nimble/host: Add support for SM debug mode

New syscfg option allows to enable SM debug mode which uses predefined
DH key pair, as per core spec.

nimble/host/src/ble_sm_alg.c

@@ -452,6 +452,19 @@ static const uint8_t ble_sm_alg_dbg_priv_key[32] = {
     0x58, 0x99, 0xb8, 0xa6, 0xcd, 0x3c, 0x1a, 0xbd
 };
 
+#if MYNEWT_VAL(BLE_SM_SC_DEBUG_KEYS)
+static const uint8_t ble_sm_alg_dbg_pub_key[64] = {
+    /* X */
+    0x20, 0xb0, 0x03, 0xd2, 0xf2, 0x97, 0xbe, 0x2c, 0x5e, 0x2c, 0x83, 0xa7,
+    0xe9, 0xf9, 0xa5, 0xb9, 0xef, 0xf4, 0x91, 0x11, 0xac, 0xf4, 0xfd, 0xdb,
+    0xcc, 0x03, 0x01, 0x48, 0x0e, 0x35, 0x9d, 0xe6,
+    /* Y */
+    0xdc, 0x80, 0x9c, 0x49, 0x65, 0x2a, 0xeb, 0x6d, 0x63, 0x32, 0x9a, 0xbf,
+    0x5a, 0x52, 0x15, 0x5c, 0x76, 0x63, 0x45, 0xc2, 0x8f, 0xed, 0x30, 0x24,
+    0x74, 0x1c, 0x8e, 0xd0, 0x15, 0x89, 0xd2, 0x8b,
+};
+#endif
+
 /**
  * pub: 64 bytes
  * priv: 32 bytes
@@ -459,6 +472,11 @@ static const uint8_t ble_sm_alg_dbg_priv_key[32] = {
 int
 ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
 {
+#if MYNEWT_VAL(BLE_SM_SC_DEBUG_KEYS)
+    swap_buf(pub, ble_sm_alg_dbg_pub_key, 32);
+    swap_buf(&pub[32], &ble_sm_alg_dbg_pub_key[32], 32);
+    swap_buf(priv, ble_sm_alg_dbg_priv_key, 32);
+#else
     uint8_t pk[64];
 
     do {
@@ -472,6 +490,7 @@ ble_sm_alg_gen_key_pair(uint8_t *pub, uint8_t *priv)
     swap_buf(pub, pk, 32);
     swap_buf(&pub[32], &pk[32], 32);
     swap_in_place(priv, 32);
+#endif
 
     return 0;
 }

nimble/host/syscfg.yml

@@ -163,6 +163,13 @@ syscfg.defs:
                 0x04: BLE_SM_PAIR_KEY_DIST_SIGN
                 0x08: BLE_SM_PAIR_KEY_DIST_LINK
         value: 0
+    BLE_SM_SC_DEBUG_KEYS:
+        description: >
+            Enable SM debug mode. In this mode SM uses predefined DH key pair as
+            described in Core Specification 5.0, Vol. 3, Part H, 2.3.5.6.1. This
+            allows to decrypt air traffic easily and thus should be only used
+            for debugging.
+        value: 0
 
     # Supported GATT procedures.  By default:
     #     o Notify and indicate are enabled;