Is Bluetooth OOB pairing really supported in Android?

Question

I am a complete newbie to the world of Android.Please forgive me if my question is too naive.

I have been working on a sample application to realize Bluetooth pairing between a Linux Box (FC-21 running Bluez-5.42) and an Android tablet. I am using NFC to transfer the Bluetooth name, address and OOB data from the PC to Android. I am able to send the above data from PC to Android over NFC (beam to be precise) and I am able to parse and decode all the data at the Android side. With the Bluetooth address of the Linux box available at Android, I can call CreateBond() to pair the Android tablet with Linux Box. I have tested this part and it works as expected.

Now, the problem with this method is that, during Bluetooth pairing Numeric comparison or passkey entry association model is used, which I feel is an aberration to the user experience when he is using NFC to do the pairing. Since I already have the OOB data of the PC, I would like to use the OOB association for pairing such that the user experience is not compromised.

To do this, when I replace CreateBond() with CreateBondOutOfBand() [using reflection], no pairing request is sent from Android to the Linux PC.

       try {
        showLog("Pairing started");
        Method m = bDev.getClass().getMethod("createBondOutOfBand", byte[].class, byte[].class);
        showLog("Found method");
        Boolean flag = (Boolean) m.invoke(bDev, Hash, Rand,(Object[]) null);
        //Method m = bDev.getClass().getMethod("createBond", (Class[]) null);
        //Boolean flag = (Boolean) m.invoke(bDev, (Object[]) null);
        if(flag)
            showLog("Pairing successfully finished.");
        else
            showLog("Pairing failed");
    } catch (Exception e) {
        showLog("Pairing failed.");
    }

I searched online but could not find any concrete evidence that OOB pairing can be implemented in Android.

Further, to check the behavior of native Android, I created a NFC tag with the Bluetooth name, address and OOB data of the Linux box. When I held the tag against the Android tablet, Bluettoth pairing was started but it was still not using OOB association model.

My questions are as follows,

• Is OOB association model really supported on Android?
• If OOB association model is supported, is CreateBondOutOfBand() the API to be used or is there any other API that I need to use?

Any inputs would be greatly appreciated.

Thanks,

Sai

Pollux

Hey, we are facing the exact same problem. Have you found a solution ? – Magee

Hello, I would also want to know if you have found an answer – Syzygy

@Seynorth, ymerdrengene I am sorry, I haven't had the time to look back at this. – Pollux

@Pollux no problem, we finally succeeded using reflexion on Android 7. – Magee

@Magee That's great news! Is it possible to post the code snippet used for the achieving the same? Is there anything wrong in the way I am doing it? – Pollux

Answer 1

According to this,

Android 9 introduces new restrictions on the use of non-SDK interfaces, whether directly, via reflection, or via JNI. These restrictions are applied whenever an app references a non-SDK interface or attempts to obtain its handle using reflection or JNI.

Since createBondOutOfBand() and removeBond() are hidden from public documentation, these methods are restricted from Android 9. Calling these methods using reflection will cause exceptions.

Buchan

Does one of you know why Android doesn't make createBondOutOfBand() public? I have seen that it can be called by NFC Service but someone may want to do Out Of Band pairing by another mean. – Hominoid

Answer 2

I don't use NFC but I use reflection to use createBondOutOfBand. In addition, this code does work on Motorola lineage rom 7.1 (on Moto G4 play and Moto E 2015) and on Samsung official rom 7.0 (Galaxy S6), but does not work on LG G5 or G6 official rom 7.0 (the authentication always fails).

Here is my code (not really different from yours @saai63).

private boolean createBondOutOfBand(final byte[] oobKey) {
    try {
        if (DEBUG) {
            Log.d(LOG_TAG, "createBondOutOfBand entry");
        }

        Class c = Class.forName("android.bluetooth.OobData");
        Constructor constr = c.getConstructor();
        Object oobData = constr.newInstance();
        Method method = c.getMethod("setSecurityManagerTk", byte[].class);
        method.invoke(oobData, oobKey);

        Method m = mBluetoothDevice.getClass().getMethod("createBondOutOfBand", int.class, c);
        boolean res = (boolean)m.invoke(mBluetoothDevice, BluetoothDevice.TRANSPORT_AUTO, oobData);

        if (DEBUG) {
            Log.d(LOG_TAG, "createBondOutOfBand result => " + res);
        }

        return res;

    }
    catch (Exception e) {
        Log.e(LOG_TAG, "Error when calling createBondOutOfBand", e);
        return false;
    }
}

Magee

I have done the test: With an Android 8.1 phone it works. With a 9.0, I get a "NoSuchMethodException". It confirms what "smileqq" told. – Hominoid