title: Secure BLE pairing - is it possible?
body: <p>I'm trying to make a BLE device that actually pairs securely. As far as I know the transport encryption (using AES) is secure in all versions of BLE, once the 'Long Term Key' has been exchanged.</p>
  <h3>BLE 4.1</h3>
  <p>BLE 4.1 and earlier use symmetric cryptography and the passkey (PIN) is only 6 digits so it is trivial to passively eavesdrop on the pairing, <a href="https://lacklustre.net/projects/crackle/" rel="noreferrer">brute-force the passkey</a> and derive the LTK from that. It seems that this was insecure by design because it was thought that low power BLE devices wouldn't have enough oomph to do asymmetric cryptography.</p>
  <h3>BLE 4.2</h3>
  <p>BLE 4.2 adds 'Secure Connections'. This is apparently <a href="https://pomcor.com/2015/06/03/has-bluetooth-become-secure/" rel="noreferrer">also broken</a> and what's more <a href="https://www.blackhat.com/presentations/bh-usa-08/Lindell/BH_US_08_Lindell_Bluetooth_2.1_New_Vulnerabilities.pdf" rel="noreferrer">it was broken in 2008</a> when the same pairing method was used in Bluetooth 2.1!! It doesn't totally break pairing - only the passkey entry method - and you only learn the passkey, not the LTK. But it does allow an attacker to perform a MitM attack if the passkey isn't changed for every pairing attempt.</p>
  <h3>Out-of-Band pairing</h3>
  <p>The Out-of-Band pairing method would be an excellent choice, then I can use a QR code or something. However there are no public APIs to access the OOB method on either Android or iOS. Android supports OOB pairing via NFC but iOS doesn't, so that's out.</p>
  <p>It seems the only option left is to implement a custom encryption scheme, but that is a ridiculous amount of work.</p>
  <p><strong>My questions are:</strong></p>
  <ol>
  <li><p>Why did the Bluetooth SIG specify a pairing method in BLE 4.2 that was already known to be insecure 6 years earlier?</p>
  </li>
  <li><p>Are there any existing encryption schemes for BLE that secure it? Ideally open source and well-tested, but could be commercial. Would I still be able to use GATT?</p>
  </li>
  </ol>