I am trying to perform a MitM-Attack for educational purposes on my own BLE Keyboard with help of this Framework:
Mirage (I modified this pull requests further for my own purposes though)

On the process of pairing with the keyboard however, it does work, but after 30s the Keyboard disconnects. I suspect this is because of the SMP Timeout specified in the Bluetooth Core Specs v5.3 page 1599.

My guess is that some SMP Packets that are necessary are not yet implemented and therefor the keyboard runs into the timeout.

Here is a list of the packages in the pairing so far: (C = central, P = peripheral(keyboard))

1. C->P Connect Indication
2. C->P Pairing Request
3. C<-P Pairing Response
4. C->P Sent Pairing Public Key
5. C<-P Rcvd Pairing Public Key
6. C<-P Rcvd Pairing Confirm
7. C->P Sent Pairing Random
8. C<-P Rcvd Pairing Random
9. C->P Sent Pairing DHKey Check
10. C<-P Rcvd Pairing DHKey Check
11. C->P LL_ENC_REQ
12. C<-P LL_ENC_RSP
13. C<-P LL_START_ENC_REQ
14. C->P ??? (can’t see the rest, it’s encrypted)

From the Mirage STD-out I can see the following part:

[INFO]    [13:28:47.991667] Connecting to slave D5:BB:76:E9:2F:A9...
[SUCCESS] [13:28:48.191875] Connected on slave : D5:BB:76:E9:2F:A9
[INFO]    [13:28:48.192579] << BLE - Pairing Request Packet | outOfBand=no | inputOutputCapability=0x3 | authentication=0x1d | maxKeySize=16 | initiatorKeyDistribution=0x3 | responderKeyDistribution=0x3 >>
[SUCCESS] [13:28:48.195843] Started Advertising. Entering WAIT_CONNECTION stage ...
[INFO]    [13:28:48.366898] << BLE - Pairing Response Packet | outOfBand=no | inputOutputCapability=0x2 | authentication=0x1d | maxKeySize=16 | initiatorKeyDistribution=0x2 | responderKeyDistribution=0x3 >>
[INFO]    [13:28:48.378317] << BLE - Public Key Packet | key_x=b'B,xe7x99xedxbexdb%x10Q,Cyx06x16xd4x14<xf8Sxc20Axe8x96xd1*x84xb1Hx1cH' | key_y=b'x10-x95xcc\xc5xe5xcbxb8xa1xbbx01xf4jx97v,xbbxaazx9ex8fx05x03xe8xfe#_Axe0xa6x14' >>
[INFO]    [13:28:48.474534] << BLE - Public Key Packet | key_x=b'x1ax14xf0xc1x01xecx91xf6xfaKx98xf6x81xee,px00x0cxc2P!/Jx9dRx16@Dx83-EL' | key_y=b'_xc7x96_SHx08xe3^Tri[|xxabxa3rxdbVxd9[kxa7#dx96x86xc4Px1fx05' >>
[SUCCESS] [13:28:48.477176] DH Key generated: 8c4a448b660d1b92fa16b9e3f76a0361906c1df5b6ec0e6d0731d554ab9f9430
[INFO]    [13:28:48.478190] << BLE - Pairing Confirm Packet | confirm=dccf1683f7e2858ffdfa16dc9409d500 >>
[INFO]    [13:28:48.567808] << BLE - Pairing Random Packet | random=b51af88ea19933dd2b0da06d2b51e684 >>
[INFO]    [13:28:48.568465] Slave verify Confirm value success!
[INFO]    [13:28:48.568536] Slave deriving LTK
[INFO]    [13:28:48.568913] MacKey: b'xf3xe3xf3xfexeexeeB+Mx08x0exa4AYtxef'
[INFO]    [13:28:48.568951] LTK: b'$x07x13.}wxebtJxf11x13bxabxaaxc3' of type <class 'bytes'>
[INFO]    [13:28:48.568973] Slave sending DH Key Check
[INFO]    [13:28:48.667564] << BLE - DH Key Check | dhkey_check=b'1mxc1x19Sx1b?xb6x19lnx1fpxb4xddx8e' >>
[INFO]    [13:28:48.668536] Slave DH Key Check success!
[INFO]    [13:28:48.668577] Slave Try to encrypt link
[INFO]    [13:28:48.668618] To Slave: << BLE - HCI Start Encryption Request | rand=b'x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00' | ediv=0 | ltk=b'xc3xaaxabbx131xf1Jtxebw}.x13x07$' >>
[INFO]    [13:28:48.966662] From Slave: << BLE - HCI Encryption Change | status=0 | enabled=1 >>
[INFO]    [13:28:48.966706] Slave Encryption success
[INFO]    [13:28:49.016964] Identity Information (from slave) : irk = 70bfab1794b6b66f9b377632286aed52
[INFO]    From Slave: << BLE - Identity Address Information Packet | type=random | address=d5:bb:76:e9:2f:a9 >>
[INFO]    [13:28:49.067104] Sent IRK
[INFO]    [13:28:49.067176] Slave pairing finished
[INFO]    [13:28:49.117132] Connection Parameter Update Request (from slave) : slaveLatency = 20 / timeoutMult = 210 / minInterval = 16 / maxInterval = 20
[INFO]    [13:28:49.117221] Sending a response to slave ...

Since I think the Pairing Request and Pairing Response might be higly relevant for answering of this question, here are the packets sniffed with Sniffle and examined with Wireshark:

Pairing Request:

Pairing Response:

If you have any idea why this pairing won’t “finish”, please let me know