Is it possible for an unauthenticated bystander to force reassociation/reauthentication of a pair of Bluetooth 2.1 devices in a manner similar to IEEE 802.11i deauths? Bluetooth 2.1 (BR/EDR) uses Simple Secure Pairing (SSP) with two-level E0 for confidentiality, SAFER+ for authentication, and ECDH using the P-192 curve with HMAC-SHA-256 for key derivation and exchange. I do not know if it is necessary to obtain the channel hopping sequence number to accomplish this.

In case this is an XY problem, my goal is to create software on a Bluetooth-capable device that automatically forces all 2.1 pairings in the vicinity to reauthenticate periodically in order to slightly improve their security against passive attackers. This is motivated by an attack against E0 which requires a mere 233.9 precomputation, 234.9 time, 220.2 frames, and 229 memory. As each frame is 2745 bits long, sending 220.2 frames (about 394 MiB) at the protocol's maximum theoretical speed of 3 Mbps takes only 18 minutes. Software on another system would be able to monitor the amount of data being transmitted in order to force reauthentication long before this critical amount of data has been sent. This forces another key exchange to take place and reseeds the cipher.

Without being able to force reauthentication, I will have to tell my "smart home"-obsessed friend that they will have to reset their devices every 18 minutes if they want to remain secure (which they do). If I am able to force reauthentication wirelessly, then I can build a cheap embedded system that monitors for active attacks and forces periodic key exchange and give it to them.

Note that this is not a duplicate of this question which asks specifically about deauth attacks to deny service. I am looking for something non-invasive which causes no more than a slight hiccup.

  • 1
    Would the downvoter care to explain their issue with this question? – forest Dec 11 '18 at 13:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.