diff --git a/ble/sm.c b/ble/sm.c
index 777b9cd2c..d69686a6e 100644
--- a/ble/sm.c
+++ b/ble/sm.c
@@ -362,7 +362,7 @@ static void sm_truncate_key(sm_key_t key, int max_encryption_size){
 // established.
 
 static void sm_timeout_handler(timer_source_t * timer){
-    printf("SM timeout");
+    printf("SM timeout\n");
     sm_state_responding = SM_STATE_TIMEOUT;
 }
 static void sm_timeout_start(){
@@ -556,7 +556,9 @@ static void sm_tk_setup(){
 
     // Otherwise the IO capabilities of the devices shall be used to determine the
     // pairing method as defined in Table 2.4.
-    sm_stk_generation_method = stk_generation_method[sm_m_io_capabilities][sm_s_io_capabilities];
+    sm_stk_generation_method = stk_generation_method[sm_s_io_capabilities][sm_m_io_capabilities];
+    printf("sm_tk_setup: master io cap: %u, slave io cap: %u -> method %u\n",
+        sm_m_io_capabilities, sm_s_io_capabilities, sm_stk_generation_method);
 }
 
 static int sm_key_distribution_flags_for_set(uint8_t key_set){
@@ -1107,6 +1109,7 @@ static void sm_packet_handler(uint8_t packet_type, uint16_t handle, uint8_t *pac
 
             // decide on STK generation method
             sm_tk_setup();
+            printf("SMP: generation method %u\n", sm_stk_generation_method);
 
             // check if STK generation method is acceptable by client
             int ok = 0;
diff --git a/example/libusb/ble_peripheral.c b/example/libusb/ble_peripheral.c
index 422603b05..a2061764a 100644
--- a/example/libusb/ble_peripheral.c
+++ b/example/libusb/ble_peripheral.c
@@ -156,6 +156,18 @@ static void app_packet_handler (uint8_t packet_type, uint16_t channel, uint8_t *
                        break;
                     }
                     break;
+
+                case SM_PASSKEY_DISPLAY_NUMBER: {
+                    // display number
+                    sm_event_t * event = (sm_event_t *) packet;
+                    printf("GAP Bonding: Display Passkey '%u\n", event->passkey);
+                    break;
+                }
+
+                case SM_PASSKEY_DISPLAY_CANCEL: 
+                    printf("GAP Bonding: Display cancel\n");
+                    break;
+
                 case SM_AUTHORIZATION_REQUEST: {
                     // auto-authorize connection if requested
                     sm_event_t * event = (sm_event_t *) packet;
@@ -189,10 +201,10 @@ void setup(void){
     // setup central device db
     central_device_db_init();
 
-    // setup SM
+    // setup SM: Display only
     sm_init();
-    sm_set_io_capabilities(IO_CAPABILITY_NO_INPUT_NO_OUTPUT);
-    sm_set_authentication_requirements( SM_AUTHREQ_BONDING );
+    sm_set_io_capabilities(IO_CAPABILITY_DISPLAY_ONLY);
+    sm_set_authentication_requirements( SM_AUTHREQ_BONDING | SM_AUTHREQ_MITM_PROTECTION); 
     sm_set_request_security(1);
 
     // setup ATT server
@@ -211,7 +223,6 @@ int main(void)
     run_loop_set_timer(&heartbeat, HEARTBEAT_PERIOD_MS);
     run_loop_add_timer(&heartbeat);
 
-
     // turn on!
     hci_power_control(HCI_POWER_ON);