Pair Bluetooth LE with LE Secure Connections

How to do it

Legacy LE pairing can be cracked from a captured exchange, and Just Works gives no protection against someone in the middle. LE Secure Connections uses an elliptic curve key exchange. Pair with numeric comparison, a passkey shown on one side, or out-of-band data such as the setup code in a QR code. Turn on the stack's Secure Connections Only mode, so a phone cannot fall back to legacy pairing. The network password still travels as send network details over an authenticated encrypted channel says. NIST SP 800-121 describes the modes and their weaknesses.

Examples

Python example

from dataclasses import dataclass

@dataclass
class PairingRequest:
    secure_connections: bool
    mitm_protection: bool

def accept_pairing(request: PairingRequest) -> bool:
    return request.secure_connections and request.mitm_protection

Go example

type PairingRequest struct {
	SecureConnections bool
	MITMProtection    bool
}

func AcceptPairing(req PairingRequest) bool {
	return req.SecureConnections && req.MITMProtection
}

How to check

A lab test pairs with a central that offers only legacy pairing, then one that offers only Just Works. The device refuses both. A capture of a good pairing shows LE Secure Connections, and reading an owner data characteristic without pairing fails.

Sources

• NIST SP 800-121 Rev. 2, Guide to Bluetooth Security

Related rules

• IOT-7 Send network details over an authenticated encrypted channel in Connected devices