Communication Protocol

High-Level Communication

General Notes

• All integers seem to be big-endian
• Encryption is based on AES-128-CBC with PKCS7 padding

Handshake

1. Link parameter negotiation (service_id=1, command_id=1)
2. Challenge-response authentication (service_id=1, command_id=19)
3. Bonding parameters negotiation (service_id=1, command_id=15)
4. (Optional) Bonding, if not already bonded (service_id=1, command_id=14)
5. Encrypted commands exchange (e.g. product information discovery, etc.)

Next Steps

Remaining communication is encrypted and constitutes a stream of commands and acknowledgements. Some services are known to use data streams, which are not wrapped in TLVs.

Universal Tags

It seems that some tags are not bound to any specific service or command:

Tag	Description
124	Encryption marker, only known value is 0x01
125	Initialisation vector for AES encryption
126	Ciphertext (AES)
127	Acknowledgement: 4-byte code, e.g. 00 01 86 A0 (100000)

Result Codes

• 100000: OK
• 100001: Failure
• 100002: Request not supported
• 100003: Permission denied
• 100004: System busy
• 100005: Format error
• 100006: Parameter error
• 100007: Out of memory
• 100008: Response timeout
• 100009: Error