does static passkey provide MITM protection after BLE4.2 ?

RE: does static passkey provide MITM protection after BLE4.2 ?

Stayhungry — Mon, 14 May 2018 14:37:54 GMT

Thanks, Mttrinh. Great answer

RE: does static passkey provide MITM protection after BLE4.2 ?

Mttrinh — Mon, 14 May 2018 14:30:17 GMT

Sorry, what I meant was that it is a low probabilty to guess the passkey, so for brute-force guesser it will take some time to connect to a device. For eavesdroppers, who can sniff the static passkey pairing transmission between two devices, it won't be difficult to get a hold of the passkey. So it is like you said once the static passkey is known it won't be secure at all.

Static passkey will only help you avoid that users connect to the wrong device in a multi-device environment. If you need protection against MITM-attacks, you should use a random passkey with a display.

RE: does static passkey provide MITM protection after BLE4.2 ?

Stayhungry — Mon, 14 May 2018 13:28:36 GMT

Just like Turbo J said, the MitM has all that is needed to perfectly fake the device once the static password is known.

As I said in the question, getting a static passkey doesn't seem to be difficult, just need a sniffer ?

So I think the static passkey cannot provide MITM protection. But there are many static passkey usages in the community, but I don't understand what the purpose of doing so is.

RE: does static passkey provide MITM protection after BLE4.2 ?

Turbo J — Mon, 14 May 2018 13:16:55 GMT

Why the "low probability"? The MitM has all that is needed to perfectly fake the device once the static password is known.

This is the worst case - software allows setting mitm bit but is actually not mitm- safe.

RE: does static passkey provide MITM protection after BLE4.2 ?

Mttrinh — Mon, 14 May 2018 12:55:18 GMT

Hi,

You will be able to get "MITM protection" when using static passkey, it's just that it isn't totally secure from MITM attacks. It is a relatively low probability for success.