Bluetooth Key Generation – Part 1

A graphical walk through Bluetooth legacy pairing versus Secure Connections. Just Works uses an all-zero key and is trivially crackable; passkey entry adds only 20 bits of entropy to a 128-bit key. Secure Connections uses Diffie-Hellman so nothing usable crosses the air, making it the mode to enforce when security matters.

Key Takeaways

• Legacy Just Works pairing uses an all-zero temporary key, so a listener can crack the session key easily
• Passkey entry adds authentication but seeds a 128-bit key with only 20 bits of entropy, still crackable offline
• Secure Connections uses elliptic-curve Diffie-Hellman, so no secret usable to derive the key is ever transmitted
• Forcing Secure Connections is far more secure and is the right choice for sensitive applications

Video Transcript

I'm going to talk through, just for a minute, the difference between legacy pairing and secure connections. I described it briefly. But here graphically, you can see on the left the process of pairing with legacy mode, if you use Just Works, as you can see on that top red rectangle. Just Works uses a key that is zeros. So it's all zeros. And then it's going to hash that with some random nonces that get sent back and forth to generate the short-term key, after which it encrypts the link, sends a long-term key, and then you're off and running.

You can imagine if you use Just Works, that's really weak. That's very crackable because a temporary key that has 0 entropy is then used with some random information. If I just listen to this sequence, I can crack that key, no problem. In comparison, passkey entry, which is another mode that's available through legacy pairing, uses 6 digits of a decimal number as the temporary key. So that's the thing that pops up on one display that you have to enter on the other device.

So that at least enables authentication, but the process of creating the keys for encryption is very weak, that's only 20 bits of entropy to generate a 128-bit key. And because you're using AES-128, you think you're good. But you went through the process of generating a key that started with only 20 bits of entropy. So again, not as easily hackable as Just Works, but not hard either. So if you've listen to that sequence, you can crack that key offline, and then you've got access to everything that they're saying.

So moving beyond legacy pairing, you can see the problem there. Enforcing secure connections to be the process that your device goes through is a really good idea because that's going to use Diffie-Hellman exchange. The devices pick a point on an elliptic curve. They multiply that by their private keys. They share those public keys across. Do the multiplication with their own private keys from what they received, and they've got a shared key.

And at no point in time was anything shared that could reasonably be leveraged to crack the shared secret. So this is a solid mechanism for generating a key, and then they use a solid crypto scheme on top of that. So if you can force secure connections, that's going to be much more secure.