I am using Raspberry Pi 3 with BlueZ v5.5 to communicate with a Bluetooth scale.
Problem: I can pair the scale and communicate with it (read/write characteristics) immediately after pairing. But if I disconnect from the scale, I cannot reconnect back.
What I do on the Raspberry Pi's side:
Here's the output from btmon:
< HCI Command: LE Create Connection (0x08|0x000d) plen 25
Scan interval: 60.000 msec (0x0060)
Scan window: 60.000 msec (0x0060)
Filter policy: White list is not used (0x00)
Peer address type: Public (0x00)
Peer address: MAC ADDRESS
Own address type: Public (0x00)
Min connection interval: 10.00 msec (0x0008)
Max connection interval: 20.00 msec (0x0010)
Connection latency: 0 (0x0000)
Supervision timeout: 6000 msec (0x0258)
Min connection length: 0.000 msec (0x0000)
Max connection length: 0.000 msec (0x0000)
> HCI Event: Command Status (0x0f) plen 4
LE Create Connection (0x08|0x000d) ncmd 1
Status: Success (0x00)
> HCI Event: LE Meta Event (0x3e) plen 19
LE Connection Complete (0x01)
Status: Success (0x00)
Handle: 64
Role: Master (0x00)
Peer address type: Public (0x00)
Peer address: MAC ADDRESS
Connection interval: 18.75 msec (0x000f)
Connection latency: 0 (0x0000)
Supervision timeout: 6000 msec (0x0258)
Master clock accuracy: 0x00
@ MGMT Event: Device Connected (0x000b) plen 37
LE Address: MAC ADDRESS
Flags: 0x00000000
Data length: 24
Flags: 0x06
LE General Discoverable Mode
BR/EDR Not Supported
16-bit Service UUIDs (partial): 1 entry
Weight Scale (0x181d)
Appearance: Weight Scale (0x0c80)
Unknown EIR field 0x1b: 00610601d3ca5d
Service Data (UUID 0x181d):
@ MGMT Event: Device Connected (0x000b) plen 37
LE Address: MAC ADDRESS
Flags: 0x00000000
Data length: 24
Flags: 0x06
LE General Discoverable Mode
BR/EDR Not Supported
16-bit Service UUIDs (partial): 1 entry
Weight Scale (0x181d)
Appearance: Weight Scale (0x0c80)
Unknown EIR field 0x1b: 00610601d3ca5d
Service Data (UUID 0x181d):
< HCI Command: LE Read Remote Used Features (0x08|0x0016) plen 2
Handle: 64
> HCI Event: Command Status (0x0f) plen 4
LE Read Remote Used Features (0x08|0x0016) ncmd 1
Status: Success (0x00)
> HCI Event: LE Meta Event (0x3e) plen 12
LE Read Remote Used Features (0x04)
Status: Success (0x00)
Handle: 64
Features: 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x00
LE Encryption
< HCI Command: LE Start Encryption (0x08|0x0019) plen 28
Handle: 64
Random number: 0x3a0760acb556aa15
Encrypted diversifier: 0xa2f4
Long term key: 1639a13299a91d0000519e1041643419
> HCI Event: Command Status (0x0f) plen 4
LE Start Encryption (0x08|0x0019) ncmd 1
Status: Success (0x00)
> HCI Event: Encryption Change (0x08) plen 4
Status: PIN or Key Missing (0x06)
Handle: 64
Encryption: Disabled (0x00)
< HCI Command: Disconnect (0x01|0x0006) plen 3
Handle: 64
Reason: Authentication Failure (0x05)
> HCI Event: Command Status (0x0f) plen 4
Disconnect (0x01|0x0006) ncmd 1
Status: Success (0x00)
> HCI Event: Disconnect Complete (0x05) plen 4
Status: Success (0x00)
Handle: 64
Reason: Connection Terminated By Local Host (0x16)
@ MGMT Event: Device Disconnected (0x000c) plen 8
LE Address: MAC ADDRESS
Reason: Connection terminated due to authentication failure (0x04)
I have looked through tons of pages and threads but could not solve this issue. Any suggestion would be appreciated. Thanks a lot!
So, the solution was to look closer at SMP pairing packets.
My SMP Pairing Request (from the master) contained the following parameters:
Initiator key distribution: EncKey Sign LinkKey (0x0d)
Responder key distribution: EncKey IdKey Sign LinkKey (0x0f)
The SMP Pairing Response (from the slave) had it differently:
Initiator key distribution: IdKey (0x02)
Responder key distribution: EncKey IdKey (0x03)
So the slave required the IdKey from the master and was serious about it. Instead the BlueZ stack simply ignored the demand and did not provide the IdKey.
The quick fix was to send some hard-coded id key to the slave.