Encrypted device cannot be registered if Trigger based device flag is set

[hannesb]

Describe the bug
If the 'Trigger based device flag' is set, a device sending encrypted messages cannot be registered in Home Assistant

To Reproduce
Steps to reproduce the behavior:

• Enable BTHome in Home Assistant
• Configure Arduino IDE for ESP32-C3
• Open BTHome V2-Arduino NimBLE_Encryption sample
• Enable 'Trigger based device flag' by changing line 31 to:
  btHome = new BtHomeV2Device("", "", true, key, _macAddress);
• Run sample
  Home Assistant will recognize the new device and ask for the bind key, but registration will fail

Additional context
Arduino debug output:

01:22:32.959 -> Device MAC: CE:AC:31:8D:F9:D4
01:22:32.959 -> Advertising data:
01:22:32.959 -> 02 01 06 0f 16 d2 fc 45 a9 69 f9 01 00 00 00 1f 72 0e 4f 01 09 01 08

BTHome log:

2025-10-30 01:22:31.340 WARNING (MainThread) [bthome_ble.parser] BTHome sensor ACCE: Decryption failed:
2025-10-30 01:22:31.341 DEBUG (MainThread) [bthome_ble.parser] BTHome sensor ACCE: mic: 1f720e4f
2025-10-30 01:22:31.341 DEBUG (MainThread) [bthome_ble.parser] BTHome sensor ACCE: nonce: d4f98d31acced2fc4501000000
2025-10-30 01:22:31.341 DEBUG (MainThread) [bthome_ble.parser] BTHome sensor ACCE: encrypted_payload: a969f9

nonce parts:

• mac: d4f98d31acce
• uuid: d2fc
• bthome device info: 45 -> 0x40 | 0x04 | 0x01 -> BTHome Version 2, Trigger device, encrypted
• counter: 01000000

After disabling the 'Trigger based device flag', BTHome will accept the device.
Arduino debug output changes to:

01:37:10.751 -> Device MAC: CE:AC:31:8D:F9:D4
01:37:10.751 -> Advertising data:
01:37:10.751 -> 02 01 06 0f 16 d2 fc 41 a9 69 f9 01 00 00 00 1f 72 0e 4f 01 09 01 08

Note that the only difference is the BTHome Device Information byte

HTH
Hannes

[Ernst79]

I think you miss the Ciphertext and MIC. See this page how to get these.

https://bthome.io/encryption/

The final encrypted Service Data, which you can broadcast in your (encrypted) BLE advertisement, is composed as follows.

UUID (reversed per byte)D2FC
BTHome device data byte 41
Ciphertext a47266c95f73
Counter 00112233
Message Integrity Check (MIC) 78237214

[hannesb]

But for a trigger based device, the BTHome device data byte must be 45, right?

[Ernst79]

Yes, that should be correct.

01000101 = 69 = 0x45

When reading from right to left, you get the following settings
bit 0: 1 = True: Encryption
bit 2: 1 = True: Device is NOT sending regular data updates
bit 5-7: 010 = 2: BTHome Version 2.