Snippet 20: Fixed Coordinate Invalid Curve Attack

The Fixed Coordinate Invalid Curve attack is a flaw in the Bluetooth standard itself rather than any one implementation: weaknesses in how the elliptic-curve key exchange is authenticated give an active attacker up to a fifty percent chance of recovering the encryption key.

Key Takeaways

• The weakness is standard-compliant: the flaw sat in the Bluetooth specification, not in a vendor’s code
• Only the hashed x-coordinate of the key exchange is authenticated, freeing an attacker to choose a convenient y-coordinate
• An active attacker recovers the long-term key twenty-five to fifty percent of the time depending on how aggressively they inject
• Once the key is recovered, all encrypted Bluetooth traffic between the devices is readable

Video Transcript

Fixed Coordinate Invalid Curve Attack. This one is a lot more mathy than the other attacks. The idea is that Bluetooth uses elliptic curve Diffie-Hellman key exchange to exchange this long-term key. And if you dig into the specifics of that, there's certain mechanisms that Bluetooth does that aren't secure. And so this is a standard compliant attack. It's an actual problem with the Bluetooth standard, not with implementations. The attack model is that the attacker does need to transmit a little bit.

And they also need to be able to receive the key exchange sequence without missing anything. So I think the paper was published in '19, but they did the disclosure and the updates in '18. So a very high level idea in elliptic curve cryptography. You've got your key parameterized by x and y-coordinates among other parameters. And Bluetooth basically sends out hash versions of the x and y-coordinates, which is more information that needs to send. And that allows the attacker to reverse engineer the key.

What's worse is that only the hash x-coordinate is authenticated, which gives the attacker the freedom to pick whatever y-coordinate they want. And the paper notes that if the attacker picks y equals 0, that makes things easy for this attack, and that's what makes the attack possible.

So the net result of it is that, depending on several factors, an attacker has a 25% to 50% chance, depending on how active they are, whether they're just injecting key packets at one point in the process, or if they're doing it at two separate points in the process. They'll have either 25% or 50% chance of getting the key. And then once you have the key, you're able to see all the encrypted traffic.