Decrypting BLE LESE traffic in Wireshark fails.
I am sniffing BLE LESC traffic between nRF52849 SoC and my app. I am able to sniff the data but cannot decrypt it. I have tried entering the LTK in Wirehark nRF dropdown menu after selecting SC LTK but it doesn't work.
I have tried to used the LTK is both ways but it didn't work. I have got the LTK from nRF logs in this format 69 DF C6 EC 5B 44 13 6B 80 A6 AB 2F 07 7E A3 9E
And I have tried entering the key in these two sequences.
0x69DFC6EC5B44136B80A6AB2F077EA39E
0x80A6AB2F077EA39E69DFC6EC5B44136B
But the results are same. Which bad MIC.
One more thing that I observed in Wireshark is that the initialization vector in ENC_RES is 8 bytes. in ENC_REQ it is 4 bytes and i believe it be 4 bytes in response as well. but it starts with 00000000. I have pasted the exact values below please check.
LL_ENC_REQ:
Master Session Key Diversifier: 11715665302558257366 (0xa29667853a5ab0d6)
Master Session Initialization Vector: 4243942787 (0xfcf56d83)
LL_ENC_RES:
Slave Session Key Diversifier: 17276284828074169839 (0xefc1b18477d4d5ef)
Slave Session Initialization Vector: 4184769382 (0x00000000f96e8366) (This should be 4 bytes as per BLE specs)
Does this matter?
