Need help with BLE authorization

Nuki APIs Bluetooth
1

Hi everyone,

I have a Nuki Smart Lock Go with firmware 5.4.6.
I’m trying to write a program to control it using your BLE documentation, but I’m encountering several roadblocks.

Device Details:

  • Model: Smart Lock Go
  • Firmware: 5.4.6
  • Expected Generation: 1st-4th gen (based on model)
  • Actual Service UUID: a92ee300 (not documented a92ee100)
  • PIN: 6 digits (updated from 4 digits in firmware 5.2.2)

Protocol Choice:
Since the device uses service a92ee300 (Ultra protocol) instead of the documented a92ee100 (gen 1-4 protocol), I’m following the Ultra protocol flow as documented.

Current Flow (Ultra Protocol):

  1. :white_check_mark: Exchange public keys (0x0001 → 0x0003)
  2. :white_check_mark: Calculate X25519 shared secret
  3. :white_check_mark: Receive first challenge (0x0004)
  4. :white_check_mark: Send authorization authenticator (0x0005) with HMAC-SHA256
  5. :x: Expected: Receive second challenge (0x0004)
  6. :x: Actual: Receive “0x4c 0x00 0x01 0x71 0xb4” (Authorization Info)
  7. :x: Result: Cannot proceed to authorization data (0x0006)

Error Analysis:

  • Error 0x20: “Returned if the provided authorization id is invalid or the payload could not be decrypted using the shared key for this authorization id”
  • This suggests the device is rejecting my authorization data payload

Questions:

  1. Is the Smart Lock Go (firmware 5.4.6) supposed to use Ultra protocol (a92ee300) or Legacy protocol (a92ee100)?
  2. After sending authorization authenticator (0x0005), should I expect a second challenge (0x0004) or Authorization Info (0x4C)?
  3. If I receive 0x4C instead of a challenge, how should I proceed with the authorization data (0x0006)?
  4. Are there any protocol changes between firmware versions that aren’t reflected in the current documentation?

Reference Implementation:
I’m comparing my implementation with the open-source nuki-cli-main project, which shows the expected Ultra protocol flow.

Please help me identify what I’m doing wrong or if there are documentation gaps.

Best regards,

ungoro

2

Hi ungoro,

As you already found out, all 5th generation devices (i.e. all devices with 5.x.x firmware) are using the “Ultra” protocol. The pairing/authorization flow was changed for 5th generation devices. You may find an example for that flow in the official Smartlock API documentation on page 83.

The Authorization Info is where the authorization flows starts to differ compared to pre 5th generation. After you received that, you need to switch to an encrypted communication for the Authorization Data.

Unfortunately, when originally implementing the nuki-cli I didn’t have a 5th generation device at hand, so I did not implement it properly. I have now added the missing pieces in the code. It was developed against a Pro, but should be the same for a Go.

Let me know if the added code in the nuki-cli is sufficient for you, or if you need any additional help.

Best regards,
Nico