esp-idf: [TW#23304] BLE SMP:LE secure connection (passkey) - Bug when set characteristic permissions to ENC_MITM.

Environment

• Development Kit: [ESP32-Wrover-Kit and others]
• Kit version (for WroverKit/PicoKit/DevKitC): [v3]
• IDF version (git rev-parse --short HEAD to get the commit id.): b2ff235b
• Development Env: [Make]
• Operating System: [Ubuntu and MacOS]
• Power Supply: [external 5V]

Problem Description

Example Code: examples/bluetooth/gatt_security_server

Client Device: Various iPhones (6,6+,7,8,X) and Android. Same behaviour with ALL of these devices.

If I change the code to use passkey pairing with MITM:

esp_ble_auth_req_t auth_req = ESP_LE_AUTH_REQ_SC_MITM_BOND;   
esp_ble_io_cap_t iocap = ESP_IO_CAP_OUT;

Everything works as expected. After Rebooting the ESP, my client device is still bonded and can connect/read/write without another pairing.

HOWEVER:

If I additionally change the security permissions of the characteristics to ‘xxx_ENC_MITM’ e.g.

    // Heart Rate Control Point Characteristic Value
    [HRS_IDX_HR_CTNL_PT_VAL]             =
    {{ESP_GATT_AUTO_RSP}, {ESP_UUID_LEN_16, (uint8_t *)&heart_rate_ctrl_point, ESP_GATT_PERM_WRITE_ENC_MITM | ESP_GATT_PERM_READ_ENC_MITM,
      sizeof(uint8_t), sizeof(heart_ctrl_point), (uint8_t *)heart_ctrl_point}},

On the first connect, passkey pairing (le secure) is triggered as expected, and the characteristic can afterwards be accessed.

But then, after rebooting the ESP, the client device CAN NOT access those characteristics any more.

The connection works, but somehow, the connection does not have the MITM flag set and therefore there is an auth error.

The lowlevel error ist:

I (16062) SEC_GATTS_DEMO: ESP_GATTS_CONNECT_EVT
E (18472) BT_GATT: GATT_INSUF_AUTHENTICATION

This worked perfectly with release V2 and release V3 RC1.

I checked the connection with OSX’ packet-logger and it seems the connection does really use MITM and is encrypted. (This is due to the fact, that security is switched on in the GATT CONNECT handler in the example)

Does anybody know/can confirm if this is a bug?

Thank you very much! Boris