Hi Pavel, Den tors 14 feb. 2019 kl 14:59 skrev Pavel Machek <pavel@xxxxxx>: > > Hi! > > Currently, "no keyboard, no display" devices can be paired, but > pairing is not secure against active attacker. > > Can we do better? Not for the first pairing; but for the next ones -- > yes, I believe we can. > > BLE device in this case has internal storage, and Linux running > there. From factory, random 6-digit number is stored in the > flash. Legitimate user knows the number, and system is manipulated so > that pairing passkey will be this pre-shared passkey. After pairing, > user is allowed to change it. > > [Or maybe passkey is 000000 from the factory; this is still win for > the user, as long as he can change the key to something random in a > secure cave.] > > Fortunately, kernel support for this is rather easy; patch is attached > below. > > Does someone see a security issue with proposal above? Assuming "LE Secure Connections" is used, the protocol is only secure if the passkey is not reused. A 6 digit passkey means 20 bits. The protocol is performed in 20 steps, where one bit is compared and revealed in every step. This means the attacker will know for every attempt the first bit that is incorrect in the attempted passkey. If the passkey is reused, the attacker can just try the same passkey with the incorrect bit flipped. In average it takes 10 attempts to crack the key and maximum 20 attempts. Hence, a static key doesn't really add much security compared to Just Works and might give a false sense of security. A static key for Legacy Pairing has comparable security as using a random key. The security is kind of the same as logging in to a website over unencrypted HTTP, assuming the static key is stored on the peripheral and the user enters the passkey on the central. In the case where the passkey is entered by the user on the peripheral instead of the central, the protocol is completely broken (https://eprint.iacr.org/2013/309.pdf). /Emil
