I'm building an application which must securely transfer data between a mobile device and a BLE peripheral.

I've been reading up on the different pairing methods and the level of security offered across BLE 4.0 to 4.2. It seems as though the process used for pairing pre-4.2 is insecure to passive eavesdropping by design.

So my question is quite simple: what device has to have what version of BLE for this process to be secure? The central, peripheral, or both?


In any kind of encrypted communication, both endpoints must support the encryption.

So, to answer your question, all the devices must support the encryption.

Normal bluetooth cannot be passively sniffed, so I recommend using normal bluetooth.

  • 1
    Since most devices have a known default pairing key, where is the evidence or reference that it cannot be passively sniffed or automated that it is passively sniffed? – rjt Feb 4 '19 at 20:49
  • A default pairing key would be the exception. I'd say that's more an issue with implementation than the spec – dGRAMOP Feb 4 '19 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.