Input <Link Password> To Complete Connection Decryption - Excell Wireless Platform Service Manual

EXCELL PRECISION CO., LTD.
12-2-2 Input <LINK PASSWORD> to Complete Connection Decryption
This decryption can be performed only when the H1 bit Connection Password Decryption Required for
Every Connection), as described in the section 12-1-31. Read Bluetooth Mode , is set to 1.
The following tasks must be complete within 10 minutes to complete the connection:
(1). Read "Temporary Key":
For UUID E812 handle write the following Commands :
Read "Temporary Key"
Command (Hex)
9C
(2). Read UUID E812 handle and request decryption of "Temporary Key"
Read UUID E812 handle, then you can get the following return value(s):
"Temporary Key" return
Command Length Sub-Command
(Hex) (Hex) (Hex)
9C 11 02
"Temporary Key" AES128 ECB Encryption
Input (16 bytes)
"Temporary Key"
Decrypt and get "Temporary Key", please refer to the table below:
"Temporary Key" AES128 ECB Decryption
Input (16 bytes)
KK KK KK KK KK KK KK KK KK KK
KK KK KK KK KK KK
(3). Read "Temporary Code":
For UUID E812 handle write the following Commands :
Read "Temporary Code"
Command (Hex)
9C
(4). Read UUID E812 handle and request decryption of "Temporary Code"
Read UUID E812 handle,then you can get the following return value
"Temporary Code" return
Command Length Sub-Command
(Hex) (Hex) (Hex)
9C 11 03
TM
Length (Hex)
01
"Temporary Key" AES128 ECB Encrypted Data (16-byte Type B
Data)
KK KK KK KK KK KK KK KK KK KK KK KK KK KK KK KK
Key (16 bytes)
<LINK PASSWORD>
Key (16 bytes)
<LINK PASSWORD>
Length (Hex)
01
"Temporary Code" AES128 ECB Encrypted Data (16-byte Type B
Data)
NN NN NN NN NN NN NN NN NN NN NN NN NN NN NN NN
58
Sub-Command (Hex)
02
Output (16 bytes)
KK KK KK KK KK KK KK KK KK KK
KK KK KK KK KK KK
Output (16 bytes)
"Temporary Key"
Sub-Command (Hex)
03
ZSME000000026