Bluetooth: Controller: Missing LL_ENC_RSP after HCI LTK Negative Reply

[rugeGerritsen]

Describe the bug
In the Encryption Start Procedure, for the case when the host does not provide an LTK, the controller is supposed to send an LL_ENC_RSP before sending LL_REJECT_IND or LL_REJECT_EXT_IND.

To Reproduce

1. Modify hci_core.c, le_ltk_request() to always call le_ltk_neg_reply():

//	if (bt_smp_request_ltk(conn, evt->rand, evt->ediv, ltk)) {
//		le_ltk_reply(handle, ltk);
//	} else {
		le_ltk_neg_reply(handle);
//	}

2. Build the peripheral_hr sample
3. Connect and try bonding, expect it to fail.
4. Observe the sniffer log.

Expected behavior
Send LL_ENC_RSP before LL_REJECT_IND. See the MSC in Bluetooth Core Specification v5.1, Vol 6, Part D, Section 6.7, or Part B Section 5.1.3.1.

If encryption is not supported by the Link Layer of the slave, the Link Layer of
the slave shall send an LL_REJECT_IND or LL_REJECT_EXT_IND PDU with
the ErrorCode set to Unsupported Remote Feature / Unsupported LMP
Feature (0x1A).
…
The Link Layer of the slave shall then send an LL_ENC_RSP PDU. The Link
Layer of the slave shall then notify the Host with the Rand and EDIV fields.

Impact
Possible showstopper. Peer devices may cache that the controller does not support encryption, thereby leaving the link unencrypted.

Screenshots or console output

Environment (please complete the following information):
f79fbac

The issue is present in both the legacy and split controller. The issue is also present in Zephyr v.2.0.0

[rugeGerritsen]

@cvinayak, FYI

[carlescufi]

@rugeGerritsen Please specify which controller you are using, legacy or split

[rugeGerritsen]

Updated the bug description to state that this bug is present in 2.0.0, both the legacy and split controller

[cvinayak]

@rugeGerritsen Please try with CONFIG_BT_CTLR_FAST_ENC=y

[carlescufi]

Thanks @rugeGerritsen, this is indeed a bug. It will only be fixed in the split controller.

[rugeGerritsen]

@rugeGerritsen Please try with CONFIG_BT_CTLR_FAST_ENC=y

The bug is not present when CONFIG_BT_CTLR_FAST_ENC=y. This is only enabled in the hci_uart example