can private address be used to stop connection

RE: can private address be used to stop connection

RK — Thu, 05 May 2016 02:22:00 GMT

If you have the additional step that someone has sniffed a whitelisted device getting connected then yes you can replay the address and get as far as connection. That's true of any address type, resolvable private addresses aren't about security, they are about privacy.

Your second question doesn't make so much sense. You wouldn't usually share an IRK, an IRK is an identity and is coupled with all the encryption keys for that identity, you don't want two things to look like the same thing. You could if you wanted, but it wouldn't be usual. If you're asking how, after you bond with one device and move into a whitelist-only connection mode you can bond with a second one; either you drop the whitelisting, bond, then restart it with them both whitelisted, or you write something complicated to pass keys through the bonded device to add a second one.

RE: can private address be used to stop connection

andrewjfox — Thu, 05 May 2016 02:06:04 GMT

How does a new, legitimate, central bond with the device, if it's previously bonded with another central? Is there a way of 2 centrals sharing the IRKs so the new central can also connect to the peripheral?

RE: can private address be used to stop connection

andrewjfox — Thu, 05 May 2016 01:45:59 GMT

But if someone is eavesdropping and they see what address is trasmitted, when they want to connect can't they just echo the same address. Even if it's encrypted, the final result will match the entry in the whitelist, or do I have this wrong

RE: can private address be used to stop connection

RK — Thu, 05 May 2016 01:30:43 GMT

If you don't have the IRK you can't try to spoof the address, the private resolvable address is made up of a random part plus the same random part encrypted with the IRK.

If the peripheral is set up only to accept connections from whitelisted peers then it will deny connection from anything not on the list. If that list contains some resolvable private addresses, ie basically IRKs as that's the important part, it will deny connection to any resolvable private address it sees which was not constructed using an IRK in that list.