Device Security

RE: Device Security

Hung Bui — Mon, 27 Apr 2015 09:08:24 GMT

@Ash: Of course it's possible. What needed for the device to set up whitelist mode is to have the central device's address if it's public or static address or the IRK if it's random resolvable address.

Note that "whitelist mode" is only available when advertising.

RE: Device Security

Ash — Fri, 24 Apr 2015 20:30:42 GMT

Hung, would it be possible to have our device enter "whitelist mode" upon successfully writing a particular sequence of characters to a specific characteristic?

RE: Device Security

Hung Bui — Tue, 21 Apr 2015 09:29:19 GMT

@Ash: It's not common to send a Long term key from one central to use on another. The LTK is bounded to the connection between a particular central and a peripheral.

I would suggest you have a look at the Bluetooth Core spec v4.2 for more information regarding whitelist , security, bonding and pairing. (Section 4.2.2 Part A Vol 1 to has an overview on whitelist, chapter 10 Part C Vol 3 on security aspects )

I would also recommend the Bluetooth Low Energy - The developer Handbook by Robin Heydon.

RE: Device Security

Ash — Mon, 20 Apr 2015 18:45:37 GMT

Thanks for the response. What would the process look like for authorizing a device to be on the whitelist? Is it possible to have one device generate a LongTermKey and store that key in our servers? Then when the wife wants to pair, her husband can transfer this key to her.

RE: Device Security

Hung Bui — Mon, 20 Apr 2015 11:49:06 GMT

@Ash: You can use whitelist to block other central devices that not in the list to connect to your device. You can have an option to enter non-whitelist mode to allow the husband/wife phone to connect and bond and be added to the whitelist.

Note that attacker can always clone an address to pass through the whitelisting (but won't be able to re-bond to the device because he doesn't have the LongTermKey)

Secondly, pairing procedure without out of band (OOB) key should be done in a protected environment that can avoid eavesdropping.