So as we know there are significant issues with Bluetooth LE when it comes to security at least in the 4.0 and 4.1 specs. There are many solutions to this problem that can be undertaken i.e Enabling OOB keying functionality in the platforms that tend to interact with Bluetooth LE (Android/iOS do not support this currently). In the mean time as an application developer are there any libraries or determined best practices that exist for transferring GATT data over insecure channels?

My daydream is that someone has wrapped the APIs on the microcontroller side and the mobile device side such that additional security is implemented using generated additional attributes. I haven't found evidence of any such projects though.

  • In terms of microcontrollers interfacing a separate BTLE unit I don't think wasting CPU power and memory on a micro controller is a good idea. Possibly there's even not enough memory on some MCUs for crypto. There are some Bluetooth SoC that come with cryptography units on board (like TI's CC2540 or Nordics nRF51822). If you can stick with with implementing your own security layer utilizing these it could be a good option. This requires you to implement your application on the SoC which might not be an option for some one. – try-catch-finally Mar 23 '16 at 20:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.