Just Works Bluetooth Low Energy Security

Question

I have been puzzled the past couple days about bluetooth low energy security.

My situation:

I am looking at what it might take to secure unpaired BLE connections.

In some cases, and essentially this main use case, a mobile device (Android) may want to connect to several different peripherals randomly at different times throughout the day. By 'randomly' I mean I am walking by one if I have a dozen scattered around my apartment and I personally don't know exactly which one without physically checking.

The process of physically accepting a pair request seems unnecessary and quite time consuming. I don't what to walk in the room the first time and have to manually pair each device, that would be insane if I had 100+ devices. Note that these devices don't necessarily have to be connected at the same time, but could. Also note that I understand this isn't generally the main use case of the typical peripheral to mobile communication considering the max connected devices at one time is 7.

These peripheral devices have no I/O thus the Numeric Comparison, Passkey Entry, and Out of Band connection methods don't seem to be the ones that I'm looking for. It seems that Just Works should work, however there doesn't seem to be security support for it. Anyone with a sniffer would be able to read all communication.

It seems I may be asking too much of Bluetooth LE and will have to figure out another means--maybe in the application layer?

Answer 1

if you want to have encrypted communication on bluetooth layer, you will need a pairing process. Just Works is the most simple one but using Android or iOS you will still need to press a button at least on phone side.

A basic idea of the bluetooth pairing process is that no predefined keys are necessary. Therefor, the user can secure the connection between two devices out of the box.

From you post above, some questions arise:

• Do you need encryption or authentication?
• What is the sense of encryption in your use case if any device is able to connect, encrypt and communicate?
• What level of security do you need? Security against professional atackers or against someone accidentally connecting to your device with a BLE scanner app?
• Do you actually need encryption or signing?

Dependent on your requirements, there are different solutions. To my knowledge, BLE encryption without pairing is not possible (with usual smartphones).

You could install predefined encryption keys and encrypt data in your application. But then, you have another problem: How to distribute the keys? And if one device is hacked, how do you revoke keys? If all devices share the same key, your whole system is broken if one device is hacked.