NFC OOB Pairing Utility/Example

[AGlass0fMilk]

Moving this from internal working group discussions.

Feature proposal:

We can create (perhaps as part of the proposed BLE app framework) utility code that simplifies secure/OOB BLE pairing using Mbed's NFC API.

Security provided by "Just Works" pairing (ie: next to none) is not sufficient in most applications. Further, many IoT devices do not have required I/O to perform secure/OOB pairing otherwise. NFC provides a cost-effective and simple way of performing secure pairing without the need for such extra hardware. Therefore, I think this would be a popular feature if provided "out of the box" by Mbed.

Many of the pieces are already in place and so I think this would be a good feature to put on the roadmap.

[AGlass0fMilk]

@pan- Replied (on internal/private working group discussion):

[AGlass0fMilk]

That's an item that has been regularly discussed by the Mbed team. OOB pairing is certainly the most secure pairing method pre Bluetooth 4.2 and one of the most convenient with all versions of Bluetooth.

@pan- In my case, OOB pairing is needed for MITM protection. Does BLE5 have provisions for MITM without OOB somehow? "Secure pairing" using ECDH encryption doesn't seem to solve this problem.

I'd like to see it on a roadmap but it would require some work ahead from the Mbed team to enable Secure connection support for Cordio in BLE API. It was functional at one point but, I think, it was disabled to use Mbed TLS instead of uECC; that work did not take place.

What do you mean by this? Since the switch to using Mbed-TLS, secure pairing (ie: using ECDH) is no longer functional? What kind of work is involved in fixing this? It seems like we would just need to port Mbed-TLS ECDH to the API expected by Cordio, which shouldn't be too difficult.

My other concern is the number of NFC chip available, what would be the reference platform to develop this feature ?

I know that since Nordic isn't an "official" partner of Mbed anymore, but I think their chips are popular enough to consider using as a reference platform for NFC + Bluetooth pairing. This would also let us use an existing Mbed target (NRF52840_DK) to perform automated testing with minimal effort.

I may be misunderstanding here though, are you talking about NFC secure element chips or something else?

[0Grit]

I thought there was an NDEF record specified specifically for BLE OOB pairing? I think i recall both BLE spec even referring to this and the OOB NDEF record specifying some security stuff.

[0Grit]

But yes I want this.