2

I have Device A (Phone) which will pair with Device B (Light Switch) using "Unauthenticated Pairing with Encryption".

My belief was that this level of encryption would be enough to prevent attackers from spoofing either device (MITM attack) as long as no attacker is present to steal the Long Term Key (LTK) created during the Pairing Process.

I also thought this would be enough to prevent attackers from doing a "replay attack" since the devices will disconnect after messages/commands have been exchanged resulting in a previously captured on, or off, command being useless since the captured command would've been created with an older session key.

Please let me know if my thought process is wrong or if I've overlooked anything.

Thank You

6
  • 1
    Without authentication a MITM attack is possible. There’s no stopping this without authentication. Whether an attacker would gain useable information from a MITM depends on how strong your encryption and threat level is. Use authentication for crying out loud! Commented Jul 4 at 22:38
  • And it also depends on how strong your LTK is. Commented Jul 4 at 22:39
  • 1
    @security_paranoid: How is authentication supposed to work with a light switch? It's not going to have an integrated screen or keyboard.
    – Ja1024
    Commented Jul 5 at 6:28
  • @Ja1024 I have heard of simple IoT devices having an initial reliable and secure connection (like holding a button before installed in wall,) and then authenticating through an app on that connection so that more than one device can authenticate through the central reliable connection. Commented Jul 5 at 7:43
  • @security_paranoid: This sounds like Wi-Fi Protected Setup. In Bluetooth, authenticated pairing requires either a display to compare numbers, a keyboard to enter a passkey or an out-of-bounds channel.
    – Ja1024
    Commented Jul 5 at 12:14

1 Answer 1

2

It's correct that if no attacker is present during the Just Works (i.e., unauthenticated) pairing procedure, then LE ACL packets are protected from man-in-the-middle and replay attacks. Replay within a single session is prevented through packet counters, and replay across sessions is prevented through unique session keys (as you already pointed out yourself).

If the devices use LE Secure Connections instead of legacy pairing, then even the presence of a passive attacker is not an issue, because the LTK is never transmitted. Instead, the devices use the Elliptic Curve Diffie-Hellman algorithm to agree on an LTK.

Just Works pairing is of course always vulnerable to active man-in-the-middle attackers.

2
  • What does an active MITM attack look like during Just Works pairing and why would someone choose to attack that pairing procedure in such a way? I think that an active MITM attack involves adding your own messages to the exchange instead of just listening passively for key messages.
    – Ampersand
    Commented Jul 11 at 13:43
  • Your definition of an active and passive attacker is correct. The “why” question is impossible to answer -- different people have different motivations.
    – Ja1024
    Commented Jul 11 at 15:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .