---
title: "Pair Bluetooth LE with LE Secure · Agent Wranglers"
url: https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding/ble-secure-connections
id: IOT-42
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 904
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Pair Bluetooth LE with LE Secure Connections

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Provisioning and onboarding](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: IOT-42
- Level: Recommended
- Chapter: [Provisioning and onboarding](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding.md)
- Rule: A device that pairs over Bluetooth Low Energy accepts only LE Secure Connections with authentication, which is Security Mode 1 Level 4. It refuses legacy pairing and Just Works for any link that carries owner data or commands.
- Check: A lab test pairs with a central that offers only legacy pairing, then one that offers only Just Works. The device refuses both. A capture of a good pairing shows LE Secure Connections, and reading an owner data characteristic without pairing fails.
- How: Legacy LE pairing can be cracked from a captured exchange, and Just Works gives no protection against someone in the middle. LE Secure Connections uses an elliptic curve key exchange. Pair with numeric comparison, a passkey shown on one side, or out-of-band data such as the setup code in a QR code. Turn on the stack's Secure Connections Only mode, so a phone cannot fall back to legacy pairing. The network password still travels as [send network details over an authenticated encrypted channel](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding/secure-setup-channel.md) says. NIST SP 800-121 describes the modes and their weaknesses.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Python example

```python
from dataclasses import dataclass

@dataclass
class PairingRequest:
    secure_connections: bool
    mitm_protection: bool

def accept_pairing(request: PairingRequest) -> bool:
    return request.secure_connections and request.mitm_protection
```

### Go example

```go
type PairingRequest struct {
	SecureConnections bool
	MITMProtection    bool
}

func AcceptPairing(req PairingRequest) bool {
	return req.SecureConnections && req.MITMProtection
}
```

## Sources

- [NIST SP 800-121 Rev. 2, Guide to Bluetooth Security](https://csrc.nist.gov/pubs/sp/800/121/r2/upd1/final)

## Related rules

- IOT-7 [Send network details over an authenticated encrypted channel](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding/secure-setup-channel.md) in Connected devices

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding/ble-secure-connections">Agent Wranglers connected devices playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Follow Matter's attestation and commissioning in full](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding/matter-attestation.md)
- Next: [Hand a device to a new owner without the old owner's access](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding/owner-transfer.md)
- [Provisioning and onboarding](https://agentwranglers.se/playbook/connected-devices/provisioning-and-onboarding.md)