Securing BLE device

RE: Securing BLE device

Petter Myhre — Thu, 05 Jan 2017 08:19:11 GMT

Yes, a static passkey can be bruteforced in a hostile environment. It is up to you, anyways, this got a bit cluttered, is there anything specific I can help you with?

RE: Securing BLE device

gaminn — Thu, 05 Jan 2017 08:10:11 GMT

I mean 6 digits passkey can be bruteforced easily. But maybe I can live with the passkey as long as bad passkey entry means my BLE peripheral will ignore any connections for several tens of seconds after that so the bruteforce attack takes very long time.

RE: Securing BLE device

Petter Myhre — Thu, 05 Jan 2017 07:46:57 GMT

I don't understand, if we assume we pair in a secure environment, there is no hacker there.

RE: Securing BLE device

gaminn — Wed, 04 Jan 2017 15:10:11 GMT

Yes, but the passcode has only 6 digits, so it can be hacked quite easily.

RE: Securing BLE device

Petter Myhre — Wed, 04 Jan 2017 13:06:18 GMT

If you pair in a secure environment passkey pairing is secure.

RE: Securing BLE device

gaminn — Wed, 04 Jan 2017 12:49:41 GMT

I don't consider passkey pairing to be secure. What I considered was OOB pairing but Android smartphone will connect to the peripheral and I think it is not possible to use OOB on Android (at least without NFC - my peripherals don't have NFC). Also BLED112 on standard PC will connect to the peripherals.

RE: Securing BLE device

Petter Myhre — Wed, 04 Jan 2017 12:33:26 GMT

Sorry, I missed the secure environment part. Then it can work, but maybe you can use passkey pairing for this? And if the peripheral doesn't have any IO you can consider using static passkey. What kind of centrals will connect to the peripheral? Smart phones? Or something else?

RE: Securing BLE device

gaminn — Wed, 04 Jan 2017 12:11:49 GMT

It is simple - initially, the password is sent in secure environment. Subsequently, the connection is established using stored bonding information. I want only authorized users who were given the password to read/write to BLE peripheral. Or is there a better solution?

RE: Securing BLE device

Petter Myhre — Wed, 04 Jan 2017 10:55:38 GMT

It is not very hard to implement this, but it doesn't sound very secure. If you send the password over the air unencrypted anyone can get the password and use it later. Could you explain a bit more in regards to what you want to achieve with this?