I'm building an application which must securely transfer data between a mobile device and a BLE peripheral.
I've been reading up on the different pairing methods and the level of security offered across BLE 4.0 to 4.2. It seems as though the process used for pairing pre-4.2 is insecure to passive eavesdropping by design.
So my question is quite simple: what device has to have what version of BLE for this process to be secure? The central, peripheral, or both?