1

I am attempting to decrypt some test data that is encrypted by a blueooth module. The bluetooth's firmware is programmed in C, if that matters.

The data encrypted was:

// Test Bytes - 16 bytes
byte[] testInput = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
                    0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f};

// Test key - 16 bytes, 128-bit
byte[] keyBytes = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
                   0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f};

// Test nonce - 13 bytes, 104-bit
byte[] nonce = {0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,
                0x0a,0x0b,0x0c};

Here's the problem. Encrypting the data in C, using AES/CCM, produces an ouput of 16-bytes, with a 4-byte MIC. When I encrypt the data using AES/CCM/NoPadding in Java, the output is also 16 bytes, but has a 8-byte MAC. The terms MAC and MIC are ambiguous, it seems, where MIC is used for bluetooth terminology.

When I encrypt the above testInput in Java, I get the same 16 bytes of output as the C programming encryption. But, due to the MIC and MAC being different lengths, I cannot decrypt the data on either end.

Is there a solution to this?

I have added my Java code:

Cipher cipher = Cipher.getInstance("AES/CCM/NoPadding", "BC");
SecretKeySpec secretKeySpec = new SecretKeySpec(keyBytes, "AES");
IvParameterSpec ivParameterSpec = new IvParameterSpec(nonce);
cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec, ivParameterSpec);
byte[] encrypted = cipher.doFinal(testInput);

// The first 16 bytes print out equivalently with the C-language AES/CCM

Below is an image of my output:

enter image description here

Below is an image of the C output.

enter image description here

BLE Advertising Packet

enter image description here

EDIT: I am using the selected answer, but please look at Matthew Beckler's answer as well. It will provide a bit more depth to the answer, as well as prevent errors later.

4
  • 1
    For bluetooth, the MIC is computed over 3 additional bytes -- 0x00, 0x01, and a byte that is computed from the first byte of the PDU header. Without that byte you can't get the same MIC. Commented Sep 26, 2017 at 19:07
  • @JamesKPolk How do you suggest I pass data back and forth? I've been searching for a solution for days. I'd be extremely grateful if you could assist me further.
    – user5803705
    Commented Sep 26, 2017 at 19:38
  • 1
    First I have to figure out how the MIC was generated/ Commented Sep 26, 2017 at 19:56
  • What are you trying to encrypt? What's the role of Bluetooth in here? Do you want to decrypt BLE packets that are encrypted by pairing or just arbitrary data and you happen to be able to reuse the CCM engine in the BLE chip? The MIC is not an input to the decryption algorithm but rather a signature that should match when the receiver verifies the received data according to the nonce, key and AAD.
    – Emil
    Commented Sep 27, 2017 at 18:27

2 Answers 2

3

I have figured out how to duplicate the BLE-style AES CCM using software crypto libraries on a computer. Many more details are here (https://devzone.nordicsemi.com/f/nordic-q-a/28524/aes-ccm-encryption-by-s132-timeslot-api/137155#137155), but the crux of the issue is that BLE CCM specifies one byte of ADATA ("additional data") that is included in the MAC calculation but not encrypted as part of the payload. The BLE spec says this byte must be equal to the "data channel PDU header's first octet with NESN, SN and MD bits masked to 0". This means that the ADATA byte is one of 0, 1, 2, or 3, based on the two LLID bits of the Data Channel PDU header (which should be available to whichever device is decrypting the payload).

The BLE spec provides this description of the LLID values:

  • 00b = Reserved for future use
  • 01b = LL Data PDU: Continuation fragment of an L2CAP message, or an Empty PDU
  • 10b = LL Data PDU: Start of an L2CAP message or a complete L2CAP message with no fragmentation
  • 11b = LL Control PDU

It seems like you're 99% of the way there with the cipher.updateAAD(new byte[]{0x01}); pointed out in a previous answer. You should be able to pull that 0x01 value from somewhere earlier in the packet structure. You may need to mask away certain bits of a packet byte (& 0xE3 will do it) to find the right byte for the cipher.updateAAD() call.

Hope this helps, I'm happy to answer questions if you need more details.

1
  • Thanks for the post Matt. I currently have it working using the above answer, but I'll see if i can pull that bit out of the advertising packet so if anything changes, then it will still work! Great find!
    – user5803705
    Commented Jun 21, 2018 at 18:00
2

The following Java code will produce the same output as the C code:

import org.bouncycastle.jce.provider.BouncyCastleProvider;

import javax.crypto.Cipher;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import javax.xml.bind.DatatypeConverter;
import java.security.Security;

public class Main {

    // Test Bytes - 16 bytes
    static byte[] testInput = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
            0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f};

    // Test key - 16 bytes, 128-bit
    static byte[] keyBytes = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
            0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f};

    // Test nonce - 13 bytes, 104-bit
    static byte[] nonce = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09,
            0x0a, 0x0b, 0x0c};


    public static void main(String[] args) throws Exception {
        Security.addProvider(new BouncyCastleProvider());
        GCMParameterSpec parameterSpec = new GCMParameterSpec(32, nonce);
        Cipher cipher = Cipher.getInstance("AES/CCM/NoPadding");
        SecretKeySpec secretKeySpec = new SecretKeySpec(keyBytes, "AES");
        cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec, parameterSpec);
        cipher.updateAAD(new byte[]{0x01});
        System.out.println(DatatypeConverter.printHexBinary(cipher.doFinal(testInput)));
    }
}

However, I'm not sure how to find the byte to provide to Cipher.updateAAD(). 0x01 was found by trial and error. Trying to read the Bluetooth 4.0 spec is quite painful. The spec seems to say that the byte is the first byte of the packet header, with 3 of the bits (NESN, SN, MD) forced to zero. The remaining bits I'm still trying to figure out.

4
  • Though 0x01 is the first byte of the header this time around, are we to assume that this should always be the case?
    – user5803705
    Commented Sep 26, 2017 at 21:35
  • @FoxDonut: No, I think there are three possible values, 1, 2, and 3. But the spec is quite confusing. Do you have access to the header? Commented Sep 26, 2017 at 22:10
  • My engineer is in control of the C portion of the code. I'll ask him to send me whatever he can for the header. Anything I should ask for specifically?
    – user5803705
    Commented Sep 26, 2017 at 23:23
  • I'm not sure if it helps, but I added a picture of the advertising packet. I removed all the confidential info, but you'll get the point. I opened up my engineer's file, and you can only see the first 3 lines in the "Advertising Data 0" section, then the full "Advertising Data 1" section. I don't know my way around his IDE, but was able to obtain this much. Let me know if this helps.
    – user5803705
    Commented Sep 27, 2017 at 0:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.