BLE Security: Pairing, Bonding, Encryption and Address Privacy
Learn pairing methods, the difference between Bonding and Encryption, LTK and IRK keys, and choosing Just Works, Passkey, or Numeric Comparison.
Contents
Turning on Pairing alone does not secure the product. Security is built from threat analysis, input and output capability of two devices, access level characteristics, key retention and product recovery policy.
Pairing, Bonding and Encryption
Pairing is the process of making or agreeing key ingredients. Encryption makes the link confidential with the same keys. Bonding means storing keys for future connections. The connection may be encrypted but not bonded, or the device may be bonded and encryption is not yet enabled on the current connection.
Pairing methods
Just Works has little interaction but does not provide strong authentication against man-in-the-middle attacks. Passkey Entry requires a display or number entry. Numeric Comparison in LE Secure Connections shows the common number on two devices. OOB transmits security data through another channel such as NFC. IO capability and threat model determine the appropriate method.
the keys
LTK is used for link encryption, IRK for Resolvable Private Address identification and CSRK for data signing in related scenarios. The key must be stored in the appropriate memory, with access control and erasure cycle enabled. Factory reset should clear the bonds as expected by the user.
Address privacy
Fixed device address makes long-term tracking easy. The Resolvable Private Address changes periodically and can be resolved by an IRK bonded device. Anonymous random address does not mean data security; Address privacy and encryption are two separate issues.
Select security for smart lock
For a lock, Just Works is not enough. Consider Numeric Comparison or OOB, allow unlock commands only on the encrypted link, limit failed attempts, and delete deleted bonds on both sides. Then design the scenario of the lost phone.
Link authentication is different from product ownership
Numeric Comparison in LE Secure Connections requires compatible I/O and actual user authentication on both sides; Just showing the number in a log does not make it so. Choosing the pairing method is the result of IO capability, security request and support from both sides.
For a lock, in addition to the encrypted link, it must be known who is allowed to register the new owner, unlock and delete the key. An unknown phone that succeeds in pairing should not be automatically owned. Add owner, restore and revoke access of lost phone separately from passcode transfer.
Factory Reset can wipe the keys on the side of the device, but it won't remotely force the phone to wipe Bond. The recovery process should prompt the user to remove the old bond and re-pair. A private address alone does not guarantee access or concealment of the ad payload.
Question and answer article
Ask your technical question
Questions and answers are published after moderation. Authors can see their own pending drafts.
No confirmed questions have been registered for this article yet.