2

I'm building an application which must securely transfer data between a mobile device and a BLE peripheral.

I've been reading up on the different pairing methods and the level of security offered across BLE 4.0 to 4.2. It seems as though the process used for pairing pre-4.2 is insecure to passive eavesdropping by design.

So my question is quite simple: what device has to have what version of BLE for this process to be secure? The central, peripheral, or both?

Improve this question

1 Answer 1

Reset to default
-1

In any kind of encrypted communication, both endpoints must support the encryption.

So, to answer your question, all the devices must support the encryption.

Normal bluetooth cannot be passively sniffed, so I recommend using normal bluetooth.

Improve this answer
3
  • 1
    Since most devices have a known default pairing key, where is the evidence or reference that it cannot be passively sniffed or automated that it is passively sniffed?
    – rjt
    Feb 4, 2019 at 20:49
  • A default pairing key would be the exception. I'd say that's more an issue with implementation than the spec
    – dGRAMOP
    Feb 4, 2019 at 21:07
  • Here is a link to an attack framework able to (among other things) passively sniff bluetooth communications: homepages.laas.fr/rcayre/mirage-documentation/blestack.html
    – A. Hersean
    Sep 22, 2022 at 14:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .