Bluetooth & BLE · Study deck

Pairing Methods and MITM Protection

A resident pairs a phone with a new door lock while another person waits in the hallway.

Radio Remi is your guide for this deck.

securitypairingmethods

Radio Remi, the module guide, in a scene from this chapter.

After studying this chapter

Learning objectives

You will be able to:

Explain the BLE Pairing Protocol: Describe the three-phase pairing sequence and what keys are exchanged in each phase
Compare Pairing Methods: Analyze Just Works, Passkey Entry, Numeric Comparison, and OOB pairing across security level and I/O requirements
Diagnose Just Works Vulnerabilities: Justify why TK=0 in legacy Just Works provides no MITM protection and when it is acceptable
Select Appropriate Pairing: Evaluate device capabilities and threat model to choose and configure the correct pairing method

Major section

Start With the Story

A resident pairs a phone with a new door lock while another person waits in the hallway.

The important question is whether the resident confirmed the intended lock or merely accepted the first nearby request.
A secure link cannot repair a weak choice of partner made at the start.
This test does not protect a device whose screen, code, or stored keys are already under an attacker's control.

Major section

Why Bluetooth Security Matters

Analogy: Bluetooth security is like locking your front door.

No security = Leaving door wide open (anyone can walk in).
Wearables: unencrypted or weakly authenticated links can expose private health or location-adjacent data.
Medical devices: default or static passkeys weaken the pairing ceremony and can put treatment workflows at risk.

Major section

"Just Works" Pairing: A Critical Security Flaw

Attacker completes "Just Works" pairing (no user verification required).

BLE's "Just Works" pairing mode provides zero authentication and is vulnerable to Man-in-the-Middle (MITM) attacks.
Attacker intercepts pairing request before legitimate user connects.
Medical device: A weak app policy may expose health data or treatment controls.

Major section

"Just Works" Pairing: A Critical Security Flaw (continued)

In Legacy Pairing, Just Works sets the Temporary Key (TK) to zero, meaning the Short Term Key (STK) derivation has no user-supplied entropy.

Attacker gains a bond and can access data or commands permitted to that bond unless application authorization blocks them.
Smart lock: A weak app policy may let an unauthorized bond unlock a door.
Payment terminal: A weak app policy may expose transaction data.

Major section

Alternative View: Pairing Security as Defense Layers

Think of pairing methods as concentric security layers. "Just Works" is an unlocked door - attackers walk right through.

Each stronger method (Passkey, Numeric Comparison, OOB) adds a verification barrier that creates progressively more resistance to MITM attackers.

BLE pairing methods as defense layers from Just Works through Passkey Entry, Numeric Comparison, and Out of Band setup.

Major section

BLE Pairing Process

The BLE pairing process establishes secure communication through distinct decisions.

Phase II authenticates according to that method and establishes protection for the current exchange.
This order connects the method choice above to the key roles below and shows why “paired” is too vague for an audit record.
Key generation and authentication depend on the selected pairing method.

Source: University of Edinburgh IoT Security Course

Major section

Academic Reference: BLE Numeric Comparison Authentication (University of Edinburgh)

Pairing proceeds only after the user verifies that the displays match.

An active relay establishing two different key exchanges cannot silently make both authenticated transcripts agree.

BLE numeric comparison pairing protocol flow

Major section

Common Beginner Mistakes

Mistake 1: "My device has Bluetooth, so it's secure".

Wrong!: Many BLE devices use "Just Works" pairing (no MITM protection during setup).
Wrong!: If pairing mode is "Just Works", password doesn't help.
Mistake 3: "Bluetooth only works 10 meters, so I'm safe from hackers".

Major section

Common Misconception: "My Device Has Encryption, So It's Secure"

The misconception: "If BLE link encryption is enabled, my system is secure.".

The reality: Link encryption protects confidentiality/integrity after two devices agree on keys.
The pairing method and your authorization logic determine who gets those keys and what they can do.
BLE link-layer encryption is AES-CCM with 128-bit keys (you do not "choose AES-256" at the BLE link layer).

Major section

Dig Deeper and Practice

BLE pairing security is a setup ceremony, not just a cipher choice.

Just Works can encrypt a link but gives no user-authenticated MITM protection.
LE Secure Connections uses P-256 ECDH to protect against passive key recovery, while Numeric Comparison, Passkey Entry, or OOB evidence is still needed for active MITM resistance.
High-impact products should reject silent fallback to Just Works and explain pairing-security mismatches to users.

Deck summary

Key takeaways

A resident pairs a phone with a new door lock while another person waits in the hallway.

Analogy: Bluetooth security is like locking your front door.
Attacker completes "Just Works" pairing (no user verification required).
In Legacy Pairing, Just Works sets the Temporary Key (TK) to zero, meaning the Short Term Key (STK) derivation has no user-supplied entropy.
Think of pairing methods as concentric security layers. "Just Works" is an unlocked door - attackers walk right through.

Retrieval practice

Recall check 1 of 5

Radio Remi says: answer from memory, then check your reasoning.

Q1A reviewer is checking the Bluetooth security decision for this topic. Which evidence keeps the claim bounded?

AA statement that Bluetooth is common in consumer devices, without checking this deployment

BA successful connection screenshot with no power, security, or failure-behavior evidence

CPairing method, I/O assumptions, key storage, encryption level, authorization boundary, recovery plan.

DA decision to defer retest triggers until after deployment problems appear

Show answer

Answer: C Bluetooth security review should separate pairing, encryption, key management, authorization, and recovery evidence.

Retrieval practice

Recall check 2 of 5

Radio Remi says: answer from memory, then check your reasoning.

Q2A BLE medical glucose monitor has a small display and two Yes/No buttons. The phone also displays and confirms a number; neither device has a protected OOB channel. Which pairing method fits these capabilities?

AJust Works, chosen only because it asks less of the user during pairing.

BNumeric Comparison, using the two displays and Yes/No confirmation buttons.

CPasskey Entry, assuming two Yes/No buttons can enter a six-digit PIN.

DNFC OOB, chosen even though the described devices have no protected NFC path.

Show answer

Answer: B With a display and Yes/No buttons, the monitor satisfies the I/O requirements for Numeric Comparison.

Retrieval practice

Recall check 3 of 5

Radio Remi says: answer from memory, then check your reasoning.

Q3What is the primary security weakness of BLE 'Just Works' pairing?

AIt uses easily broken AES-64 as the encryption mode for a BLE link.

BIt lacks authenticated user verification during the pairing exchange.

CIt works only with Classic Bluetooth and cannot pair BLE devices.

DIt requires two display screens, unlike the stated headless devices.

Show answer

Answer: B Just Works has zero authentication bits -- there is no verification step during pairing.

Retrieval practice

Recall check 4 of 5

Radio Remi says: answer from memory, then check your reasoning.

Q4What is the key security trade-off when enabling BLE bonding?

ABonding disables encryption to make later reconnections faster.

BBond keys speed reconnection but become sensitive stored secrets.

CBonding stops either device from connecting to any other peer.

DBonding works only with Numeric Comparison, not other pairing modes.

Show answer

Answer: B Bonding requests retention of pairing keys for future reconnections; IRK and CSRK are stored only if those keys were negotiated and distributed.

Retrieval practice

Recall check 5 of 5

Radio Remi says: answer from memory, then check your reasoning.

Q5A displayless BLE smart lock has a protected NFC commissioning path that transfers fresh, authenticated OOB pairing proof to the owner's phone. Which pairing method fits this design?

AJust Works, because no lock display exists to check pairing identity.

BPasskey Entry using a fixed PIN printed on the exterior lock body.

CNFC Out-of-Band pairing with the protected fresh commissioning proof.

DNumeric Comparison showing a code only on the user's phone screen.

Show answer

Answer: C Protected NFC OOB pairing can authenticate the commissioning exchange for this displayless lock.

Print reference

Answers 1 of 2

Answer key.

C · Bluetooth security review should separate pairing, encryption, key management, authorization, and recovery evidence.
B · With a display and Yes/No buttons, the monitor satisfies the I/O requirements for Numeric Comparison.
B · Just Works has zero authentication bits -- there is no verification step during pairing.
B · Bonding requests retention of pairing keys for future reconnections; IRK and CSRK are stored only if those keys were negotiated and distributed.

Print reference

Answers 2 of 2

Answer key.

C · Protected NFC OOB pairing can authenticate the commissioning exchange for this displayless lock.