feat(bt/bluedroid): added a VSC to set minimal encryption key size

components/bt/host/bluedroid/Kconfig.in

@@ -54,6 +54,25 @@ config BT_CLASSIC_ENABLED
     help
         For now this option needs "SMP_ENABLE" to be set to yes
 
+choice BT_ENC_KEY_SIZE_CTRL_ENABLED
+    prompt "configure encryption key size"
+    depends on BT_CLASSIC_ENABLED
+    default BT_ENC_KEY_SIZE_CTRL_VSC
+    help
+        This chooses the support status of configuring encryption key size
+
+    config BT_ENC_KEY_SIZE_CTRL_STD
+        depends on (BT_CONTROLLER_DISABLED || (BT_CONTROLLER_ENABLED && SOC_BT_H2C_ENC_KEY_CTRL_ENH_STD_SUPPORTED))
+        bool "Supported by standard HCI command"
+
+    config BT_ENC_KEY_SIZE_CTRL_VSC
+        depends on (BT_CONTROLLER_DISABLED || (BT_CONTROLLER_ENABLED && SOC_BT_H2C_ENC_KEY_CTRL_ENH_VSC_SUPPORTED))
+        bool "Supported by Vendor-specific HCI command"
+
+    config BT_ENC_KEY_SIZE_CTRL_NONE
+        bool "Not supported"
+endchoice
+
 config BT_CLASSIC_BQB_ENABLED
     bool "Host Qualitifcation support for Classic Bluetooth"
     depends on BT_CLASSIC_ENABLED

components/bt/host/bluedroid/api/esp_gap_bt_api.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -494,4 +494,27 @@ esp_err_t esp_bt_gap_set_acl_pkt_types(esp_bd_addr_t remote_bda, uint16_t pkt_ty
     return (btc_transfer_context(&msg, &arg, sizeof(btc_gap_bt_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+esp_err_t esp_bt_gap_set_min_enc_key_size(uint8_t key_size)
+{
+    btc_msg_t msg;
+    btc_gap_bt_args_t arg;
+
+    if (esp_bluedroid_get_status() != ESP_BLUEDROID_STATUS_ENABLED) {
+        return  ESP_ERR_INVALID_STATE;
+    }
+
+    if (key_size < ESP_BT_ENC_KEY_SIZE_CTRL_MIN || key_size > ESP_BT_ENC_KEY_SIZE_CTRL_MAX) {
+        return ESP_ERR_INVALID_ARG;
+    }
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_GAP_BT;
+    msg.act = BTC_GAP_BT_ACT_SET_MIN_ENC_KEY_SIZE;
+
+    arg.set_min_enc_key_size.key_size = key_size;
+    return (btc_transfer_context(&msg, &arg, sizeof(btc_gap_bt_args_t), NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+#endif /* #if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE) */
+
 #endif /* #if BTC_GAP_BT_INCLUDED == TRUE */

components/bt/host/bluedroid/api/include/api/esp_gap_bt_api.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -121,6 +121,10 @@ typedef uint8_t esp_bt_eir_type_t;
 
 typedef uint16_t esp_bt_acl_pkt_type_t;
 
+/* Range of encryption key size */
+#define ESP_BT_ENC_KEY_SIZE_CTRL_MAX            (16)
+#define ESP_BT_ENC_KEY_SIZE_CTRL_MIN            (7)
+
 /* ESP_BT_EIR_FLAG bit definition */
 #define ESP_BT_EIR_FLAG_LIMIT_DISC         (0x01 << 0)
 #define ESP_BT_EIR_FLAG_GEN_DISC           (0x01 << 1)
@@ -266,6 +270,7 @@ typedef enum {
     ESP_BT_GAP_GET_PAGE_TO_EVT,                     /*!< Get page timeout event */
     ESP_BT_GAP_ACL_PKT_TYPE_CHANGED_EVT,            /*!< Set ACL packet types event */
     ESP_BT_GAP_ENC_CHG_EVT,                         /*!< Encryption change event */
+    ESP_BT_GAP_SET_MIN_ENC_KEY_SIZE_EVT,            /*!< Set minimum encryption key size */
     ESP_BT_GAP_EVT_MAX,
 } esp_bt_gap_cb_event_t;
 
@@ -458,6 +463,13 @@ typedef union {
         uint16_t pkt_types;                     /*!< packet types successfully set */
     } set_acl_pkt_types;                        /*!< set ACL packet types parameter struct */
 
+    /**
+     * @brief ESP_BT_GAP_SET_MIN_ENC_KEY_SIZE_EVT
+     */
+    struct set_min_enc_key_size_param {
+        esp_bt_status_t status;                 /*!< set minimum encryption key size status */
+    } set_min_enc_key_size;                     /*!< set minimum encryption key size parameter struct */
+
     /**
      * @brief ESP_BT_GAP_ACL_CONN_CMPL_STAT_EVT
      */
@@ -909,6 +921,15 @@ esp_err_t esp_bt_gap_get_page_timeout(void);
  */
 esp_err_t esp_bt_gap_set_acl_pkt_types(esp_bd_addr_t remote_bda, esp_bt_acl_pkt_type_t pkt_types);
 
+/**
+ * @brief           Set the mininal size of encryption key
+ *
+ * @return          - ESP_OK: success
+ *                  - ESP_ERR_INVALID_STATE: if bluetooth stack is not yet enabled
+ *                  - other: failed
+ */
+esp_err_t esp_bt_gap_set_min_enc_key_size(uint8_t key_size);
+
 #ifdef __cplusplus
 }
 #endif

components/bt/host/bluedroid/bta/dm/bta_dm_act.c

@@ -920,6 +920,23 @@ void bta_dm_set_acl_pkt_types (tBTA_DM_MSG *p_data)
     }
 }
 
+/*******************************************************************************
+**
+** Function         bta_dm_set_min_enc_key_size
+**
+** Description      Sets the minimal size of encryption key
+**
+**
+** Returns          void
+**
+*******************************************************************************/
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+void bta_dm_set_min_enc_key_size (tBTA_DM_MSG *p_data)
+{
+    BTM_SetMinEncKeySize(p_data->set_min_enc_key_size.key_size, p_data->set_min_enc_key_size.set_min_enc_key_size_cb);
+}
+#endif
+
 #endif
 /*******************************************************************************
 **

components/bt/host/bluedroid/bta/dm/bta_dm_api.c

@@ -380,6 +380,31 @@ void BTA_DmSetAclPktTypes(BD_ADDR remote_addr, UINT16 pkt_types, tBTM_CMPL_CB *p
         bta_sys_sendmsg(p_msg);
     }
 }
+
+/*******************************************************************************
+**
+** Function         BTA_DmSetMinEncKeySize
+**
+** Description      This function sets the minimal size of encryption key.
+**
+**
+** Returns          void
+**
+*******************************************************************************/
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+void BTA_DmSetMinEncKeySize(UINT8 key_size, tBTM_CMPL_CB *p_cb)
+{
+    tBTA_DM_API_SET_MIN_ENC_KEY_SIZE *p_msg;
+
+    if ((p_msg = (tBTA_DM_API_SET_MIN_ENC_KEY_SIZE *) osi_malloc(sizeof(tBTA_DM_API_SET_MIN_ENC_KEY_SIZE))) != NULL) {
+        p_msg->hdr.event = BTA_DM_API_SET_MIN_ENC_KEY_SIZE_EVT;
+        p_msg->key_size = key_size;
+        p_msg->set_min_enc_key_size_cb = p_cb;
+
+        bta_sys_sendmsg(p_msg);
+    }
+}
+#endif
 #endif /// CLASSIC_BT_INCLUDED == TRUE
 
 #if (SDP_INCLUDED == TRUE)

components/bt/host/bluedroid/bta/dm/bta_dm_main.c

@@ -71,6 +71,9 @@ const tBTA_DM_ACTION bta_dm_action[BTA_DM_MAX_EVT] = {
     bta_dm_set_page_timeout,                /* BTA_DM_API_PAGE_TO_SET_EVT */
     bta_dm_get_page_timeout,                /* BTA_DM_API_PAGE_TO_GET_EVT */
     bta_dm_set_acl_pkt_types,               /* BTA_DM_API_SET_ACL_PKT_TYPES_EVT */
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+    bta_dm_set_min_enc_key_size,            /* BTA_DM_API_SET_MIN_ENC_KEY_SIZE_EVT */
+#endif
 #endif
     bta_dm_set_afh_channels,                /* BTA_DM_API_SET_AFH_CHANNELS_EVT */
 #if (SDP_INCLUDED == TRUE)

components/bt/host/bluedroid/bta/dm/include/bta_dm_int.h

@@ -63,6 +63,9 @@ enum {
     BTA_DM_API_PAGE_TO_SET_EVT,
     BTA_DM_API_PAGE_TO_GET_EVT,
     BTA_DM_API_SET_ACL_PKT_TYPES_EVT,
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+    BTA_DM_API_SET_MIN_ENC_KEY_SIZE_EVT,
+#endif
 #endif
     BTA_DM_API_SET_AFH_CHANNELS_EVT,
 #if (SDP_INCLUDED == TRUE)
@@ -317,6 +320,15 @@ typedef struct {
     tBTM_CMPL_CB        *set_acl_pkt_types_cb;
 } tBTA_DM_API_SET_ACL_PKT_TYPES;
 
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+/* data type for BTA_DM_API_SET_MIN_ENC_KEY_SIZE_EVT */
+typedef struct {
+    BT_HDR              hdr;
+    UINT8               key_size;
+    tBTM_CMPL_CB        *set_min_enc_key_size_cb;
+} tBTA_DM_API_SET_MIN_ENC_KEY_SIZE;
+#endif
+
 /* data type for BTA_DM_API_GET_REMOTE_NAME_EVT */
 typedef struct {
     BT_HDR         hdr;
@@ -1178,6 +1190,9 @@ typedef union {
     tBTA_DM_API_PAGE_TO_SET set_page_timeout;
     tBTA_DM_API_PAGE_TO_GET get_page_timeout;
     tBTA_DM_API_SET_ACL_PKT_TYPES set_acl_pkt_types;
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+    tBTA_DM_API_SET_MIN_ENC_KEY_SIZE set_min_enc_key_size;
+#endif
 #if (SDP_INCLUDED == TRUE)
     tBTA_DM_API_GET_REMOTE_NAME  get_rmt_name;
 #endif
@@ -1692,6 +1707,9 @@ extern void bta_dm_config_eir (tBTA_DM_MSG *p_data);
 extern void bta_dm_set_page_timeout (tBTA_DM_MSG *p_data);
 extern void bta_dm_get_page_timeout (tBTA_DM_MSG *p_data);
 extern void bta_dm_set_acl_pkt_types (tBTA_DM_MSG *p_data);
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+extern void bta_dm_set_min_enc_key_size (tBTA_DM_MSG *p_data);
+#endif
 #endif
 extern void bta_dm_set_afh_channels (tBTA_DM_MSG *p_data);
 extern void bta_dm_read_rmt_name(tBTA_DM_MSG *p_data);

components/bt/host/bluedroid/bta/include/bta/bta_api.h

@@ -449,6 +449,10 @@ typedef tBTM_GET_PAGE_TIMEOUT_RESULTS tBTA_GET_PAGE_TIMEOUT_RESULTS;
 
 typedef tBTM_SET_ACL_PKT_TYPES_RESULTS tBTA_SET_ACL_PKT_TYPES_RESULTS;
 
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+typedef tBTM_SET_MIN_ENC_KEY_SIZE_RESULTS tBTA_SET_MIN_ENC_KEY_SIZE_RESULTS;
+#endif
+
 typedef tBTM_REMOTE_DEV_NAME tBTA_REMOTE_DEV_NAME;
 
 /* advertising channel map */
@@ -1835,6 +1839,20 @@ void BTA_DmGetPageTimeout(tBTM_CMPL_CB *p_cb);
 *******************************************************************************/
 void BTA_DmSetAclPktTypes(BD_ADDR remote_addr, UINT16 pkt_types, tBTM_CMPL_CB *p_cb);
 
+/*******************************************************************************
+**
+** Function         BTA_DmSetMinEncKeySize
+**
+** Description      This function sets the minimal size of encryption key.
+**
+**
+** Returns          void
+**
+*******************************************************************************/
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+void BTA_DmSetMinEncKeySize(UINT8 key_size, tBTM_CMPL_CB *p_cb);
+#endif
+
 #if (BLE_INCLUDED == TRUE)
 /*******************************************************************************
 **

components/bt/host/bluedroid/btc/profile/std/gap/btc_gap_bt.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -797,6 +797,31 @@ static void btc_gap_set_acl_pkt_types(btc_gap_bt_args_t *arg)
                          btc_gap_bt_set_acl_pkt_types_cmpl_callback);
 }
 
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+static void btc_gap_bt_set_min_enc_key_size_cmpl_callback(void *p_data)
+{
+    tBTA_SET_MIN_ENC_KEY_SIZE_RESULTS *result = (tBTA_SET_MIN_ENC_KEY_SIZE_RESULTS *)p_data;
+    esp_bt_gap_cb_param_t param;
+    bt_status_t ret;
+    btc_msg_t msg;
+    msg.sig = BTC_SIG_API_CB;
+    msg.pid = BTC_PID_GAP_BT;
+    msg.act = BTC_GAP_BT_SET_MIN_ENC_KEY_SIZE_EVT;
+
+    param.set_min_enc_key_size.status = btc_hci_to_esp_status(result->hci_status);
+
+    ret = btc_transfer_context(&msg, &param, sizeof(esp_bt_gap_cb_param_t), NULL, NULL);
+    if (ret != BT_STATUS_SUCCESS) {
+        BTC_TRACE_ERROR("%s btc_transfer_context failed\n", __func__);
+    }
+}
+
+static void btc_gap_set_min_enc_key_size(btc_gap_bt_args_t *arg)
+{
+    BTA_DmSetMinEncKeySize(arg->set_min_enc_key_size.key_size, btc_gap_bt_set_min_enc_key_size_cmpl_callback);
+}
+#endif
+
 static void btc_gap_bt_read_remote_name_cmpl_callback(void *p_data)
 {
     tBTA_REMOTE_DEV_NAME *result = (tBTA_REMOTE_DEV_NAME *)p_data;
@@ -872,6 +897,9 @@ void btc_gap_bt_arg_deep_copy(btc_msg_t *msg, void *p_dest, void *p_src)
     case BTC_GAP_BT_ACT_SET_PAGE_TIMEOUT:
     case BTC_GAP_BT_ACT_GET_PAGE_TIMEOUT:
     case BTC_GAP_BT_ACT_SET_ACL_PKT_TYPES:
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+    case BTC_GAP_BT_ACT_SET_MIN_ENC_KEY_SIZE:
+#endif
         break;
     case BTC_GAP_BT_ACT_PASSKEY_REPLY:
     case BTC_GAP_BT_ACT_CONFIRM_REPLY:
@@ -939,6 +967,9 @@ void btc_gap_bt_arg_deep_free(btc_msg_t *msg)
     case BTC_GAP_BT_ACT_SET_PAGE_TIMEOUT:
     case BTC_GAP_BT_ACT_GET_PAGE_TIMEOUT:
     case BTC_GAP_BT_ACT_SET_ACL_PKT_TYPES:
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+    case BTC_GAP_BT_ACT_SET_MIN_ENC_KEY_SIZE:
+#endif
         break;
     case BTC_GAP_BT_ACT_PASSKEY_REPLY:
     case BTC_GAP_BT_ACT_CONFIRM_REPLY:
@@ -1049,6 +1080,12 @@ void btc_gap_bt_call_handler(btc_msg_t *msg)
         btc_gap_set_acl_pkt_types(arg);
         break;
     }
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+    case BTC_GAP_BT_ACT_SET_MIN_ENC_KEY_SIZE: {
+        btc_gap_set_min_enc_key_size(arg);
+        break;
+    }
+#endif
     default:
         break;
     }
@@ -1101,6 +1138,9 @@ void btc_gap_bt_cb_deep_free(btc_msg_t *msg)
 #if (BTC_DM_PM_INCLUDED == TRUE)
     case BTC_GAP_BT_MODE_CHG_EVT:
 #endif /// BTC_DM_PM_INCLUDED == TRUE
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+    case BTC_GAP_BT_SET_MIN_ENC_KEY_SIZE_EVT:
+#endif /// ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE
         break;
     default:
         BTC_TRACE_ERROR("%s: Unhandled event (%d)!\n", __FUNCTION__, msg->act);
@@ -1192,6 +1232,12 @@ void btc_gap_bt_cb_handler(btc_msg_t *msg)
         btc_gap_bt_cb_to_app(ESP_BT_GAP_ACL_PKT_TYPE_CHANGED_EVT, (esp_bt_gap_cb_param_t *)msg->arg);
         break;
     }
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+    case BTC_GAP_BT_SET_MIN_ENC_KEY_SIZE_EVT: {
+        btc_gap_bt_cb_to_app(ESP_BT_GAP_SET_MIN_ENC_KEY_SIZE_EVT, (esp_bt_gap_cb_param_t *)msg->arg);
+        break;
+    }
+#endif
     default:
         BTC_TRACE_ERROR("%s: Unhandled event (%d)!\n", __FUNCTION__, msg->act);
         break;

components/bt/host/bluedroid/btc/profile/std/include/btc_gap_bt.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -35,6 +35,9 @@ typedef enum {
     BTC_GAP_BT_SET_PAGE_TO_EVT,
     BTC_GAP_BT_GET_PAGE_TO_EVT,
     BTC_GAP_BT_SET_ACL_PKT_TYPES_EVT,
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+    BTC_GAP_BT_SET_MIN_ENC_KEY_SIZE_EVT,
+#endif
 }btc_gap_bt_evt_t;
 
 typedef enum {
@@ -58,6 +61,9 @@ typedef enum {
     BTC_GAP_BT_ACT_SET_PAGE_TIMEOUT,
     BTC_GAP_BT_ACT_GET_PAGE_TIMEOUT,
     BTC_GAP_BT_ACT_SET_ACL_PKT_TYPES,
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+    BTC_GAP_BT_ACT_SET_MIN_ENC_KEY_SIZE,
+#endif
 } btc_gap_bt_act_t;
 
 /* btc_bt_gap_args_t */
@@ -165,6 +171,12 @@ typedef union {
         uint16_t pkt_types;
     } set_acl_pkt_types;
 
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+    // BTC_GAP_BT_ACT_SET_MIN_ENC_KEY_SIZE
+    struct set_min_enc_key_size_args {
+        uint8_t key_size;
+    } set_min_enc_key_size;
+#endif
 } btc_gap_bt_args_t;
 
 void btc_gap_bt_call_handler(btc_msg_t *msg);

components/bt/host/bluedroid/common/include/common/bluedroid_user_config.h

@@ -95,6 +95,15 @@
 #define UC_BT_CLASSIC_BQB_ENABLED           FALSE
 #endif
 
+//Set Encryption Key Size(BT)
+#ifdef CONFIG_BT_ENC_KEY_SIZE_CTRL_STD
+#define UC_BT_ENC_KEY_SIZE_CTRL_MODE   1
+#elif CONFIG_BT_ENC_KEY_SIZE_CTRL_VSC
+#define UC_BT_ENC_KEY_SIZE_CTRL_MODE   2
+#else
+#define UC_BT_ENC_KEY_SIZE_CTRL_MODE   0
+#endif
+
 //BLE
 #ifdef CONFIG_BT_BLE_ENABLED
 #define UC_BT_BLE_ENABLED                   CONFIG_BT_BLE_ENABLED

components/bt/host/bluedroid/common/include/common/bt_target.h

@@ -73,6 +73,11 @@
 #define SDP_INCLUDED                TRUE
 #define BTA_DM_QOS_INCLUDED         TRUE
 
+#define ENC_KEY_SIZE_CTRL_MODE_NONE 0
+#define ENC_KEY_SIZE_CTRL_MODE_STD  1
+#define ENC_KEY_SIZE_CTRL_MODE_VSC  2
+#define ENC_KEY_SIZE_CTRL_MODE      UC_BT_ENC_KEY_SIZE_CTRL_MODE
+
 #if (UC_BT_A2DP_ENABLED == TRUE)
 #define BTA_AR_INCLUDED             TRUE
 #define BTA_AV_INCLUDED             TRUE

components/bt/host/bluedroid/stack/btm/btm_devctl.c

@@ -877,6 +877,42 @@ tBTM_STATUS BTM_WritePageTimeout(UINT16 timeout, tBTM_CMPL_CB *p_cb)
     return (BTM_CMD_STARTED);
 }
 
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+void btm_set_min_enc_key_size_complete(const UINT8 *p)
+{
+    tBTM_SET_MIN_ENC_KEY_SIZE_RESULTS results;
+    tBTM_CMPL_CB *p_cb = btm_cb.devcb.p_set_min_enc_key_size_cmpl_cb;
+
+    STREAM_TO_UINT8(results.hci_status, p);
+
+    if (p_cb) {
+        btm_cb.devcb.p_set_min_enc_key_size_cmpl_cb = NULL;
+        (*p_cb)(&results);
+    }
+}
+
+tBTM_STATUS BTM_SetMinEncKeySize(UINT8 key_size, tBTM_CMPL_CB *p_cb)
+{
+    BTM_TRACE_EVENT ("BTM: BTM_SetMinEncKeySize: key_size: %d.", key_size);
+
+    btm_cb.devcb.p_set_min_enc_key_size_cmpl_cb = p_cb;
+    tBTM_STATUS status = BTM_NO_RESOURCES;
+
+#if (ENC_KEY_SIZE_CTRL_MODE == ENC_KEY_SIZE_CTRL_MODE_VSC)
+    /* Send the HCI command */
+    UINT8 param[1];
+    UINT8 *p = (UINT8 *)param;
+    UINT8_TO_STREAM(p, key_size);
+    status = BTM_VendorSpecificCommand(HCI_VENDOR_BT_SET_MIN_ENC_KEY_SIZE, 1, param, NULL);
+#else
+    if (btsnd_hcic_set_min_enc_key_size(key_size)) {
+        status = BTM_SUCCESS;
+    }
+#endif
+    return status;
+}
+#endif
+
 /*******************************************************************************
 **
 ** Function         btm_set_page_timeout_complete

components/bt/host/bluedroid/stack/btm/include/btm_int.h

@@ -221,6 +221,8 @@ tBTM_CMPL_CB         *p_page_to_set_cmpl_cb; /* Callback function to be called w
 TIMER_LIST_ENT       set_acl_pkt_types_timer;
 tBTM_CMPL_CB         *p_set_acl_pkt_types_cmpl_cb; /* Callback function to be called when */
 /* set ACL packet types is completed */
+tBTM_CMPL_CB         *p_set_min_enc_key_size_cmpl_cb; /* Callback function to be called when */
+/* set min encryption key size is completed */
 #endif
 
 DEV_CLASS            dev_class;         /* Local device class                   */
@@ -1148,6 +1150,9 @@ void btm_delete_stored_link_key_complete (UINT8 *p);
 void btm_report_device_status (tBTM_DEV_STATUS status);
 void btm_set_afh_channels_complete (UINT8 *p);
 void btm_ble_set_channels_complete (UINT8 *p);
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+void btm_set_min_enc_key_size_complete(const UINT8 *p);
+#endif
 void btm_set_page_timeout_complete (const UINT8 *p);
 void btm_page_to_setup_timeout (void *p_tle);
 

components/bt/host/bluedroid/stack/btu/btu_hcif.c

@@ -998,6 +998,16 @@ static void btu_hcif_hdl_command_complete (UINT16 opcode, UINT8 *p, UINT16 evt_l
     case HCI_WRITE_PAGE_TOUT:
         btm_set_page_timeout_complete(p);
         break;
+#if (ENC_KEY_SIZE_CTRL_MODE == ENC_KEY_SIZE_CTRL_MODE_STD)
+    case HCI_SET_MIN_ENC_KEY_SIZE:
+        btm_set_min_enc_key_size_complete(p);
+        break;
+#endif
+#if (ENC_KEY_SIZE_CTRL_MODE == ENC_KEY_SIZE_CTRL_MODE_VSC)
+    case HCI_VENDOR_BT_SET_MIN_ENC_KEY_SIZE:
+        btm_set_min_enc_key_size_complete(p);
+        break;
+#endif
 #endif
 
 #if (BLE_INCLUDED == TRUE)

components/bt/host/bluedroid/stack/hcic/hcicmds.c

@@ -1910,4 +1910,30 @@ BOOLEAN btsnd_hcic_set_afh_channels (AFH_CHANNELS channels)
     btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID,  p);
     return (TRUE);
 }
+
+#if (ENC_KEY_SIZE_CTRL_MODE == ENC_KEY_SIZE_CTRL_MODE_STD)
+BOOLEAN btsnd_hcic_set_min_enc_key_size (UINT8 size)
+{
+    BT_HDR *p;
+    UINT8 *pp;
+
+    if ((p = HCI_GET_CMD_BUF(HCIC_PARAM_SIZE_SET_MIN_ENC_KEY_SIZE)) == NULL) {
+        return (FALSE);
+    }
+
+    pp = (UINT8 *)(p + 1);
+
+    p->len    = HCIC_PREAMBLE_SIZE + HCIC_PARAM_SIZE_SET_MIN_ENC_KEY_SIZE;
+    p->offset = 0;
+
+    UINT16_TO_STREAM (pp, HCI_SET_MIN_ENC_KEY_SIZE);
+    UINT8_TO_STREAM  (pp, HCIC_PARAM_SIZE_SET_MIN_ENC_KEY_SIZE);
+
+    UINT8_TO_STREAM  (pp, size);
+
+    btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID,  p);
+    return (TRUE);
+}
+#endif
+
 #endif /// CLASSIC_BT_INCLUDED == TRUE

components/bt/host/bluedroid/stack/include/stack/btm_api.h

@@ -860,6 +860,15 @@ typedef struct {
     UINT16      pkt_types;
 } tBTM_SET_ACL_PKT_TYPES_RESULTS;
 
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+/* Structure returned with set minimal encryption key size event (in tBTM_CMPL_CB callback function)
+** in response to BTM_SetMinEncKeySize call.
+*/
+typedef struct {
+    UINT8 hci_status;
+} tBTM_SET_MIN_ENC_KEY_SIZE_RESULTS;
+#endif
+
 /* Structure returned with set BLE channels event (in tBTM_CMPL_CB callback function)
 ** in response to BTM_BleSetChannels call.
 */
@@ -2305,6 +2314,22 @@ tBTM_STATUS BTM_ReadPageTimeout(tBTM_CMPL_CB *p_cb);
 //extern
 tBTM_STATUS BTM_SetAclPktTypes(BD_ADDR remote_bda, UINT16 pkt_types, tBTM_CMPL_CB *p_cb);
 
+/*******************************************************************************
+**
+** Function         BTM_SetMinEncKeySize
+**
+** Description      Send HCI Set Minimum Encryption Key Size
+**
+** Returns
+**      BTM_SUCCESS         Command sent.
+**      BTM_NO_RESOURCES    If out of resources to send the command.
+**
+*******************************************************************************/
+//extern
+#if (ENC_KEY_SIZE_CTRL_MODE != ENC_KEY_SIZE_CTRL_MODE_NONE)
+tBTM_STATUS BTM_SetMinEncKeySize(UINT8 key_size, tBTM_CMPL_CB *p_cb);
+#endif
+
 /*******************************************************************************
 **
 ** Function         BTM_WriteVoiceSettings

components/bt/host/bluedroid/stack/include/stack/hcidefs.h

@@ -212,6 +212,7 @@
 #define HCI_WRITE_ERRONEOUS_DATA_RPT    (0x005B | HCI_GRP_HOST_CONT_BASEBAND_CMDS)
 #define HCI_ENHANCED_FLUSH              (0x005F | HCI_GRP_HOST_CONT_BASEBAND_CMDS)
 #define HCI_SEND_KEYPRESS_NOTIF         (0x0060 | HCI_GRP_HOST_CONT_BASEBAND_CMDS)
+#define HCI_SET_MIN_ENC_KEY_SIZE        (0x0084 | HCI_GRP_HOST_CONT_BASEBAND_CMDS)
 
 
 /* AMP HCI */
@@ -425,6 +426,7 @@
 
 //ESP BT subcode define
 #define HCI_SUBCODE_BT_INIT                     0x00
+#define HCI_SUBCODE_BT_SET_MIN_ENC_KEY_SIZE     0x02
 #define HCI_SUBCODE_BT_MAX                      0x7F
 
 #define HCI_ESP_VENDOR_OPCODE_BUILD(ogf, group, subcode) ((ogf << 10) | (group <<7) | (subcode << 0))
@@ -467,6 +469,7 @@
 /* BLE clear legacy advertising */
 #define HCI_VENDOR_BLE_CLEAR_ADV          HCI_ESP_VENDOR_OPCODE_BUILD(HCI_VENDOR_OGF, HCI_ESP_GROUP_BLE, HCI_SUBCODE_BLE_CLEAR_ADV)
 //ESP BT HCI CMD
+#define HCI_VENDOR_BT_SET_MIN_ENC_KEY_SIZE         HCI_ESP_VENDOR_OPCODE_BUILD(HCI_VENDOR_OGF, HCI_ESP_GROUP_BT, HCI_SUBCODE_BT_SET_MIN_ENC_KEY_SIZE)
 
 /* subcode for multi adv feature */
 #define BTM_BLE_MULTI_ADV_SET_PARAM                     0x01

components/bt/host/bluedroid/stack/include/stack/hcimsgs.h

@@ -583,6 +583,10 @@ BOOLEAN btsnd_hcic_set_afh_channels (AFH_CHANNELS channels);
 BOOLEAN btsnd_hcic_ble_set_channels (BLE_CHANNELS channels);
 #define HCIC_PARAM_SIZE_BLE_SET_CHANNELS    5
 
+/* set minimum encryption key size */
+BOOLEAN btsnd_hcic_set_min_enc_key_size (UINT8 size);
+#define HCIC_PARAM_SIZE_SET_MIN_ENC_KEY_SIZE    1
+
 BOOLEAN btsnd_hcic_write_pin_type(UINT8 type);                   /* Write PIN Type */
 BOOLEAN btsnd_hcic_write_auto_accept(UINT8 flag);                /* Write Auto Accept */
 BOOLEAN btsnd_hcic_read_name (void);                             /* Read Local Name */

components/soc/esp32/include/soc/Kconfig.soc_caps.in

@@ -911,6 +911,10 @@ config SOC_BLUFI_SUPPORTED
     bool
     default y
 
+config SOC_BT_H2C_ENC_KEY_CTRL_ENH_VSC_SUPPORTED
+    bool
+    default y
+
 config SOC_ULP_HAS_ADC
     bool
     default y

components/soc/esp32/include/soc/soc_caps.h

@@ -437,6 +437,7 @@
 #define SOC_BT_CLASSIC_SUPPORTED        (1)    /*!< Support Bluetooth Classic hardware */
 #define SOC_BLE_DEVICE_PRIVACY_SUPPORTED (0)   /*!< Support BLE device privacy mode */
 #define SOC_BLUFI_SUPPORTED             (1)    /*!< Support BLUFI */
+#define SOC_BT_H2C_ENC_KEY_CTRL_ENH_VSC_SUPPORTED (1) /*!< Support Bluetooth Classic encryption key size configuration through vendor-specific HCI command */
 
 /*-------------------------- ULP CAPS ----------------------------------------*/
 #define SOC_ULP_HAS_ADC                     (1)    /* ADC can be accessed from ULP */