User manual

between the master and the slave devices at Frame# 39,591 and 39,600 respectively.
Clicking on the MSC LE LL tab will show the process of encrypting a session link. Clicking on Frame# 39,617
displays the LL_ENC_REQ command from the master to the slave. In the MSC below this command you will see
the data transferred that includes SKD
master
used to generate the LTK. At Frame# 39,623 the slave responds with
LL_ENC_RSP sending SKD
slave
to generate LTK at the master. Up to this point all transmissions are unencrypted. For
this example the slave sends the request to start encryption, LL_START_ENC_REQ, at Frame#39,635. The master
responds with LL_START_ENC_RSP at Frame# 39,639, and finally the slave responds with LL_START_ENC_RSP at
Frame# 36,649. At this point the session link is encrypted.
Figure 14 - MSC link Layer Encryption (BPA 600 low energy capture)
A.1.7.4 Viewing Decrypted Data
In the ComProbe software Frame Display click on the LE BB tab. Search in the Summary pane for Decryption
Initiated = Yes frames. In the example depicted in the following figure, Frame# 39723 is selected. In the Decoder
pane LE BB shows that the decryption was initiated and decryption was successful. In LE Data we see the
Encrypted MIC value. The MIC value is used to authenticate the sender of the data packet to ensure that the data
was sent by a peer device in the link and not by a third party attacker. The actual decrypted data appears between
the Payload Length and the MIC in the packet. This is shown in the Binary pane below the Summary pane.
TELEDYNE LECROY Appendicies
219 Frontline BPA low energy Hardware & Software User Manual