742 }
1743 
1744 static void sm_sc_calculate_remote_confirm(sm_connection_t * sm_conn){
1745     uint8_t z = 0;
1746     if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT){
1747         // some form of passkey
1748         uint32_t pk = big_endian_read_32(setup->sm_tk, 12);
1749         // sm_passkey_bit was increased before sending confirm value
1750         z = 0x80 | ((pk >> (setup->sm_passkey_bit-1)) & 1);
1751     }
1752     f4_engine(sm_conn, setup->sm_peer_q, ec_q, setup->sm_peer_nonce, z);
1753 }
1754 
1755 static void sm_sc_prepare_dhkey_check(sm_connection_t * sm_conn){
1756     sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F5_SALT;
1757 }
1758 
1759 static void sm_sc_calculate_f6_for_dhkey_check(sm_connection_t * sm_conn){
1760     // calculate DHKCheck
1761     sm_key56_t bd_addr_master, bd_addr_slave;
1762     bd_addr_master[0] =  setup->sm_m_addr_type;
1763     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1764     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1765     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1766     uint8_t iocap_a[3];
1767     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1768     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1769     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1770     uint8_t iocap_b[3];
1771     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1772     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1773     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1774     if (IS_RESPONDER(sm_conn->sm_role)){
1775         // responder
1776         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1777     } else {
1778         // initiator
1779         f6_engine(sm_conn, setup->sm_mackey, setup->sm_local_nonce, setup->sm_peer_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1780     }
1781 }
1782 
1783 static void sm_sc_calculate_f6_to_verify_dhkey_check(sm_connection_t * sm_conn){
1784     // validate E = f6()
1785     sm_key56_t bd_addr_master, bd_addr_slave;
1786     bd_addr_master[0] =  setup->sm_m_addr_type;
1787     bd_addr_slave[0]  =  setup->sm_s_addr_type;
1788     memcpy(&bd_addr_master[1], setup->sm_m_address, 6);
1789     memcpy(&bd_addr_slave[1],  setup->sm_s_address, 6);
1790 
1791     uint8_t iocap_a[3];
1792     iocap_a[0] = sm_pairing_packet_get_auth_req(setup->sm_m_preq);
1793     iocap_a[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_m_preq);
1794     iocap_a[2] = sm_pairing_packet_get_io_capability(setup->sm_m_preq);
1795     uint8_t iocap_b[3];
1796     iocap_b[0] = sm_pairing_packet_get_auth_req(setup->sm_s_pres);
1797     iocap_b[1] = sm_pairing_packet_get_oob_data_flag(setup->sm_s_pres);
1798     iocap_b[2] = sm_pairing_packet_get_io_capability(setup->sm_s_pres);
1799     if (IS_RESPONDER(sm_conn->sm_role)){
1800         // responder
1801         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_rb, iocap_a, bd_addr_master, bd_addr_slave);
1802     } else {
1803         // initiator
1804         f6_engine(sm_conn, setup->sm_mackey, setup->sm_peer_nonce, setup->sm_local_nonce, setup->sm_ra, iocap_b, bd_addr_slave, bd_addr_master);
1805     }
1806 }
1807 
1808 
1809 //
1810 // Link Key Conversion Function h6
1811 //
1812 // h6(W, keyID) = AES-CMACW(keyID)
1813 // - W is 128 bits
1814 // - keyID is 32 bits
1815 static void h6_engine(sm_connection_t * sm_conn, const sm_key_t w, const uint32_t key_id){
1816     const uint16_t message_len = 4;
1817     sm_cmac_connection = sm_conn;
1818     big_endian_store_32(sm_cmac_sc_buffer, 0, key_id);
1819     log_info("h6 key");
1820     log_info_hexdump(w, 16);
1821     log_info("h6 message");
1822     log_info_hexdump(sm_cmac_sc_buffer, message_len);
1823     sm_cmac_general_start(w, message_len, &sm_sc_cmac_get_byte, &sm_sc_cmac_done);
1824 }
1825 
1826 // For SC, setup->sm_local_ltk holds full LTK (sm_ltk is already truncated)
1827 // Errata Service Release to the Bluetooth Specification: ESR09
1828 //   E6405 – Cross transport key derivation from a key of size less than 128 bits
1829 //   "Note: When the BR/EDR link key is being derived from the LTK, the derivation is done before the LTK gets masked."
1830 static void h6_calculate_ilk(sm_connection_t * sm_conn){
1831     h6_engine(sm_conn, setup->sm_local_ltk, 0x746D7031);    // "tmp1"
1832 }
1833 
1834 static void h6_calculate_br_edr_link_key(sm_connection_t * sm_conn){
1835     h6_engine(sm_conn, setup->sm_t, 0x6c656272);    // "lebr"
1836 }
1837 
1838 #endif
1839 
1840 // key management legacy connections:
1841 // - potentially two different LTKs based on direction. each device stores LTK provided by peer
1842 // - master stores LTK, EDIV, RAND. responder optionally stored master LTK (only if it needs to reconnect)
1843 // - initiators reconnects: initiator uses stored LTK, EDIV, RAND generated by responder
1844 // - responder  reconnects: responder uses LTK receveived from master
1845 
1846 // key management secure connections:
1847 // - both devices store same LTK from ECDH key exchange.
1848 
1849 #if defined(ENABLE_LE_SECURE_CONNECTIONS) || defined(ENABLE_LE_CENTRAL)
1850 static void sm_load_security_info(sm_connection_t * sm_connection){
1851     int encryption_key_size;
1852     int authenticated;
1853     int authorized;
1854 
1855     // fetch data from device db - incl. authenticated/authorized/key size. Note all sm_connection_X require encryption enabled
1856     le_device_db_encryption_get(sm_connection->sm_le_db_index, &setup->sm_peer_ediv, setup->sm_peer_rand, setup->sm_peer_ltk,
1857                                 &encryption_key_size, &authenticated, &authorized);
1858     log_info("db index %u, key size %u, authenticated %u, authorized %u", sm_connection->sm_le_db_index, encryption_key_size, authenticated, authorized);
1859     sm_connection->sm_actual_encryption_key_size = encryption_key_size;
1860     sm_connection->sm_connection_authenticated = authenticated;
1861     sm_connection->sm_connection_authorization_state = authorized ? AUTHORIZATION_GRANTED : AUTHORIZATION_UNKNOWN;
1862 }
1863 #endif
1864 
1865 #ifdef ENABLE_LE_PERIPHERAL
1866 static void sm_start_calculating_ltk_from_ediv_and_rand(sm_connection_t * sm_connection){
1867     memcpy(setup->sm_local_rand, sm_connection->sm_local_rand, 8);
1868     setup->sm_local_ediv = sm_connection->sm_local_ediv;
1869     // re-establish used key encryption size
1870     // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
1871     sm_connection->sm_actual_encryption_key_size = (setup->sm_local_rand[7] & 0x0f) + 1;
1872     // no db for authenticated flag hack: flag is stored in bit 4 of LSB
1873     sm_connection->sm_connection_authenticated = (setup->sm_local_rand[7] & 0x10) >> 4;
1874     log_info("sm: received ltk request with key size %u, authenticated %u",
1875             sm_connection->sm_actual_encryption_key_size, sm_connection->sm_connection_authenticated);
1876     sm_connection->sm_engine_state = SM_RESPONDER_PH4_Y_GET_ENC;
1877 }
1878 #endif
1879 
1880 static void sm_run(void){
1881 
1882     btstack_linked_list_iterator_t it;
1883 
1884     // assert that we can send at least commands
1885     if (!hci_can_send_command_packet_now()) return;
1886 
1887     //
1888     // non-connection related behaviour
1889     //
1890 
1891     // distributed key generation
1892     switch (dkg_state){
1893         case DKG_CALC_IRK:
1894             // already busy?
1895             if (sm_aes128_state == SM_AES128_IDLE) {
1896                 // IRK = d1(IR, 1, 0)
1897                 sm_key_t d1_prime;
1898                 sm_d1_d_prime(1, 0, d1_prime);  // plaintext
1899                 dkg_next_state();
1900                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
1901                 return;
1902             }
1903             break;
1904         case DKG_CALC_DHK:
1905             // already busy?
1906             if (sm_aes128_state == SM_AES128_IDLE) {
1907                 // DHK = d1(IR, 3, 0)
1908                 sm_key_t d1_prime;
1909                 sm_d1_d_prime(3, 0, d1_prime);  // plaintext
1910                 dkg_next_state();
1911                 sm_aes128_start(sm_persistent_ir, d1_prime, NULL);
1912                 return;
1913             }
1914             break;
1915         default:
1916             break;
1917     }
1918 
1919 #ifdef ENABLE_LE_SECURE_CONNECTIONS
1920     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
1921 #ifndef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
1922         sm_random_start(NULL);
1923 #else
1924         ec_key_generation_state = EC_KEY_GENERATION_W4_KEY;
1925         hci_send_cmd(&hci_le_read_local_p256_public_key);
1926 #endif
1927         return;
1928     }
1929 #endif
1930 
1931     // random address updates
1932     switch (rau_state){
1933         case RAU_GET_RANDOM:
1934             rau_next_state();
1935             sm_random_start(NULL);
1936             return;
1937         case RAU_GET_ENC:
1938             // already busy?
1939             if (sm_aes128_state == SM_AES128_IDLE) {
1940                 sm_key_t r_prime;
1941                 sm_ah_r_prime(sm_random_address, r_prime);
1942                 rau_next_state();
1943                 sm_aes128_start(sm_persistent_irk, r_prime, NULL);
1944                 return;
1945             }
1946             break;
1947         case RAU_SET_ADDRESS:
1948             log_info("New random address: %s", bd_addr_to_str(sm_random_address));
1949             rau_state = RAU_IDLE;
1950             hci_send_cmd(&hci_le_set_random_address, sm_random_address);
1951             return;
1952         default:
1953             break;
1954     }
1955 
1956 #ifdef ENABLE_CMAC_ENGINE
1957     // CMAC
1958     switch (sm_cmac_state){
1959         case CMAC_CALC_SUBKEYS:
1960         case CMAC_CALC_MI:
1961         case CMAC_CALC_MLAST:
1962             // already busy?
1963             if (sm_aes128_state == SM_AES128_ACTIVE) break;
1964             sm_cmac_handle_aes_engine_ready();
1965             return;
1966         default:
1967             break;
1968     }
1969 #endif
1970 
1971     // CSRK Lookup
1972     // -- if csrk lookup ready, find connection that require csrk lookup
1973     if (sm_address_resolution_idle()){
1974         hci_connections_get_iterator(&it);
1975         while(btstack_linked_list_iterator_has_next(&it)){
1976             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1977             sm_connection_t  * sm_connection  = &hci_connection->sm_connection;
1978             if (sm_connection->sm_irk_lookup_state == IRK_LOOKUP_W4_READY){
1979                 // and start lookup
1980                 sm_address_resolution_start_lookup(sm_connection->sm_peer_addr_type, sm_connection->sm_handle, sm_connection->sm_peer_address, ADDRESS_RESOLUTION_FOR_CONNECTION, sm_connection);
1981                 sm_connection->sm_irk_lookup_state = IRK_LOOKUP_STARTED;
1982                 break;
1983             }
1984         }
1985     }
1986 
1987     // -- if csrk lookup ready, resolved addresses for received addresses
1988     if (sm_address_resolution_idle()) {
1989         if (!btstack_linked_list_empty(&sm_address_resolution_general_queue)){
1990             sm_lookup_entry_t * entry = (sm_lookup_entry_t *) sm_address_resolution_general_queue;
1991             btstack_linked_list_remove(&sm_address_resolution_general_queue, (btstack_linked_item_t *) entry);
1992             sm_address_resolution_start_lookup(entry->address_type, 0, entry->address, ADDRESS_RESOLUTION_GENERAL, NULL);
1993             btstack_memory_sm_lookup_entry_free(entry);
1994         }
1995     }
1996 
1997     // -- Continue with CSRK device lookup by public or resolvable private address
1998     if (!sm_address_resolution_idle()){
1999         log_info("LE Device Lookup: device %u/%u", sm_address_resolution_test, le_device_db_count());
2000         while (sm_address_resolution_test < le_device_db_count()){
2001             int addr_type;
2002             bd_addr_t addr;
2003             sm_key_t irk;
2004             le_device_db_info(sm_address_resolution_test, &addr_type, addr, irk);
2005             log_info("device type %u, addr: %s", addr_type, bd_addr_to_str(addr));
2006 
2007             if (sm_address_resolution_addr_type == addr_type && memcmp(addr, sm_address_resolution_address, 6) == 0){
2008                 log_info("LE Device Lookup: found CSRK by { addr_type, address} ");
2009                 sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
2010                 break;
2011             }
2012 
2013             if (sm_address_resolution_addr_type == 0){
2014                 sm_address_resolution_test++;
2015                 continue;
2016             }
2017 
2018             if (sm_aes128_state == SM_AES128_ACTIVE) break;
2019 
2020             log_info("LE Device Lookup: calculate AH");
2021             log_info_key("IRK", irk);
2022 
2023             sm_key_t r_prime;
2024             sm_ah_r_prime(sm_address_resolution_address, r_prime);
2025             sm_address_resolution_ah_calculation_active = 1;
2026             sm_aes128_start(irk, r_prime, sm_address_resolution_context);   // keep context
2027             return;
2028         }
2029 
2030         if (sm_address_resolution_test >= le_device_db_count()){
2031             log_info("LE Device Lookup: not found");
2032             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_FAILED);
2033         }
2034     }
2035 
2036     // handle basic actions that don't requires the full context
2037     hci_connections_get_iterator(&it);
2038     while((sm_active_connection_handle == HCI_CON_HANDLE_INVALID) && btstack_linked_list_iterator_has_next(&it)){
2039         hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
2040         sm_connection_t  * sm_connection = &hci_connection->sm_connection;
2041         switch(sm_connection->sm_engine_state){
2042             // responder side
2043             case SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY:
2044                 sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
2045                 hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
2046                 return;
2047 
2048 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2049             case SM_SC_RECEIVED_LTK_REQUEST:
2050                 switch (sm_connection->sm_irk_lookup_state){
2051                     case IRK_LOOKUP_FAILED:
2052                         log_info("LTK Request: ediv & random are empty, but no stored LTK (IRK Lookup Failed)");
2053                         sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
2054                         hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
2055                         return;
2056                     default:
2057                         break;
2058                 }
2059                 break;
2060 #endif
2061             default:
2062                 break;
2063         }
2064     }
2065 
2066     //
2067     // active connection handling
2068     // -- use loop to handle next connection if lock on setup context is released
2069 
2070     while (1) {
2071 
2072         // Find connections that requires setup context and make active if no other is locked
2073         hci_connections_get_iterator(&it);
2074         while((sm_active_connection_handle == HCI_CON_HANDLE_INVALID) && btstack_linked_list_iterator_has_next(&it)){
2075             hci_connection_t * hci_connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
2076             sm_connection_t  * sm_connection = &hci_connection->sm_connection;
2077             // - if no connection locked and we're ready/waiting for setup context, fetch it and start
2078             int done = 1;
2079             int err;
2080             UNUSED(err);
2081             switch (sm_connection->sm_engine_state) {
2082 #ifdef ENABLE_LE_PERIPHERAL
2083                 case SM_RESPONDER_SEND_SECURITY_REQUEST:
2084                     // send packet if possible,
2085                     if (l2cap_can_send_fixed_channel_packet_now(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)){
2086                         const uint8_t buffer[2] = { SM_CODE_SECURITY_REQUEST, SM_AUTHREQ_BONDING};
2087                         sm_connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_REQUEST;
2088                         l2cap_send_connectionless(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2089                     } else {
2090                         l2cap_request_can_send_fix_channel_now_event(sm_connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
2091                     }
2092                     // don't lock sxetup context yet
2093                     done = 0;
2094                     break;
2095                 case SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED:
2096                     sm_reset_setup();
2097                     sm_init_setup(sm_connection);
2098                     // recover pairing request
2099                     memcpy(&setup->sm_m_preq, &sm_connection->sm_m_preq, sizeof(sm_pairing_packet_t));
2100                     err = sm_stk_generation_init(sm_connection);
2101                     if (err){
2102                         setup->sm_pairing_failed_reason = err;
2103                         sm_connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
2104                         break;
2105                     }
2106                     sm_timeout_start(sm_connection);
2107                     // generate random number first, if we need to show passkey
2108                     if (setup->sm_stk_generation_method == PK_INIT_INPUT){
2109                         sm_connection->sm_engine_state = SM_PH2_GET_RANDOM_TK;
2110                         break;
2111                     }
2112                     sm_connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
2113                     break;
2114                 case SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST:
2115                     sm_reset_setup();
2116                     sm_start_calculating_ltk_from_ediv_and_rand(sm_connection);
2117                     break;
2118 #endif
2119 #ifdef ENABLE_LE_CENTRAL
2120                 case SM_INITIATOR_PH0_HAS_LTK:
2121                     sm_reset_setup();
2122                     sm_load_security_info(sm_connection);
2123                     sm_connection->sm_engine_state = SM_INITIATOR_PH0_SEND_START_ENCRYPTION;
2124                     break;
2125                 case SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST:
2126                     sm_reset_setup();
2127                     sm_init_setup(sm_connection);
2128                     sm_timeout_start(sm_connection);
2129                     sm_connection->sm_engine_state = SM_INITIATOR_PH1_SEND_PAIRING_REQUEST;
2130                     break;
2131 #endif
2132 
2133 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2134                 case SM_SC_RECEIVED_LTK_REQUEST:
2135                     switch (sm_connection->sm_irk_lookup_state){
2136                         case IRK_LOOKUP_SUCCEEDED:
2137                             // assuming Secure Connection, we have a stored LTK and the EDIV/RAND are null
2138                             // start using context by loading security info
2139                             sm_reset_setup();
2140                             sm_load_security_info(sm_connection);
2141                             if (setup->sm_peer_ediv == 0 && sm_is_null_random(setup->sm_peer_rand) && !sm_is_null_key(setup->sm_peer_ltk)){
2142                                 memcpy(setup->sm_ltk, setup->sm_peer_ltk, 16);
2143                                 sm_connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK_REPLY;
2144                                 break;
2145                             }
2146                             log_info("LTK Request: ediv & random are empty, but no stored LTK (IRK Lookup Succeeded)");
2147                             sm_connection->sm_engine_state = SM_RESPONDER_IDLE;
2148                             hci_send_cmd(&hci_le_long_term_key_negative_reply, sm_connection->sm_handle);
2149                             // don't lock setup context yet
2150                             return;
2151                         default:
2152                             // just wait until IRK lookup is completed
2153                             // don't lock setup context yet
2154                             done = 0;
2155                             break;
2156                     }
2157                     break;
2158 #endif
2159                 default:
2160                     done = 0;
2161                     break;
2162             }
2163             if (done){
2164                 sm_active_connection_handle = sm_connection->sm_handle;
2165                 log_info("sm: connection 0x%04x locked setup context as %s, state %u", sm_active_connection_handle, sm_connection->sm_role ? "responder" : "initiator", sm_connection->sm_engine_state);
2166             }
2167         }
2168 
2169         //
2170         // active connection handling
2171         //
2172 
2173         if (sm_active_connection_handle == HCI_CON_HANDLE_INVALID) return;
2174 
2175         // assert that we could send a SM PDU - not needed for all of the following
2176         if (!l2cap_can_send_fixed_channel_packet_now(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL)) {
2177             log_info("cannot send now, requesting can send now event");
2178             l2cap_request_can_send_fix_channel_now_event(sm_active_connection_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
2179             return;
2180         }
2181 
2182         sm_connection_t * connection = sm_get_connection_for_handle(sm_active_connection_handle);
2183         if (!connection) {
2184             log_info("no connection for handle 0x%04x", sm_active_connection_handle);
2185             return;
2186         }
2187 
2188         // send keypress notifications
2189         if (setup->sm_keypress_notification != 0xff){
2190             uint8_t buffer[2];
2191             buffer[0] = SM_CODE_KEYPRESS_NOTIFICATION;
2192             buffer[1] = setup->sm_keypress_notification;
2193             setup->sm_keypress_notification = 0xff;
2194             l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2195             return;
2196         }
2197 
2198         sm_key_t plaintext;
2199         int key_distribution_flags;
2200         UNUSED(key_distribution_flags);
2201 
2202         log_info("sm_run: state %u", connection->sm_engine_state);
2203 
2204         switch (connection->sm_engine_state){
2205 
2206             // general
2207             case SM_GENERAL_SEND_PAIRING_FAILED: {
2208                 uint8_t buffer[2];
2209                 buffer[0] = SM_CODE_PAIRING_FAILED;
2210                 buffer[1] = setup->sm_pairing_failed_reason;
2211                 connection->sm_engine_state = connection->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
2212                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2213                 sm_done_for_handle(connection->sm_handle);
2214                 break;
2215             }
2216 
2217             // responding state
2218 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2219             case SM_SC_W2_GET_RANDOM_A:
2220                 sm_random_start(connection);
2221                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_A;
2222                 break;
2223             case SM_SC_W2_GET_RANDOM_B:
2224                 sm_random_start(connection);
2225                 connection->sm_engine_state = SM_SC_W4_GET_RANDOM_B;
2226                 break;
2227             case SM_SC_W2_CMAC_FOR_CONFIRMATION:
2228                 if (!sm_cmac_ready()) break;
2229                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CONFIRMATION;
2230                 sm_sc_calculate_local_confirm(connection);
2231                 break;
2232             case SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION:
2233                 if (!sm_cmac_ready()) break;
2234                 connection->sm_engine_state = SM_SC_W4_CMAC_FOR_CHECK_CONFIRMATION;
2235                 sm_sc_calculate_remote_confirm(connection);
2236                 break;
2237             case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
2238                 if (!sm_cmac_ready()) break;
2239                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK;
2240                 sm_sc_calculate_f6_for_dhkey_check(connection);
2241                 break;
2242             case SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK:
2243                 if (!sm_cmac_ready()) break;
2244                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
2245                 sm_sc_calculate_f6_to_verify_dhkey_check(connection);
2246                 break;
2247             case SM_SC_W2_CALCULATE_F5_SALT:
2248                 if (!sm_cmac_ready()) break;
2249                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_SALT;
2250                 f5_calculate_salt(connection);
2251                 break;
2252             case SM_SC_W2_CALCULATE_F5_MACKEY:
2253                 if (!sm_cmac_ready()) break;
2254                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_MACKEY;
2255                 f5_calculate_mackey(connection);
2256                 break;
2257             case SM_SC_W2_CALCULATE_F5_LTK:
2258                 if (!sm_cmac_ready()) break;
2259                 connection->sm_engine_state = SM_SC_W4_CALCULATE_F5_LTK;
2260                 f5_calculate_ltk(connection);
2261                 break;
2262             case SM_SC_W2_CALCULATE_G2:
2263                 if (!sm_cmac_ready()) break;
2264                 connection->sm_engine_state = SM_SC_W4_CALCULATE_G2;
2265                 g2_calculate(connection);
2266                 break;
2267             case SM_SC_W2_CALCULATE_H6_ILK:
2268                 if (!sm_cmac_ready()) break;
2269                 connection->sm_engine_state = SM_SC_W4_CALCULATE_H6_ILK;
2270                 h6_calculate_ilk(connection);
2271                 break;
2272             case SM_SC_W2_CALCULATE_H6_BR_EDR_LINK_KEY:
2273                 if (!sm_cmac_ready()) break;
2274                 connection->sm_engine_state = SM_SC_W4_CALCULATE_H6_BR_EDR_LINK_KEY;
2275                 h6_calculate_br_edr_link_key(connection);
2276                 break;
2277 #endif
2278 
2279 #ifdef ENABLE_LE_CENTRAL
2280             // initiator side
2281             case SM_INITIATOR_PH0_SEND_START_ENCRYPTION: {
2282                 sm_key_t peer_ltk_flipped;
2283                 reverse_128(setup->sm_peer_ltk, peer_ltk_flipped);
2284                 connection->sm_engine_state = SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED;
2285                 log_info("sm: hci_le_start_encryption ediv 0x%04x", setup->sm_peer_ediv);
2286                 uint32_t rand_high = big_endian_read_32(setup->sm_peer_rand, 0);
2287                 uint32_t rand_low  = big_endian_read_32(setup->sm_peer_rand, 4);
2288                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle,rand_low, rand_high, setup->sm_peer_ediv, peer_ltk_flipped);
2289                 return;
2290             }
2291 
2292             case SM_INITIATOR_PH1_SEND_PAIRING_REQUEST:
2293                 sm_pairing_packet_set_code(setup->sm_m_preq, SM_CODE_PAIRING_REQUEST);
2294                 connection->sm_engine_state = SM_INITIATOR_PH1_W4_PAIRING_RESPONSE;
2295                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_m_preq, sizeof(sm_pairing_packet_t));
2296                 sm_timeout_reset(connection);
2297                 break;
2298 #endif
2299 
2300 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2301 
2302             case SM_SC_SEND_PUBLIC_KEY_COMMAND: {
2303                 uint8_t buffer[65];
2304                 buffer[0] = SM_CODE_PAIRING_PUBLIC_KEY;
2305                 //
2306                 reverse_256(&ec_q[0],  &buffer[1]);
2307                 reverse_256(&ec_q[32], &buffer[33]);
2308 
2309                 // stk generation method
2310                 // passkey entry: notify app to show passkey or to request passkey
2311                 switch (setup->sm_stk_generation_method){
2312                     case JUST_WORKS:
2313                     case NK_BOTH_INPUT:
2314                         if (IS_RESPONDER(connection->sm_role)){
2315                             // responder
2316                             sm_sc_start_calculating_local_confirm(connection);
2317                         } else {
2318                             // initiator
2319                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2320                         }
2321                         break;
2322                     case PK_INIT_INPUT:
2323                     case PK_RESP_INPUT:
2324                     case OK_BOTH_INPUT:
2325                         // use random TK for display
2326                         memcpy(setup->sm_ra, setup->sm_tk, 16);
2327                         memcpy(setup->sm_rb, setup->sm_tk, 16);
2328                         setup->sm_passkey_bit = 0;
2329 
2330                         if (IS_RESPONDER(connection->sm_role)){
2331                             // responder
2332                             connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2333                         } else {
2334                             // initiator
2335                             connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2336                         }
2337                         sm_trigger_user_response(connection);
2338                         break;
2339                     case OOB:
2340                         // TODO: implement SC OOB
2341                         break;
2342                 }
2343 
2344                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2345                 sm_timeout_reset(connection);
2346                 break;
2347             }
2348             case SM_SC_SEND_CONFIRMATION: {
2349                 uint8_t buffer[17];
2350                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2351                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2352                 if (IS_RESPONDER(connection->sm_role)){
2353                     connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2354                 } else {
2355                     connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2356                 }
2357                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2358                 sm_timeout_reset(connection);
2359                 break;
2360             }
2361             case SM_SC_SEND_PAIRING_RANDOM: {
2362                 uint8_t buffer[17];
2363                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2364                 reverse_128(setup->sm_local_nonce, &buffer[1]);
2365                 if (setup->sm_stk_generation_method != JUST_WORKS && setup->sm_stk_generation_method != NK_BOTH_INPUT && setup->sm_passkey_bit < 20){
2366                     if (IS_RESPONDER(connection->sm_role)){
2367                         // responder
2368                         connection->sm_engine_state = SM_SC_W4_CONFIRMATION;
2369                     } else {
2370                         // initiator
2371                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2372                     }
2373                 } else {
2374                     if (IS_RESPONDER(connection->sm_role)){
2375                         // responder
2376                         if (setup->sm_stk_generation_method == NK_BOTH_INPUT){
2377                             connection->sm_engine_state = SM_SC_W2_CALCULATE_G2;
2378                         } else {
2379                             sm_sc_prepare_dhkey_check(connection);
2380                         }
2381                     } else {
2382                         // initiator
2383                         connection->sm_engine_state = SM_SC_W4_PAIRING_RANDOM;
2384                     }
2385                 }
2386                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2387                 sm_timeout_reset(connection);
2388                 break;
2389             }
2390             case SM_SC_SEND_DHKEY_CHECK_COMMAND: {
2391                 uint8_t buffer[17];
2392                 buffer[0] = SM_CODE_PAIRING_DHKEY_CHECK;
2393                 reverse_128(setup->sm_local_dhkey_check, &buffer[1]);
2394 
2395                 if (IS_RESPONDER(connection->sm_role)){
2396                     connection->sm_engine_state = SM_SC_W4_LTK_REQUEST_SC;
2397                 } else {
2398                     connection->sm_engine_state = SM_SC_W4_DHKEY_CHECK_COMMAND;
2399                 }
2400 
2401                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2402                 sm_timeout_reset(connection);
2403                 break;
2404             }
2405 
2406 #endif
2407 
2408 #ifdef ENABLE_LE_PERIPHERAL
2409             case SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE:
2410                 // echo initiator for now
2411                 sm_pairing_packet_set_code(setup->sm_s_pres,SM_CODE_PAIRING_RESPONSE);
2412                 key_distribution_flags = sm_key_distribution_flags_for_auth_req();
2413 
2414                 if (setup->sm_use_secure_connections){
2415                     connection->sm_engine_state = SM_SC_W4_PUBLIC_KEY_COMMAND;
2416                     // skip LTK/EDIV for SC
2417                     log_info("sm: dropping encryption information flag");
2418                     key_distribution_flags &= ~SM_KEYDIST_ENC_KEY;
2419                 } else {
2420                     connection->sm_engine_state = SM_RESPONDER_PH1_W4_PAIRING_CONFIRM;
2421                 }
2422 
2423                 sm_pairing_packet_set_initiator_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_initiator_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2424                 sm_pairing_packet_set_responder_key_distribution(setup->sm_s_pres, sm_pairing_packet_get_responder_key_distribution(setup->sm_m_preq) & key_distribution_flags);
2425                 // update key distribution after ENC was dropped
2426                 sm_setup_key_distribution(sm_pairing_packet_get_responder_key_distribution(setup->sm_s_pres));
2427 
2428                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) &setup->sm_s_pres, sizeof(sm_pairing_packet_t));
2429                 sm_timeout_reset(connection);
2430                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
2431                 if (!setup->sm_use_secure_connections || setup->sm_stk_generation_method == JUST_WORKS){
2432                     sm_trigger_user_response(connection);
2433                 }
2434                 return;
2435 #endif
2436 
2437             case SM_PH2_SEND_PAIRING_RANDOM: {
2438                 uint8_t buffer[17];
2439                 buffer[0] = SM_CODE_PAIRING_RANDOM;
2440                 reverse_128(setup->sm_local_random, &buffer[1]);
2441                 if (IS_RESPONDER(connection->sm_role)){
2442                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_LTK_REQUEST;
2443                 } else {
2444                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_RANDOM;
2445                 }
2446                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2447                 sm_timeout_reset(connection);
2448                 break;
2449             }
2450 
2451             case SM_PH2_GET_RANDOM_TK:
2452             case SM_PH2_C1_GET_RANDOM_A:
2453             case SM_PH2_C1_GET_RANDOM_B:
2454             case SM_PH3_GET_RANDOM:
2455             case SM_PH3_GET_DIV:
2456                 sm_next_responding_state(connection);
2457                 sm_random_start(connection);
2458                 return;
2459 
2460             case SM_PH2_C1_GET_ENC_B:
2461             case SM_PH2_C1_GET_ENC_D:
2462                 // already busy?
2463                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2464                 sm_next_responding_state(connection);
2465                 sm_aes128_start(setup->sm_tk, setup->sm_c1_t3_value, connection);
2466                 return;
2467 
2468             case SM_PH3_LTK_GET_ENC:
2469             case SM_RESPONDER_PH4_LTK_GET_ENC:
2470                 // already busy?
2471                 if (sm_aes128_state == SM_AES128_IDLE) {
2472                     sm_key_t d_prime;
2473                     sm_d1_d_prime(setup->sm_local_div, 0, d_prime);
2474                     sm_next_responding_state(connection);
2475                     sm_aes128_start(sm_persistent_er, d_prime, connection);
2476                     return;
2477                 }
2478                 break;
2479 
2480             case SM_PH3_CSRK_GET_ENC:
2481                 // already busy?
2482                 if (sm_aes128_state == SM_AES128_IDLE) {
2483                     sm_key_t d_prime;
2484                     sm_d1_d_prime(setup->sm_local_div, 1, d_prime);
2485                     sm_next_responding_state(connection);
2486                     sm_aes128_start(sm_persistent_er, d_prime, connection);
2487                     return;
2488                 }
2489                 break;
2490 
2491             case SM_PH2_C1_GET_ENC_C:
2492                 // already busy?
2493                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2494                 // calculate m_confirm using aes128 engine - step 1
2495                 sm_c1_t1(setup->sm_peer_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
2496                 sm_next_responding_state(connection);
2497                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2498                 break;
2499             case SM_PH2_C1_GET_ENC_A:
2500                 // already busy?
2501                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2502                 // calculate confirm using aes128 engine - step 1
2503                 sm_c1_t1(setup->sm_local_random, (uint8_t*) &setup->sm_m_preq, (uint8_t*) &setup->sm_s_pres, setup->sm_m_addr_type, setup->sm_s_addr_type, plaintext);
2504                 sm_next_responding_state(connection);
2505                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2506                 break;
2507             case SM_PH2_CALC_STK:
2508                 // already busy?
2509                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2510                 // calculate STK
2511                 if (IS_RESPONDER(connection->sm_role)){
2512                     sm_s1_r_prime(setup->sm_local_random, setup->sm_peer_random, plaintext);
2513                 } else {
2514                     sm_s1_r_prime(setup->sm_peer_random, setup->sm_local_random, plaintext);
2515                 }
2516                 sm_next_responding_state(connection);
2517                 sm_aes128_start(setup->sm_tk, plaintext, connection);
2518                 break;
2519             case SM_PH3_Y_GET_ENC:
2520                 // already busy?
2521                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2522                 // PH3B2 - calculate Y from      - enc
2523                 // Y = dm(DHK, Rand)
2524                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
2525                 sm_next_responding_state(connection);
2526                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
2527                 return;
2528             case SM_PH2_C1_SEND_PAIRING_CONFIRM: {
2529                 uint8_t buffer[17];
2530                 buffer[0] = SM_CODE_PAIRING_CONFIRM;
2531                 reverse_128(setup->sm_local_confirm, &buffer[1]);
2532                 if (IS_RESPONDER(connection->sm_role)){
2533                     connection->sm_engine_state = SM_RESPONDER_PH2_W4_PAIRING_RANDOM;
2534                 } else {
2535                     connection->sm_engine_state = SM_INITIATOR_PH2_W4_PAIRING_CONFIRM;
2536                 }
2537                 l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2538                 sm_timeout_reset(connection);
2539                 return;
2540             }
2541 #ifdef ENABLE_LE_PERIPHERAL
2542             case SM_RESPONDER_PH2_SEND_LTK_REPLY: {
2543                 sm_key_t stk_flipped;
2544                 reverse_128(setup->sm_ltk, stk_flipped);
2545                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2546                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, stk_flipped);
2547                 return;
2548             }
2549             case SM_RESPONDER_PH4_SEND_LTK_REPLY: {
2550                 sm_key_t ltk_flipped;
2551                 reverse_128(setup->sm_ltk, ltk_flipped);
2552                 connection->sm_engine_state = SM_RESPONDER_IDLE;
2553                 hci_send_cmd(&hci_le_long_term_key_request_reply, connection->sm_handle, ltk_flipped);
2554                 return;
2555             }
2556             case SM_RESPONDER_PH4_Y_GET_ENC:
2557                 // already busy?
2558                 if (sm_aes128_state == SM_AES128_ACTIVE) break;
2559                 log_info("LTK Request: recalculating with ediv 0x%04x", setup->sm_local_ediv);
2560                 // Y = dm(DHK, Rand)
2561                 sm_dm_r_prime(setup->sm_local_rand, plaintext);
2562                 sm_next_responding_state(connection);
2563                 sm_aes128_start(sm_persistent_dhk, plaintext, connection);
2564                 return;
2565 #endif
2566 #ifdef ENABLE_LE_CENTRAL
2567             case SM_INITIATOR_PH3_SEND_START_ENCRYPTION: {
2568                 sm_key_t stk_flipped;
2569                 reverse_128(setup->sm_ltk, stk_flipped);
2570                 connection->sm_engine_state = SM_PH2_W4_CONNECTION_ENCRYPTED;
2571                 hci_send_cmd(&hci_le_start_encryption, connection->sm_handle, 0, 0, 0, stk_flipped);
2572                 return;
2573             }
2574 #endif
2575 
2576             case SM_PH3_DISTRIBUTE_KEYS:
2577                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION){
2578                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
2579                     uint8_t buffer[17];
2580                     buffer[0] = SM_CODE_ENCRYPTION_INFORMATION;
2581                     reverse_128(setup->sm_ltk, &buffer[1]);
2582                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2583                     sm_timeout_reset(connection);
2584                     return;
2585                 }
2586                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_MASTER_IDENTIFICATION){
2587                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
2588                     uint8_t buffer[11];
2589                     buffer[0] = SM_CODE_MASTER_IDENTIFICATION;
2590                     little_endian_store_16(buffer, 1, setup->sm_local_ediv);
2591                     reverse_64(setup->sm_local_rand, &buffer[3]);
2592                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2593                     sm_timeout_reset(connection);
2594                     return;
2595                 }
2596                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_INFORMATION){
2597                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
2598                     uint8_t buffer[17];
2599                     buffer[0] = SM_CODE_IDENTITY_INFORMATION;
2600                     reverse_128(sm_persistent_irk, &buffer[1]);
2601                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2602                     sm_timeout_reset(connection);
2603                     return;
2604                 }
2605                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION){
2606                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
2607                     bd_addr_t local_address;
2608                     uint8_t buffer[8];
2609                     buffer[0] = SM_CODE_IDENTITY_ADDRESS_INFORMATION;
2610                     gap_le_get_own_address(&buffer[1], local_address);
2611                     reverse_bd_addr(local_address, &buffer[2]);
2612                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2613                     sm_timeout_reset(connection);
2614                     return;
2615                 }
2616                 if (setup->sm_key_distribution_send_set &   SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION){
2617                     setup->sm_key_distribution_send_set &= ~SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
2618 
2619                     // hack to reproduce test runs
2620                     if (test_use_fixed_local_csrk){
2621                         memset(setup->sm_local_csrk, 0xcc, 16);
2622                     }
2623 
2624                     uint8_t buffer[17];
2625                     buffer[0] = SM_CODE_SIGNING_INFORMATION;
2626                     reverse_128(setup->sm_local_csrk, &buffer[1]);
2627                     l2cap_send_connectionless(connection->sm_handle, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, (uint8_t*) buffer, sizeof(buffer));
2628                     sm_timeout_reset(connection);
2629                     return;
2630                 }
2631 
2632                 // keys are sent
2633                 if (IS_RESPONDER(connection->sm_role)){
2634                     // slave -> receive master keys if any
2635                     if (sm_key_distribution_all_received(connection)){
2636                         sm_key_distribution_handle_all_received(connection);
2637                         connection->sm_engine_state = SM_RESPONDER_IDLE;
2638                         sm_done_for_handle(connection->sm_handle);
2639                     } else {
2640                         connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2641                     }
2642                 } else {
2643                     // master -> all done
2644                     connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2645                     sm_done_for_handle(connection->sm_handle);
2646                 }
2647                 break;
2648 
2649             default:
2650                 break;
2651         }
2652 
2653         // check again if active connection was released
2654         if (sm_active_connection_handle != HCI_CON_HANDLE_INVALID) break;
2655     }
2656 }
2657 
2658 // note: aes engine is ready as we just got the aes result
2659 static void sm_handle_encryption_result(uint8_t * data){
2660 
2661     sm_aes128_state = SM_AES128_IDLE;
2662 
2663     if (sm_address_resolution_ah_calculation_active){
2664         sm_address_resolution_ah_calculation_active = 0;
2665         // compare calulated address against connecting device
2666         uint8_t hash[3];
2667         reverse_24(data, hash);
2668         if (memcmp(&sm_address_resolution_address[3], hash, 3) == 0){
2669             log_info("LE Device Lookup: matched resolvable private address");
2670             sm_address_resolution_handle_event(ADDRESS_RESOLUTION_SUCEEDED);
2671             return;
2672         }
2673         // no match, try next
2674         sm_address_resolution_test++;
2675         return;
2676     }
2677 
2678     switch (dkg_state){
2679         case DKG_W4_IRK:
2680             reverse_128(data, sm_persistent_irk);
2681             log_info_key("irk", sm_persistent_irk);
2682             dkg_next_state();
2683             return;
2684         case DKG_W4_DHK:
2685             reverse_128(data, sm_persistent_dhk);
2686             log_info_key("dhk", sm_persistent_dhk);
2687             dkg_next_state();
2688             // SM Init Finished
2689             return;
2690         default:
2691             break;
2692     }
2693 
2694     switch (rau_state){
2695         case RAU_W4_ENC:
2696             reverse_24(data, &sm_random_address[3]);
2697             rau_next_state();
2698             return;
2699         default:
2700             break;
2701     }
2702 
2703 #ifdef ENABLE_CMAC_ENGINE
2704     switch (sm_cmac_state){
2705         case CMAC_W4_SUBKEYS:
2706         case CMAC_W4_MI:
2707         case CMAC_W4_MLAST:
2708             {
2709             sm_key_t t;
2710             reverse_128(data, t);
2711             sm_cmac_handle_encryption_result(t);
2712             }
2713             return;
2714         default:
2715             break;
2716     }
2717 #endif
2718 
2719     // retrieve sm_connection provided to sm_aes128_start_encryption
2720     sm_connection_t * connection = (sm_connection_t*) sm_aes128_context;
2721     if (!connection) return;
2722     switch (connection->sm_engine_state){
2723         case SM_PH2_C1_W4_ENC_A:
2724         case SM_PH2_C1_W4_ENC_C:
2725             {
2726             sm_key_t t2;
2727             reverse_128(data, t2);
2728             sm_c1_t3(t2, setup->sm_m_address, setup->sm_s_address, setup->sm_c1_t3_value);
2729             }
2730             sm_next_responding_state(connection);
2731             return;
2732         case SM_PH2_C1_W4_ENC_B:
2733             reverse_128(data, setup->sm_local_confirm);
2734             log_info_key("c1!", setup->sm_local_confirm);
2735             connection->sm_engine_state = SM_PH2_C1_SEND_PAIRING_CONFIRM;
2736             return;
2737         case SM_PH2_C1_W4_ENC_D:
2738             {
2739             sm_key_t peer_confirm_test;
2740             reverse_128(data, peer_confirm_test);
2741             log_info_key("c1!", peer_confirm_test);
2742             if (memcmp(setup->sm_peer_confirm, peer_confirm_test, 16) != 0){
2743                 setup->sm_pairing_failed_reason = SM_REASON_CONFIRM_VALUE_FAILED;
2744                 connection->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
2745                 return;
2746             }
2747             if (IS_RESPONDER(connection->sm_role)){
2748                 connection->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
2749             } else {
2750                 connection->sm_engine_state = SM_PH2_CALC_STK;
2751             }
2752             }
2753             return;
2754         case SM_PH2_W4_STK:
2755             reverse_128(data, setup->sm_ltk);
2756             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2757             log_info_key("stk", setup->sm_ltk);
2758             if (IS_RESPONDER(connection->sm_role)){
2759                 connection->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
2760             } else {
2761                 connection->sm_engine_state = SM_INITIATOR_PH3_SEND_START_ENCRYPTION;
2762             }
2763             return;
2764         case SM_PH3_Y_W4_ENC:{
2765             sm_key_t y128;
2766             reverse_128(data, y128);
2767             setup->sm_local_y = big_endian_read_16(y128, 14);
2768             log_info_hex16("y", setup->sm_local_y);
2769             // PH3B3 - calculate EDIV
2770             setup->sm_local_ediv = setup->sm_local_y ^ setup->sm_local_div;
2771             log_info_hex16("ediv", setup->sm_local_ediv);
2772             // PH3B4 - calculate LTK         - enc
2773             // LTK = d1(ER, DIV, 0))
2774             connection->sm_engine_state = SM_PH3_LTK_GET_ENC;
2775             return;
2776         }
2777         case SM_RESPONDER_PH4_Y_W4_ENC:{
2778             sm_key_t y128;
2779             reverse_128(data, y128);
2780             setup->sm_local_y = big_endian_read_16(y128, 14);
2781             log_info_hex16("y", setup->sm_local_y);
2782 
2783             // PH3B3 - calculate DIV
2784             setup->sm_local_div = setup->sm_local_y ^ setup->sm_local_ediv;
2785             log_info_hex16("ediv", setup->sm_local_ediv);
2786             // PH3B4 - calculate LTK         - enc
2787             // LTK = d1(ER, DIV, 0))
2788             connection->sm_engine_state = SM_RESPONDER_PH4_LTK_GET_ENC;
2789             return;
2790         }
2791         case SM_PH3_LTK_W4_ENC:
2792             reverse_128(data, setup->sm_ltk);
2793             log_info_key("ltk", setup->sm_ltk);
2794             // calc CSRK next
2795             connection->sm_engine_state = SM_PH3_CSRK_GET_ENC;
2796             return;
2797         case SM_PH3_CSRK_W4_ENC:
2798             reverse_128(data, setup->sm_local_csrk);
2799             log_info_key("csrk", setup->sm_local_csrk);
2800             if (setup->sm_key_distribution_send_set){
2801                 connection->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
2802             } else {
2803                 // no keys to send, just continue
2804                 if (IS_RESPONDER(connection->sm_role)){
2805                     // slave -> receive master keys
2806                     connection->sm_engine_state = SM_PH3_RECEIVE_KEYS;
2807                 } else {
2808                     if (setup->sm_use_secure_connections && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION)){
2809                         connection->sm_engine_state = SM_SC_W2_CALCULATE_H6_ILK;
2810                     } else {
2811                         // master -> all done
2812                         connection->sm_engine_state = SM_INITIATOR_CONNECTED;
2813                         sm_done_for_handle(connection->sm_handle);
2814                     }
2815                 }
2816             }
2817             return;
2818 #ifdef ENABLE_LE_PERIPHERAL
2819         case SM_RESPONDER_PH4_LTK_W4_ENC:
2820             reverse_128(data, setup->sm_ltk);
2821             sm_truncate_key(setup->sm_ltk, connection->sm_actual_encryption_key_size);
2822             log_info_key("ltk", setup->sm_ltk);
2823             connection->sm_engine_state = SM_RESPONDER_PH4_SEND_LTK_REPLY;
2824             return;
2825 #endif
2826         default:
2827             break;
2828     }
2829 }
2830 
2831 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2832 #ifndef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
2833 #if !defined(WICED_VERSION) || defined(USE_MBEDTLS_FOR_ECDH)
2834 // @return OK
2835 static int sm_generate_f_rng(unsigned char * buffer, unsigned size){
2836     if (ec_key_generation_state != EC_KEY_GENERATION_ACTIVE) return 0;
2837     int offset = setup->sm_passkey_bit;
2838     log_info("sm_generate_f_rng: size %u - offset %u", (int) size, offset);
2839     while (size) {
2840         *buffer++ = setup->sm_peer_q[offset++];
2841         size--;
2842     }
2843     setup->sm_passkey_bit = offset;
2844     return 1;
2845 }
2846 #endif
2847 #ifdef USE_MBEDTLS_FOR_ECDH
2848 // @return error
2849 static int sm_generate_f_rng_mbedtls(void * context, unsigned char * buffer, size_t size){
2850     UNUSED(context);
2851     return sm_generate_f_rng(buffer, size) == 1;
2852 }
2853 #endif
2854 #endif
2855 #endif
2856 
2857 // note: random generator is ready. this doesn NOT imply that aes engine is unused!
2858 static void sm_handle_random_result(uint8_t * data){
2859 
2860 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2861 #ifndef HAVE_HCI_CONTROLLER_DHKEY_SUPPORT
2862 
2863     if (ec_key_generation_state == EC_KEY_GENERATION_ACTIVE){
2864         int num_bytes = setup->sm_passkey_bit;
2865         memcpy(&setup->sm_peer_q[num_bytes], data, 8);
2866         num_bytes += 8;
2867         setup->sm_passkey_bit = num_bytes;
2868 
2869         if (num_bytes >= 64){
2870 
2871             // init pre-generated random data from sm_peer_q
2872             setup->sm_passkey_bit = 0;
2873 
2874             // generate EC key
2875 #ifdef USE_MBEDTLS_FOR_ECDH
2876             mbedtls_mpi d;
2877             mbedtls_ecp_point P;
2878             mbedtls_mpi_init(&d);
2879             mbedtls_ecp_point_init(&P);
2880             int res = mbedtls_ecp_gen_keypair(&mbedtls_ec_group, &d, &P, &sm_generate_f_rng_mbedtls, NULL);
2881             log_info("gen keypair %x", res);
2882             mbedtls_mpi_write_binary(&P.X, &ec_q[0],  32);
2883             mbedtls_mpi_write_binary(&P.Y, &ec_q[32], 32);
2884             mbedtls_mpi_write_binary(&d, ec_d, 32);
2885             mbedtls_ecp_point_free(&P);
2886             mbedtls_mpi_free(&d);
2887 #endif
2888 
2889 #ifdef USE_MICROECC_FOR_ECDH
2890 
2891 #ifndef WICED_VERSION
2892             // micro-ecc from WICED SDK uses its wiced_crypto_get_random by default - no need to set it
2893             uECC_set_rng(&sm_generate_f_rng);
2894 #endif /* WICED_VERSION */
2895 
2896 #if uECC_SUPPORTS_secp256r1
2897             // standard version
2898             uECC_make_key(ec_q, ec_d, uECC_secp256r1());
2899 #else
2900             // static version
2901             uECC_make_key(ec_q, ec_d);
2902 #endif /* USE_MICROECC_FOR_ECDH */
2903 
2904 #ifndef WICED_VERSION
2905             // disable rng generator as we don't have any random bits left
2906             // we can do this because we don't generate another key
2907             // we need to to this because shared key calculation fails if rng returns 0
2908             uECC_set_rng(NULL);
2909 #endif /* WICED_VERSION */
2910 
2911 #endif /* USE_MICROECC_FOR_ECDH */
2912 
2913             ec_key_generation_state = EC_KEY_GENERATION_DONE;
2914             log_info("Elliptic curve: d");
2915             log_info_hexdump(ec_d,32);
2916             sm_log_ec_keypair();
2917         }
2918     }
2919 #endif
2920 #endif
2921 
2922     switch (rau_state){
2923         case RAU_W4_RANDOM:
2924             // non-resolvable vs. resolvable
2925             switch (gap_random_adress_type){
2926                 case GAP_RANDOM_ADDRESS_RESOLVABLE:
2927                     // resolvable: use random as prand and calc address hash
2928                     // "The two most significant bits of prand shall be equal to ‘0’ and ‘1"
2929                     memcpy(sm_random_address, data, 3);
2930                     sm_random_address[0] &= 0x3f;
2931                     sm_random_address[0] |= 0x40;
2932                     rau_state = RAU_GET_ENC;
2933                     break;
2934                 case GAP_RANDOM_ADDRESS_NON_RESOLVABLE:
2935                 default:
2936                     // "The two most significant bits of the address shall be equal to ‘0’""
2937                     memcpy(sm_random_address, data, 6);
2938                     sm_random_address[0] &= 0x3f;
2939                     rau_state = RAU_SET_ADDRESS;
2940                     break;
2941             }
2942             return;
2943         default:
2944             break;
2945     }
2946 
2947     // retrieve sm_connection provided to sm_random_start
2948     sm_connection_t * connection = (sm_connection_t *) sm_random_context;
2949     if (!connection) return;
2950     switch (connection->sm_engine_state){
2951 #ifdef ENABLE_LE_SECURE_CONNECTIONS
2952         case SM_SC_W4_GET_RANDOM_A:
2953             memcpy(&setup->sm_local_nonce[0], data, 8);
2954             connection->sm_engine_state = SM_SC_W2_GET_RANDOM_B;
2955             break;
2956         case SM_SC_W4_GET_RANDOM_B:
2957             memcpy(&setup->sm_local_nonce[8], data, 8);
2958             // initiator & jw/nc -> send pairing random
2959             if (connection->sm_role == 0 && sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
2960                 connection->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
2961                 break;
2962             } else {
2963                 connection->sm_engine_state = SM_SC_W2_CMAC_FOR_CONFIRMATION;
2964             }
2965             break;
2966 #endif
2967 
2968         case SM_PH2_W4_RANDOM_TK:
2969         {
2970             // map random to 0-999999 without speding much cycles on a modulus operation
2971             uint32_t tk = little_endian_read_32(data,0);
2972             tk = tk & 0xfffff;  // 1048575
2973             if (tk >= 999999){
2974                 tk = tk - 999999;
2975             }
2976             sm_reset_tk();
2977             big_endian_store_32(setup->sm_tk, 12, tk);
2978             if (IS_RESPONDER(connection->sm_role)){
2979                 connection->sm_engine_state = SM_RESPONDER_PH1_SEND_PAIRING_RESPONSE;
2980             } else {
2981                 if (setup->sm_use_secure_connections){
2982                     connection->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
2983                 } else {
2984                     connection->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
2985                     sm_trigger_user_response(connection);
2986                     // response_idle == nothing <--> sm_trigger_user_response() did not require response
2987                     if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
2988                         connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
2989                     }
2990                 }
2991             }
2992             return;
2993         }
2994         case SM_PH2_C1_W4_RANDOM_A:
2995             memcpy(&setup->sm_local_random[0], data, 8); // random endinaness
2996             connection->sm_engine_state = SM_PH2_C1_GET_RANDOM_B;
2997             return;
2998         case SM_PH2_C1_W4_RANDOM_B:
2999             memcpy(&setup->sm_local_random[8], data, 8); // random endinaness
3000             connection->sm_engine_state = SM_PH2_C1_GET_ENC_A;
3001             return;
3002         case SM_PH3_W4_RANDOM:
3003             reverse_64(data, setup->sm_local_rand);
3004             // no db for encryption size hack: encryption size is stored in lowest nibble of setup->sm_local_rand
3005             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xf0) + (connection->sm_actual_encryption_key_size - 1);
3006             // no db for authenticated flag hack: store flag in bit 4 of LSB
3007             setup->sm_local_rand[7] = (setup->sm_local_rand[7] & 0xef) + (connection->sm_connection_authenticated << 4);
3008             connection->sm_engine_state = SM_PH3_GET_DIV;
3009             return;
3010         case SM_PH3_W4_DIV:
3011             // use 16 bit from random value as div
3012             setup->sm_local_div = big_endian_read_16(data, 0);
3013             log_info_hex16("div", setup->sm_local_div);
3014             connection->sm_engine_state = SM_PH3_Y_GET_ENC;
3015             return;
3016         default:
3017             break;
3018     }
3019 }
3020 
3021 static void sm_event_packet_handler (uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
3022 
3023     UNUSED(channel);
3024     UNUSED(size);
3025 
3026     sm_connection_t  * sm_conn;
3027     hci_con_handle_t con_handle;
3028 
3029     switch (packet_type) {
3030 
3031 		case HCI_EVENT_PACKET:
3032 			switch (hci_event_packet_get_type(packet)) {
3033 
3034                 case BTSTACK_EVENT_STATE:
3035 					// bt stack activated, get started
3036 					if (btstack_event_state_get_state(packet) == HCI_STATE_WORKING){
3037                         log_info("HCI Working!");
3038 
3039                         // set local addr for le device db
3040                         bd_addr_t local_bd_addr;
3041                         gap_local_bd_addr(local_bd_addr);
3042                         le_device_db_set_local_bd_addr(local_bd_addr);
3043 
3044                         dkg_state = sm_persistent_irk_ready ? DKG_CALC_DHK : DKG_CALC_IRK;
3045 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3046                         if (!sm_have_ec_keypair){
3047                             setup->sm_passkey_bit = 0;
3048                             ec_key_generation_state = EC_KEY_GENERATION_ACTIVE;
3049                         }
3050 #endif
3051                         // trigger Random Address generation if requested before
3052                         switch (gap_random_adress_type){
3053                             case GAP_RANDOM_ADDRESS_TYPE_OFF:
3054                                 rau_state = RAU_IDLE;
3055                                 break;
3056                             case GAP_RANDOM_ADDRESS_TYPE_STATIC:
3057                                 rau_state = RAU_SET_ADDRESS;
3058                                 break;
3059                             default:
3060                                 rau_state = RAU_GET_RANDOM;
3061                                 break;
3062                         }
3063                         sm_run();
3064 					}
3065 					break;
3066 
3067                 case HCI_EVENT_LE_META:
3068                     switch (packet[2]) {
3069                         case HCI_SUBEVENT_LE_CONNECTION_COMPLETE:
3070 
3071                             log_info("sm: connected");
3072 
3073                             if (packet[3]) return; // connection failed
3074 
3075                             con_handle = little_endian_read_16(packet, 4);
3076                             sm_conn = sm_get_connection_for_handle(con_handle);
3077                             if (!sm_conn) break;
3078 
3079                             sm_conn->sm_handle = con_handle;
3080                             sm_conn->sm_role = packet[6];
3081                             sm_conn->sm_peer_addr_type = packet[7];
3082                             reverse_bd_addr(&packet[8], sm_conn->sm_peer_address);
3083 
3084                             log_info("New sm_conn, role %s", sm_conn->sm_role ? "slave" : "master");
3085 
3086                             // reset security properties
3087                             sm_conn->sm_connection_encrypted = 0;
3088                             sm_conn->sm_connection_authenticated = 0;
3089                             sm_conn->sm_connection_authorization_state = AUTHORIZATION_UNKNOWN;
3090                             sm_conn->sm_le_db_index = -1;
3091 
3092                             // prepare CSRK lookup (does not involve setup)
3093                             sm_conn->sm_irk_lookup_state = IRK_LOOKUP_W4_READY;
3094 
3095                             // just connected -> everything else happens in sm_run()
3096                             if (IS_RESPONDER(sm_conn->sm_role)){
3097                                 // slave - state already could be SM_RESPONDER_SEND_SECURITY_REQUEST instead
3098                                 if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
3099                                     if (sm_slave_request_security) {
3100                                         // request security if requested by app
3101                                         sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
3102                                     } else {
3103                                         // otherwise, wait for pairing request
3104                                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
3105                                     }
3106                                 }
3107                                 break;
3108                             } else {
3109                                 // master
3110                                 sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
3111                             }
3112                             break;
3113 
3114                         case HCI_SUBEVENT_LE_LONG_TERM_KEY_REQUEST:
3115                             con_handle = little_endian_read_16(packet, 3);
3116                             sm_conn = sm_get_connection_for_handle(con_handle);
3117                             if (!sm_conn) break;
3118 
3119                             log_info("LTK Request: state %u", sm_conn->sm_engine_state);
3120                             if (sm_conn->sm_engine_state == SM_RESPONDER_PH2_W4_LTK_REQUEST){
3121                                 sm_conn->sm_engine_state = SM_PH2_CALC_STK;
3122                                 break;
3123                             }
3124                             if (sm_conn->sm_engine_state == SM_SC_W4_LTK_REQUEST_SC){
3125                                 // PH2 SEND LTK as we need to exchange keys in PH3
3126                                 sm_conn->sm_engine_state = SM_RESPONDER_PH2_SEND_LTK_REPLY;
3127                                 break;
3128                             }
3129 
3130                             // store rand and ediv
3131                             reverse_64(&packet[5], sm_conn->sm_local_rand);
3132                             sm_conn->sm_local_ediv = little_endian_read_16(packet, 13);
3133 
3134                             // For Legacy Pairing (<=> EDIV != 0 || RAND != NULL), we need to recalculated our LTK as a
3135                             // potentially stored LTK is from the master
3136                             if (sm_conn->sm_local_ediv != 0 || !sm_is_null_random(sm_conn->sm_local_rand)){
3137                                 sm_conn->sm_engine_state = SM_RESPONDER_PH0_RECEIVED_LTK_REQUEST;
3138                                 break;
3139                             }
3140 
3141 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3142                             sm_conn->sm_engine_state = SM_SC_RECEIVED_LTK_REQUEST;
3143 #else
3144                             log_info("LTK Request: ediv & random are empty, but LE Secure Connections not supported");
3145                             sm_conn->sm_engine_state = SM_RESPONDER_PH0_SEND_LTK_REQUESTED_NEGATIVE_REPLY;
3146 #endif
3147                             break;
3148 
3149 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3150                         case HCI_SUBEVENT_LE_READ_LOCAL_P256_PUBLIC_KEY_COMPLETE:
3151                             if (hci_subevent_le_read_local_p256_public_key_complete_get_status(packet)){
3152                                 log_error("Read Local P256 Public Key failed");
3153                                 break;
3154                             }
3155                             hci_subevent_le_read_local_p256_public_key_complete_get_dhkey_x(packet, &ec_q[0]);
3156                             hci_subevent_le_read_local_p256_public_key_complete_get_dhkey_y(packet, &ec_q[32]);
3157                             ec_key_generation_state = EC_KEY_GENERATION_DONE;
3158                             sm_log_ec_keypair();
3159                             break;
3160 #endif
3161                         default:
3162                             break;
3163                     }
3164                     break;
3165 
3166                 case HCI_EVENT_ENCRYPTION_CHANGE:
3167                     con_handle = little_endian_read_16(packet, 3);
3168                     sm_conn = sm_get_connection_for_handle(con_handle);
3169                     if (!sm_conn) break;
3170 
3171                     sm_conn->sm_connection_encrypted = packet[5];
3172                     log_info("Encryption state change: %u, key size %u", sm_conn->sm_connection_encrypted,
3173                         sm_conn->sm_actual_encryption_key_size);
3174                     log_info("event handler, state %u", sm_conn->sm_engine_state);
3175                     if (!sm_conn->sm_connection_encrypted) break;
3176                     // continue if part of initial pairing
3177                     switch (sm_conn->sm_engine_state){
3178                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
3179                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
3180                             sm_done_for_handle(sm_conn->sm_handle);
3181                             break;
3182                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
3183                             if (IS_RESPONDER(sm_conn->sm_role)){
3184                                 // slave
3185                                 if (setup->sm_use_secure_connections){
3186                                     sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
3187                                 } else {
3188                                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3189                                 }
3190                             } else {
3191                                 // master
3192                                 if (sm_key_distribution_all_received(sm_conn)){
3193                                     // skip receiving keys as there are none
3194                                     sm_key_distribution_handle_all_received(sm_conn);
3195                                     sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3196                                 } else {
3197                                     sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
3198                                 }
3199                             }
3200                             break;
3201                         default:
3202                             break;
3203                     }
3204                     break;
3205 
3206                 case HCI_EVENT_ENCRYPTION_KEY_REFRESH_COMPLETE:
3207                     con_handle = little_endian_read_16(packet, 3);
3208                     sm_conn = sm_get_connection_for_handle(con_handle);
3209                     if (!sm_conn) break;
3210 
3211                     log_info("Encryption key refresh complete, key size %u", sm_conn->sm_actual_encryption_key_size);
3212                     log_info("event handler, state %u", sm_conn->sm_engine_state);
3213                     // continue if part of initial pairing
3214                     switch (sm_conn->sm_engine_state){
3215                         case SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED:
3216                             sm_conn->sm_engine_state = SM_INITIATOR_CONNECTED;
3217                             sm_done_for_handle(sm_conn->sm_handle);
3218                             break;
3219                         case SM_PH2_W4_CONNECTION_ENCRYPTED:
3220                             if (IS_RESPONDER(sm_conn->sm_role)){
3221                                 // slave
3222                                 sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3223                             } else {
3224                                 // master
3225                                 sm_conn->sm_engine_state = SM_PH3_RECEIVE_KEYS;
3226                             }
3227                             break;
3228                         default:
3229                             break;
3230                     }
3231                     break;
3232 
3233 
3234                 case HCI_EVENT_DISCONNECTION_COMPLETE:
3235                     con_handle = little_endian_read_16(packet, 3);
3236                     sm_done_for_handle(con_handle);
3237                     sm_conn = sm_get_connection_for_handle(con_handle);
3238                     if (!sm_conn) break;
3239 
3240                     // delete stored bonding on disconnect with authentication failure in ph0
3241                     if (sm_conn->sm_role == 0
3242                         && sm_conn->sm_engine_state == SM_INITIATOR_PH0_W4_CONNECTION_ENCRYPTED
3243                         && packet[2] == ERROR_CODE_AUTHENTICATION_FAILURE){
3244                         le_device_db_remove(sm_conn->sm_le_db_index);
3245                     }
3246 
3247                     sm_conn->sm_engine_state = SM_GENERAL_IDLE;
3248                     sm_conn->sm_handle = 0;
3249                     break;
3250 
3251 				case HCI_EVENT_COMMAND_COMPLETE:
3252                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_encrypt)){
3253                         sm_handle_encryption_result(&packet[6]);
3254                         break;
3255                     }
3256                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_le_rand)){
3257                         sm_handle_random_result(&packet[6]);
3258                         break;
3259                     }
3260                     if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_read_bd_addr)){
3261                         // Hack for Nordic nRF5 series that doesn't have public address:
3262                         // - with patches from port/nrf5-zephyr, hci_read_bd_addr returns random static address
3263                         // - we use this as default for advertisements/connections
3264                         if (hci_get_manufacturer() == BLUETOOTH_COMPANY_ID_NORDIC_SEMICONDUCTOR_ASA){
3265                             log_info("nRF5: using (fake) public address as random static address");
3266                             bd_addr_t addr;
3267                             reverse_bd_addr(&packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE + 1], addr);
3268                             gap_random_address_set(addr);
3269                         }
3270                     }
3271                     break;
3272                 default:
3273                     break;
3274 			}
3275             break;
3276         default:
3277             break;
3278 	}
3279 
3280     sm_run();
3281 }
3282 
3283 static inline int sm_calc_actual_encryption_key_size(int other){
3284     if (other < sm_min_encryption_key_size) return 0;
3285     if (other < sm_max_encryption_key_size) return other;
3286     return sm_max_encryption_key_size;
3287 }
3288 
3289 
3290 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3291 static int sm_just_works_or_numeric_comparison(stk_generation_method_t method){
3292     switch (method){
3293         case JUST_WORKS:
3294         case NK_BOTH_INPUT:
3295             return 1;
3296         default:
3297             return 0;
3298     }
3299 }
3300 // responder
3301 
3302 static int sm_passkey_used(stk_generation_method_t method){
3303     switch (method){
3304         case PK_RESP_INPUT:
3305             return 1;
3306         default:
3307             return 0;
3308     }
3309 }
3310 #endif
3311 
3312 /**
3313  * @return ok
3314  */
3315 static int sm_validate_stk_generation_method(void){
3316     // check if STK generation method is acceptable by client
3317     switch (setup->sm_stk_generation_method){
3318         case JUST_WORKS:
3319             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_JUST_WORKS) != 0;
3320         case PK_RESP_INPUT:
3321         case PK_INIT_INPUT:
3322         case OK_BOTH_INPUT:
3323             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_PASSKEY) != 0;
3324         case OOB:
3325             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_OOB) != 0;
3326         case NK_BOTH_INPUT:
3327             return (sm_accepted_stk_generation_methods & SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON) != 0;
3328             return 1;
3329         default:
3330             return 0;
3331     }
3332 }
3333 
3334 static void sm_pdu_handler(uint8_t packet_type, hci_con_handle_t con_handle, uint8_t *packet, uint16_t size){
3335 
3336     UNUSED(size);
3337 
3338     if (packet_type == HCI_EVENT_PACKET && packet[0] == L2CAP_EVENT_CAN_SEND_NOW){
3339         sm_run();
3340     }
3341 
3342     if (packet_type != SM_DATA_PACKET) return;
3343 
3344     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3345     if (!sm_conn) return;
3346 
3347     if (packet[0] == SM_CODE_PAIRING_FAILED){
3348         sm_conn->sm_engine_state = sm_conn->sm_role ? SM_RESPONDER_IDLE : SM_INITIATOR_CONNECTED;
3349         return;
3350     }
3351 
3352     log_debug("sm_pdu_handler: state %u, pdu 0x%02x", sm_conn->sm_engine_state, packet[0]);
3353 
3354     int err;
3355     UNUSED(err);
3356 
3357     if (packet[0] == SM_CODE_KEYPRESS_NOTIFICATION){
3358         uint8_t buffer[5];
3359         buffer[0] = SM_EVENT_KEYPRESS_NOTIFICATION;
3360         buffer[1] = 3;
3361         little_endian_store_16(buffer, 2, con_handle);
3362         buffer[4] = packet[1];
3363         sm_dispatch_event(HCI_EVENT_PACKET, 0, buffer, sizeof(buffer));
3364         return;
3365     }
3366 
3367     switch (sm_conn->sm_engine_state){
3368 
3369         // a sm timeout requries a new physical connection
3370         case SM_GENERAL_TIMEOUT:
3371             return;
3372 
3373 #ifdef ENABLE_LE_CENTRAL
3374 
3375         // Initiator
3376         case SM_INITIATOR_CONNECTED:
3377             if ((packet[0] != SM_CODE_SECURITY_REQUEST) || (sm_conn->sm_role)){
3378                 sm_pdu_received_in_wrong_state(sm_conn);
3379                 break;
3380             }
3381             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_FAILED){
3382                 sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3383                 break;
3384             }
3385             if (sm_conn->sm_irk_lookup_state == IRK_LOOKUP_SUCCEEDED){
3386                 sm_key_t ltk;
3387                 le_device_db_encryption_get(sm_conn->sm_le_db_index, NULL, NULL, ltk, NULL, NULL, NULL);
3388                 if (!sm_is_null_key(ltk)){
3389                     log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3390                     sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3391                 } else {
3392                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3393                 }
3394                 break;
3395             }
3396             // otherwise, store security request
3397             sm_conn->sm_security_request_received = 1;
3398             break;
3399 
3400         case SM_INITIATOR_PH1_W4_PAIRING_RESPONSE:
3401             if (packet[0] != SM_CODE_PAIRING_RESPONSE){
3402                 sm_pdu_received_in_wrong_state(sm_conn);
3403                 break;
3404             }
3405             // store pairing request
3406             memcpy(&setup->sm_s_pres, packet, sizeof(sm_pairing_packet_t));
3407             err = sm_stk_generation_init(sm_conn);
3408             if (err){
3409                 setup->sm_pairing_failed_reason = err;
3410                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3411                 break;
3412             }
3413 
3414             // generate random number first, if we need to show passkey
3415             if (setup->sm_stk_generation_method == PK_RESP_INPUT){
3416                 sm_conn->sm_engine_state = SM_PH2_GET_RANDOM_TK;
3417                 break;
3418             }
3419 
3420 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3421             if (setup->sm_use_secure_connections){
3422                 // SC Numeric Comparison will trigger user response after public keys & nonces have been exchanged
3423                 if (setup->sm_stk_generation_method == JUST_WORKS){
3424                     sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3425                     sm_trigger_user_response(sm_conn);
3426                     if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3427                         sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3428                     }
3429                 } else {
3430                     sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3431                 }
3432                 break;
3433             }
3434 #endif
3435             sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3436             sm_trigger_user_response(sm_conn);
3437             // response_idle == nothing <--> sm_trigger_user_response() did not require response
3438             if (setup->sm_user_response == SM_USER_RESPONSE_IDLE){
3439                 sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3440             }
3441             break;
3442 
3443         case SM_INITIATOR_PH2_W4_PAIRING_CONFIRM:
3444             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3445                 sm_pdu_received_in_wrong_state(sm_conn);
3446                 break;
3447             }
3448 
3449             // store s_confirm
3450             reverse_128(&packet[1], setup->sm_peer_confirm);
3451             sm_conn->sm_engine_state = SM_PH2_SEND_PAIRING_RANDOM;
3452             break;
3453 
3454         case SM_INITIATOR_PH2_W4_PAIRING_RANDOM:
3455             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3456                 sm_pdu_received_in_wrong_state(sm_conn);
3457                 break;;
3458             }
3459 
3460             // received random value
3461             reverse_128(&packet[1], setup->sm_peer_random);
3462             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3463             break;
3464 #endif
3465 
3466 #ifdef ENABLE_LE_PERIPHERAL
3467         // Responder
3468         case SM_RESPONDER_IDLE:
3469         case SM_RESPONDER_SEND_SECURITY_REQUEST:
3470         case SM_RESPONDER_PH1_W4_PAIRING_REQUEST:
3471             if (packet[0] != SM_CODE_PAIRING_REQUEST){
3472                 sm_pdu_received_in_wrong_state(sm_conn);
3473                 break;;
3474             }
3475 
3476             // store pairing request
3477             memcpy(&sm_conn->sm_m_preq, packet, sizeof(sm_pairing_packet_t));
3478             sm_conn->sm_engine_state = SM_RESPONDER_PH1_PAIRING_REQUEST_RECEIVED;
3479             break;
3480 #endif
3481 
3482 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3483         case SM_SC_W4_PUBLIC_KEY_COMMAND:
3484             if (packet[0] != SM_CODE_PAIRING_PUBLIC_KEY){
3485                 sm_pdu_received_in_wrong_state(sm_conn);
3486                 break;
3487             }
3488 
3489             // store public key for DH Key calculation
3490             reverse_256(&packet[01], &setup->sm_peer_q[0]);
3491             reverse_256(&packet[33], &setup->sm_peer_q[32]);
3492 
3493             // validate public key
3494             err = 0;
3495 
3496 #ifdef USE_MBEDTLS_FOR_ECDH
3497             mbedtls_ecp_point Q;
3498             mbedtls_ecp_point_init( &Q );
3499             mbedtls_mpi_read_binary(&Q.X, &setup->sm_peer_q[0], 32);
3500             mbedtls_mpi_read_binary(&Q.Y, &setup->sm_peer_q[32], 32);
3501             mbedtls_mpi_lset(&Q.Z, 1);
3502             err = mbedtls_ecp_check_pubkey(&mbedtls_ec_group, &Q);
3503             mbedtls_ecp_point_free( & Q);
3504 #endif
3505 #ifdef USE_MICROECC_FOR_ECDH
3506 #if uECC_SUPPORTS_secp256r1
3507             // standard version
3508             err = uECC_valid_public_key(setup->sm_peer_q, uECC_secp256r1()) == 0;
3509 #else
3510             // static version
3511             err = uECC_valid_public_key(setup->sm_peer_q) == 0;
3512 #endif
3513 #endif
3514 
3515             if (err){
3516                 log_error("sm: peer public key invalid %x", err);
3517                 // uses "unspecified reason", there is no "public key invalid" error code
3518                 sm_pdu_received_in_wrong_state(sm_conn);
3519                 break;
3520             }
3521 
3522             if (IS_RESPONDER(sm_conn->sm_role)){
3523                 // responder
3524                 sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
3525             } else {
3526                 // initiator
3527                 // stk generation method
3528                 // passkey entry: notify app to show passkey or to request passkey
3529                 switch (setup->sm_stk_generation_method){
3530                     case JUST_WORKS:
3531                     case NK_BOTH_INPUT:
3532                         sm_conn->sm_engine_state = SM_SC_W4_CONFIRMATION;
3533                         break;
3534                     case PK_RESP_INPUT:
3535                         sm_sc_start_calculating_local_confirm(sm_conn);
3536                         break;
3537                     case PK_INIT_INPUT:
3538                     case OK_BOTH_INPUT:
3539                         if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3540                             sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3541                             break;
3542                         }
3543                         sm_sc_start_calculating_local_confirm(sm_conn);
3544                         break;
3545                     case OOB:
3546                         // TODO: implement SC OOB
3547                         break;
3548                 }
3549             }
3550             break;
3551 
3552         case SM_SC_W4_CONFIRMATION:
3553             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3554                 sm_pdu_received_in_wrong_state(sm_conn);
3555                 break;
3556             }
3557             // received confirm value
3558             reverse_128(&packet[1], setup->sm_peer_confirm);
3559 
3560             if (IS_RESPONDER(sm_conn->sm_role)){
3561                 // responder
3562                 if (sm_passkey_used(setup->sm_stk_generation_method)){
3563                     if (setup->sm_user_response != SM_USER_RESPONSE_PASSKEY){
3564                         // still waiting for passkey
3565                         sm_conn->sm_engine_state = SM_SC_W4_USER_RESPONSE;
3566                         break;
3567                     }
3568                 }
3569                 sm_sc_start_calculating_local_confirm(sm_conn);
3570             } else {
3571                 // initiator
3572                 if (sm_just_works_or_numeric_comparison(setup->sm_stk_generation_method)){
3573                     sm_conn->sm_engine_state = SM_SC_W2_GET_RANDOM_A;
3574                 } else {
3575                     sm_conn->sm_engine_state = SM_SC_SEND_PAIRING_RANDOM;
3576                 }
3577             }
3578             break;
3579 
3580         case SM_SC_W4_PAIRING_RANDOM:
3581             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3582                 sm_pdu_received_in_wrong_state(sm_conn);
3583                 break;
3584             }
3585 
3586             // received random value
3587             reverse_128(&packet[1], setup->sm_peer_nonce);
3588 
3589             // validate confirm value if Cb = f4(Pkb, Pka, Nb, z)
3590             // only check for JUST WORK/NC in initiator role AND passkey entry
3591             if (sm_conn->sm_role || sm_passkey_used(setup->sm_stk_generation_method)) {
3592                  sm_conn->sm_engine_state = SM_SC_W2_CMAC_FOR_CHECK_CONFIRMATION;
3593             }
3594 
3595             sm_sc_state_after_receiving_random(sm_conn);
3596             break;
3597 
3598         case SM_SC_W2_CALCULATE_G2:
3599         case SM_SC_W4_CALCULATE_G2:
3600         case SM_SC_W2_CALCULATE_F5_SALT:
3601         case SM_SC_W4_CALCULATE_F5_SALT:
3602         case SM_SC_W2_CALCULATE_F5_MACKEY:
3603         case SM_SC_W4_CALCULATE_F5_MACKEY:
3604         case SM_SC_W2_CALCULATE_F5_LTK:
3605         case SM_SC_W4_CALCULATE_F5_LTK:
3606         case SM_SC_W2_CALCULATE_F6_FOR_DHKEY_CHECK:
3607         case SM_SC_W4_DHKEY_CHECK_COMMAND:
3608         case SM_SC_W4_CALCULATE_F6_FOR_DHKEY_CHECK:
3609             if (packet[0] != SM_CODE_PAIRING_DHKEY_CHECK){
3610                 sm_pdu_received_in_wrong_state(sm_conn);
3611                 break;
3612             }
3613             // store DHKey Check
3614             setup->sm_state_vars |= SM_STATE_VAR_DHKEY_COMMAND_RECEIVED;
3615             reverse_128(&packet[01], setup->sm_peer_dhkey_check);
3616 
3617             // have we been only waiting for dhkey check command?
3618             if (sm_conn->sm_engine_state == SM_SC_W4_DHKEY_CHECK_COMMAND){
3619                 sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_F6_TO_VERIFY_DHKEY_CHECK;
3620             }
3621             break;
3622 #endif
3623 
3624 #ifdef ENABLE_LE_PERIPHERAL
3625         case SM_RESPONDER_PH1_W4_PAIRING_CONFIRM:
3626             if (packet[0] != SM_CODE_PAIRING_CONFIRM){
3627                 sm_pdu_received_in_wrong_state(sm_conn);
3628                 break;
3629             }
3630 
3631             // received confirm value
3632             reverse_128(&packet[1], setup->sm_peer_confirm);
3633 
3634             // notify client to hide shown passkey
3635             if (setup->sm_stk_generation_method == PK_INIT_INPUT){
3636                 sm_notify_client_base(SM_EVENT_PASSKEY_DISPLAY_CANCEL, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address);
3637             }
3638 
3639             // handle user cancel pairing?
3640             if (setup->sm_user_response == SM_USER_RESPONSE_DECLINE){
3641                 setup->sm_pairing_failed_reason = SM_REASON_PASSKEYT_ENTRY_FAILED;
3642                 sm_conn->sm_engine_state = SM_GENERAL_SEND_PAIRING_FAILED;
3643                 break;
3644             }
3645 
3646             // wait for user action?
3647             if (setup->sm_user_response == SM_USER_RESPONSE_PENDING){
3648                 sm_conn->sm_engine_state = SM_PH1_W4_USER_RESPONSE;
3649                 break;
3650             }
3651 
3652             // calculate and send local_confirm
3653             sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
3654             break;
3655 
3656         case SM_RESPONDER_PH2_W4_PAIRING_RANDOM:
3657             if (packet[0] != SM_CODE_PAIRING_RANDOM){
3658                 sm_pdu_received_in_wrong_state(sm_conn);
3659                 break;;
3660             }
3661 
3662             // received random value
3663             reverse_128(&packet[1], setup->sm_peer_random);
3664             sm_conn->sm_engine_state = SM_PH2_C1_GET_ENC_C;
3665             break;
3666 #endif
3667 
3668         case SM_PH3_RECEIVE_KEYS:
3669             switch(packet[0]){
3670                 case SM_CODE_ENCRYPTION_INFORMATION:
3671                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_ENCRYPTION_INFORMATION;
3672                     reverse_128(&packet[1], setup->sm_peer_ltk);
3673                     break;
3674 
3675                 case SM_CODE_MASTER_IDENTIFICATION:
3676                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_MASTER_IDENTIFICATION;
3677                     setup->sm_peer_ediv = little_endian_read_16(packet, 1);
3678                     reverse_64(&packet[3], setup->sm_peer_rand);
3679                     break;
3680 
3681                 case SM_CODE_IDENTITY_INFORMATION:
3682                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_INFORMATION;
3683                     reverse_128(&packet[1], setup->sm_peer_irk);
3684                     break;
3685 
3686                 case SM_CODE_IDENTITY_ADDRESS_INFORMATION:
3687                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION;
3688                     setup->sm_peer_addr_type = packet[1];
3689                     reverse_bd_addr(&packet[2], setup->sm_peer_address);
3690                     break;
3691 
3692                 case SM_CODE_SIGNING_INFORMATION:
3693                     setup->sm_key_distribution_received_set |= SM_KEYDIST_FLAG_SIGNING_IDENTIFICATION;
3694                     reverse_128(&packet[1], setup->sm_peer_csrk);
3695                     break;
3696                 default:
3697                     // Unexpected PDU
3698                     log_info("Unexpected PDU %u in SM_PH3_RECEIVE_KEYS", packet[0]);
3699                     break;
3700             }
3701             // done with key distribution?
3702             if (sm_key_distribution_all_received(sm_conn)){
3703 
3704                 sm_key_distribution_handle_all_received(sm_conn);
3705 
3706                 if (IS_RESPONDER(sm_conn->sm_role)){
3707                     if (setup->sm_use_secure_connections && (setup->sm_key_distribution_received_set & SM_KEYDIST_FLAG_IDENTITY_ADDRESS_INFORMATION)){
3708                         sm_conn->sm_engine_state = SM_SC_W2_CALCULATE_H6_ILK;
3709                     } else {
3710                         sm_conn->sm_engine_state = SM_RESPONDER_IDLE;
3711                         sm_done_for_handle(sm_conn->sm_handle);
3712                     }
3713                 } else {
3714                     if (setup->sm_use_secure_connections){
3715                         sm_conn->sm_engine_state = SM_PH3_DISTRIBUTE_KEYS;
3716                     } else {
3717                         sm_conn->sm_engine_state = SM_PH3_GET_RANDOM;
3718                     }
3719                 }
3720             }
3721             break;
3722         default:
3723             // Unexpected PDU
3724             log_info("Unexpected PDU %u in state %u", packet[0], sm_conn->sm_engine_state);
3725             break;
3726     }
3727 
3728     // try to send preparared packet
3729     sm_run();
3730 }
3731 
3732 // Security Manager Client API
3733 void sm_register_oob_data_callback( int (*get_oob_data_callback)(uint8_t addres_type, bd_addr_t addr, uint8_t * oob_data)){
3734     sm_get_oob_data = get_oob_data_callback;
3735 }
3736 
3737 void sm_add_event_handler(btstack_packet_callback_registration_t * callback_handler){
3738     btstack_linked_list_add_tail(&sm_event_handlers, (btstack_linked_item_t*) callback_handler);
3739 }
3740 
3741 void sm_set_accepted_stk_generation_methods(uint8_t accepted_stk_generation_methods){
3742     sm_accepted_stk_generation_methods = accepted_stk_generation_methods;
3743 }
3744 
3745 void sm_set_encryption_key_size_range(uint8_t min_size, uint8_t max_size){
3746 	sm_min_encryption_key_size = min_size;
3747 	sm_max_encryption_key_size = max_size;
3748 }
3749 
3750 void sm_set_authentication_requirements(uint8_t auth_req){
3751     sm_auth_req = auth_req;
3752 }
3753 
3754 void sm_set_io_capabilities(io_capability_t io_capability){
3755     sm_io_capabilities = io_capability;
3756 }
3757 
3758 #ifdef ENABLE_LE_PERIPHERAL
3759 void sm_set_request_security(int enable){
3760     sm_slave_request_security = enable;
3761 }
3762 #endif
3763 
3764 void sm_set_er(sm_key_t er){
3765     memcpy(sm_persistent_er, er, 16);
3766 }
3767 
3768 void sm_set_ir(sm_key_t ir){
3769     memcpy(sm_persistent_ir, ir, 16);
3770 }
3771 
3772 // Testing support only
3773 void sm_test_set_irk(sm_key_t irk){
3774     memcpy(sm_persistent_irk, irk, 16);
3775     sm_persistent_irk_ready = 1;
3776 }
3777 
3778 void sm_test_use_fixed_local_csrk(void){
3779     test_use_fixed_local_csrk = 1;
3780 }
3781 
3782 void sm_init(void){
3783     // set some (BTstack default) ER and IR
3784     int i;
3785     sm_key_t er;
3786     sm_key_t ir;
3787     for (i=0;i<16;i++){
3788         er[i] = 0x30 + i;
3789         ir[i] = 0x90 + i;
3790     }
3791     sm_set_er(er);
3792     sm_set_ir(ir);
3793     // defaults
3794     sm_accepted_stk_generation_methods = SM_STK_GENERATION_METHOD_JUST_WORKS
3795                                        | SM_STK_GENERATION_METHOD_OOB
3796                                        | SM_STK_GENERATION_METHOD_PASSKEY
3797                                        | SM_STK_GENERATION_METHOD_NUMERIC_COMPARISON;
3798 
3799     sm_max_encryption_key_size = 16;
3800     sm_min_encryption_key_size = 7;
3801 
3802 #ifdef ENABLE_CMAC_ENGINE
3803     sm_cmac_state  = CMAC_IDLE;
3804 #endif
3805     dkg_state = DKG_W4_WORKING;
3806     rau_state = RAU_W4_WORKING;
3807     sm_aes128_state = SM_AES128_IDLE;
3808     sm_address_resolution_test = -1;    // no private address to resolve yet
3809     sm_address_resolution_ah_calculation_active = 0;
3810     sm_address_resolution_mode = ADDRESS_RESOLUTION_IDLE;
3811     sm_address_resolution_general_queue = NULL;
3812 
3813     gap_random_adress_update_period = 15 * 60 * 1000L;
3814     sm_active_connection_handle = HCI_CON_HANDLE_INVALID;
3815 
3816     test_use_fixed_local_csrk = 0;
3817 
3818     // register for HCI Events from HCI
3819     hci_event_callback_registration.callback = &sm_event_packet_handler;
3820     hci_add_event_handler(&hci_event_callback_registration);
3821 
3822     // and L2CAP PDUs + L2CAP_EVENT_CAN_SEND_NOW
3823     l2cap_register_fixed_channel(sm_pdu_handler, L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
3824 
3825 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3826     ec_key_generation_state = EC_KEY_GENERATION_IDLE;
3827 #endif
3828 
3829 #ifdef USE_MBEDTLS_FOR_ECDH
3830 #ifndef HAVE_MALLOC
3831     sm_mbedtls_allocator_init(mbedtls_memory_buffer, sizeof(mbedtls_memory_buffer));
3832 #endif
3833     mbedtls_ecp_group_init(&mbedtls_ec_group);
3834     mbedtls_ecp_group_load(&mbedtls_ec_group, MBEDTLS_ECP_DP_SECP256R1);
3835 #endif
3836 }
3837 
3838 void sm_use_fixed_ec_keypair(uint8_t * qx, uint8_t * qy, uint8_t * d){
3839 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3840     memcpy(&ec_q[0],  qx, 32);
3841     memcpy(&ec_q[32], qy, 32);
3842     memcpy(ec_d, d, 32);
3843     sm_have_ec_keypair = 1;
3844     ec_key_generation_state = EC_KEY_GENERATION_DONE;
3845 #else
3846     UNUSED(qx);
3847     UNUSED(qy);
3848     UNUSED(d);
3849 #endif
3850 }
3851 
3852 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3853 #ifndef USE_MBEDTLS_FOR_ECDH
3854 static void parse_hex(uint8_t * buffer, const char * hex_string){
3855     while (*hex_string){
3856         int high_nibble = nibble_for_char(*hex_string++);
3857         int low_nibble  = nibble_for_char(*hex_string++);
3858         *buffer++       = (high_nibble << 4) | low_nibble;
3859     }
3860 }
3861 #endif
3862 #endif
3863 
3864 void sm_test_use_fixed_ec_keypair(void){
3865 #ifdef ENABLE_LE_SECURE_CONNECTIONS
3866     const char * ec_d_string =  "3f49f6d4a3c55f3874c9b3e3d2103f504aff607beb40b7995899b8a6cd3c1abd";
3867     const char * ec_qx_string = "20b003d2f297be2c5e2c83a7e9f9a5b9eff49111acf4fddbcc0301480e359de6";
3868     const char * ec_qy_string = "dc809c49652aeb6d63329abf5a52155c766345c28fed3024741c8ed01589d28b";
3869 #ifdef USE_MBEDTLS_FOR_ECDH
3870     // use test keypair from spec
3871     mbedtls_mpi x;
3872     mbedtls_mpi_init(&x);
3873     mbedtls_mpi_read_string( &x, 16, ec_d_string);
3874     mbedtls_mpi_write_binary(&x, ec_d, 32);
3875     mbedtls_mpi_read_string( &x, 16, ec_qx_string);
3876     mbedtls_mpi_write_binary(&x, &ec_q[0], 32);
3877     mbedtls_mpi_read_string( &x, 16, ec_qy_string);
3878     mbedtls_mpi_write_binary(&x, &ec_q[32], 32);
3879     mbedtls_mpi_free(&x);
3880 #else
3881     parse_hex(ec_d, ec_d_string);
3882     parse_hex(&ec_q[0],  ec_qx_string);
3883     parse_hex(&ec_q[32], ec_qy_string);
3884 #endif
3885     sm_have_ec_keypair = 1;
3886     ec_key_generation_state = EC_KEY_GENERATION_DONE;
3887 #endif
3888 }
3889 
3890 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle){
3891     hci_connection_t * hci_con = hci_connection_for_handle(con_handle);
3892     if (!hci_con) return NULL;
3893     return &hci_con->sm_connection;
3894 }
3895 
3896 // @returns 0 if not encrypted, 7-16 otherwise
3897 int sm_encryption_key_size(hci_con_handle_t con_handle){
3898     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3899     if (!sm_conn) return 0;     // wrong connection
3900     if (!sm_conn->sm_connection_encrypted) return 0;
3901     return sm_conn->sm_actual_encryption_key_size;
3902 }
3903 
3904 int sm_authenticated(hci_con_handle_t con_handle){
3905     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3906     if (!sm_conn) return 0;     // wrong connection
3907     if (!sm_conn->sm_connection_encrypted) return 0; // unencrypted connection cannot be authenticated
3908     return sm_conn->sm_connection_authenticated;
3909 }
3910 
3911 authorization_state_t sm_authorization_state(hci_con_handle_t con_handle){
3912     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3913     if (!sm_conn) return AUTHORIZATION_UNKNOWN;     // wrong connection
3914     if (!sm_conn->sm_connection_encrypted)               return AUTHORIZATION_UNKNOWN; // unencrypted connection cannot be authorized
3915     if (!sm_conn->sm_connection_authenticated)           return AUTHORIZATION_UNKNOWN; // unauthenticatd connection cannot be authorized
3916     return sm_conn->sm_connection_authorization_state;
3917 }
3918 
3919 static void sm_send_security_request_for_connection(sm_connection_t * sm_conn){
3920     switch (sm_conn->sm_engine_state){
3921         case SM_GENERAL_IDLE:
3922         case SM_RESPONDER_IDLE:
3923             sm_conn->sm_engine_state = SM_RESPONDER_SEND_SECURITY_REQUEST;
3924             sm_run();
3925             break;
3926         default:
3927             break;
3928     }
3929 }
3930 
3931 /**
3932  * @brief Trigger Security Request
3933  */
3934 void sm_send_security_request(hci_con_handle_t con_handle){
3935     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3936     if (!sm_conn) return;
3937     sm_send_security_request_for_connection(sm_conn);
3938 }
3939 
3940 // request pairing
3941 void sm_request_pairing(hci_con_handle_t con_handle){
3942     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3943     if (!sm_conn) return;     // wrong connection
3944 
3945     log_info("sm_request_pairing in role %u, state %u", sm_conn->sm_role, sm_conn->sm_engine_state);
3946     if (IS_RESPONDER(sm_conn->sm_role)){
3947         sm_send_security_request_for_connection(sm_conn);
3948     } else {
3949         // used as a trigger to start central/master/initiator security procedures
3950         uint16_t ediv;
3951         sm_key_t ltk;
3952         if (sm_conn->sm_engine_state == SM_INITIATOR_CONNECTED){
3953             switch (sm_conn->sm_irk_lookup_state){
3954                 case IRK_LOOKUP_FAILED:
3955                     sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3956                     break;
3957                 case IRK_LOOKUP_SUCCEEDED:
3958                         le_device_db_encryption_get(sm_conn->sm_le_db_index, &ediv, NULL, ltk, NULL, NULL, NULL);
3959                         if (!sm_is_null_key(ltk) || ediv){
3960                             log_info("sm: Setting up previous ltk/ediv/rand for device index %u", sm_conn->sm_le_db_index);
3961                             sm_conn->sm_engine_state = SM_INITIATOR_PH0_HAS_LTK;
3962                         } else {
3963                             sm_conn->sm_engine_state = SM_INITIATOR_PH1_W2_SEND_PAIRING_REQUEST;
3964                         }
3965                         break;
3966                 default:
3967                     sm_conn->sm_bonding_requested = 1;
3968                     break;
3969             }
3970         } else if (sm_conn->sm_engine_state == SM_GENERAL_IDLE){
3971             sm_conn->sm_bonding_requested = 1;
3972         }
3973     }
3974     sm_run();
3975 }
3976 
3977 // called by client app on authorization request
3978 void sm_authorization_decline(hci_con_handle_t con_handle){
3979     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3980     if (!sm_conn) return;     // wrong connection
3981     sm_conn->sm_connection_authorization_state = AUTHORIZATION_DECLINED;
3982     sm_notify_client_authorization(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 0);
3983 }
3984 
3985 void sm_authorization_grant(hci_con_handle_t con_handle){
3986     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3987     if (!sm_conn) return;     // wrong connection
3988     sm_conn->sm_connection_authorization_state = AUTHORIZATION_GRANTED;
3989     sm_notify_client_authorization(SM_EVENT_AUTHORIZATION_RESULT, sm_conn->sm_handle, sm_conn->sm_peer_addr_type, sm_conn->sm_peer_address, 1);
3990 }
3991 
3992 // GAP Bonding API
3993 
3994 void sm_bonding_decline(hci_con_handle_t con_handle){
3995     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
3996     if (!sm_conn) return;     // wrong connection
3997     setup->sm_user_response = SM_USER_RESPONSE_DECLINE;
3998 
3999     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
4000         switch (setup->sm_stk_generation_method){
4001             case PK_RESP_INPUT:
4002             case PK_INIT_INPUT:
4003             case OK_BOTH_INPUT:
4004                 sm_pairing_error(sm_conn, SM_GENERAL_SEND_PAIRING_FAILED);
4005                 break;
4006             case NK_BOTH_INPUT:
4007                 sm_pairing_error(sm_conn, SM_REASON_NUMERIC_COMPARISON_FAILED);
4008                 break;
4009             case JUST_WORKS:
4010             case OOB:
4011                 sm_pairing_error(sm_conn, SM_REASON_UNSPECIFIED_REASON);
4012                 break;
4013         }
4014     }
4015     sm_run();
4016 }
4017 
4018 void sm_just_works_confirm(hci_con_handle_t con_handle){
4019     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4020     if (!sm_conn) return;     // wrong connection
4021     setup->sm_user_response = SM_USER_RESPONSE_CONFIRM;
4022     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
4023         if (setup->sm_use_secure_connections){
4024             sm_conn->sm_engine_state = SM_SC_SEND_PUBLIC_KEY_COMMAND;
4025         } else {
4026             sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
4027         }
4028     }
4029 
4030 #ifdef ENABLE_LE_SECURE_CONNECTIONS
4031     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
4032         sm_sc_prepare_dhkey_check(sm_conn);
4033     }
4034 #endif
4035 
4036     sm_run();
4037 }
4038 
4039 void sm_numeric_comparison_confirm(hci_con_handle_t con_handle){
4040     // for now, it's the same
4041     sm_just_works_confirm(con_handle);
4042 }
4043 
4044 void sm_passkey_input(hci_con_handle_t con_handle, uint32_t passkey){
4045     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4046     if (!sm_conn) return;     // wrong connection
4047     sm_reset_tk();
4048     big_endian_store_32(setup->sm_tk, 12, passkey);
4049     setup->sm_user_response = SM_USER_RESPONSE_PASSKEY;
4050     if (sm_conn->sm_engine_state == SM_PH1_W4_USER_RESPONSE){
4051         sm_conn->sm_engine_state = SM_PH2_C1_GET_RANDOM_A;
4052     }
4053 #ifdef ENABLE_LE_SECURE_CONNECTIONS
4054     memcpy(setup->sm_ra, setup->sm_tk, 16);
4055     memcpy(setup->sm_rb, setup->sm_tk, 16);
4056     if (sm_conn->sm_engine_state == SM_SC_W4_USER_RESPONSE){
4057         sm_sc_start_calculating_local_confirm(sm_conn);
4058     }
4059 #endif
4060     sm_run();
4061 }
4062 
4063 void sm_keypress_notification(hci_con_handle_t con_handle, uint8_t action){
4064     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4065     if (!sm_conn) return;     // wrong connection
4066     if (action > SM_KEYPRESS_PASSKEY_ENTRY_COMPLETED) return;
4067     setup->sm_keypress_notification = action;
4068     sm_run();
4069 }
4070 
4071 /**
4072  * @brief Identify device in LE Device DB
4073  * @param handle
4074  * @returns index from le_device_db or -1 if not found/identified
4075  */
4076 int sm_le_device_index(hci_con_handle_t con_handle ){
4077     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
4078     if (!sm_conn) return -1;
4079     return sm_conn->sm_le_db_index;
4080 }
4081 
4082 static int gap_random_address_type_requires_updates(void){
4083     if (gap_random_adress_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return 0;
4084     if (gap_random_adress_type == GAP_RANDOM_ADDRESS_TYPE_OFF) return 0;
4085     return 1;
4086 }
4087 
4088 static uint8_t own_address_type(void){
4089     switch (gap_random_adress_type){
4090         case GAP_RANDOM_ADDRESS_TYPE_OFF:
4091             return BD_ADDR_TYPE_LE_PUBLIC;
4092         default:
4093             return BD_ADDR_TYPE_LE_RANDOM;
4094     }
4095 }
4096 
4097 // GAP LE API
4098 void gap_random_address_set_mode(gap_random_address_type_t random_address_type){
4099     gap_random_address_update_stop();
4100     gap_random_adress_type = random_address_type;
4101     hci_le_set_own_address_type(own_address_type());
4102     if (!gap_random_address_type_requires_updates()) return;
4103     gap_random_address_update_start();
4104     gap_random_address_trigger();
4105 }
4106 
4107 gap_random_address_type_t gap_random_address_get_mode(void){
4108     return gap_random_adress_type;
4109 }
4110 
4111 void gap_random_address_set_update_period(int period_ms){
4112     gap_random_adress_update_period = period_ms;
4113     if (!gap_random_address_type_requires_updates()) return;
4114     gap_random_address_update_stop();
4115     gap_random_address_update_start();
4116 }
4117 
4118 void gap_random_address_set(bd_addr_t addr){
4119     gap_random_address_set_mode(GAP_RANDOM_ADDRESS_TYPE_STATIC);
4120     memcpy(sm_random_address, addr, 6);
4121     if (rau_state == RAU_W4_WORKING) return;
4122     rau_state = RAU_SET_ADDRESS;
4123     sm_run();
4124 }
4125 
4126 #ifdef ENABLE_LE_PERIPHERAL
4127 /*
4128  * @brief Set Advertisement Paramters
4129  * @param adv_int_min
4130  * @param adv_int_max
4131  * @param adv_type
4132  * @param direct_address_type
4133  * @param direct_address
4134  * @param channel_map
4135  * @param filter_policy
4136  *
4137  * @note own_address_type is used from gap_random_address_set_mode
4138  */
4139 void gap_advertisements_set_params(uint16_t adv_int_min, uint16_t adv_int_max, uint8_t adv_type,
4140     uint8_t direct_address_typ, bd_addr_t direct_address, uint8_t channel_map, uint8_t filter_policy){
4141     hci_le_advertisements_set_params(adv_int_min, adv_int_max, adv_type,
4142         direct_address_typ, direct_address, channel_map, filter_policy);
4143 }
4144 #endif
4145 
4146