2
\$\begingroup\$

I am looking to seamlessly connect multiple slaves to one bluetooth low energy master, however I do not want to go through the process of pairing each individual device. The pairing process takes too long and I don't want to manually do it if I have 100+ devices; however, one side effect of unpaired seems to be the lack of security between devices.

I have been doing A LOT of research into this to see if this is even viable and I can't seem to find a clear understanding. At first I was under the impression that 'Just Works' was a form of unpaired communication but I believe this is incorrect. It seems that 'Just work' is actually paired. If this is the case it might solve my second question on how one might go about securing such communication. Though the documentation I have read says that it is a legacy method and the security support for it might be poor.

I have found this link Is Bluetooth Communication Possible Without Pairing?. Which seems to conclude that unpaired is possible however this is through traditional bluetooth communication protocols. And it is a little unclear to me how this is different from pairing.

It seems that one side effect of unpaired communication might be the lack of security between devices. They wouldn't be able to set up the right keys to securely communicate.

Tl;dr - What would a paired bluetooth low energy connection look like vs an unpaired bluetooth low energy connection?

A few of the several links/documentation I've viewed:

https://blog.bluetooth.com/bluetooth-pairing-part-1-pairing-feature-exchange https://blog.bluetooth.com/bluetooth-pairing-part-2-key-generation-methods https://blog.bluetooth.com/bluetooth-pairing-passkey-entry https://blog.bluetooth.com/bluetooth-pairing-part-4 https://blog.bluetooth.com/bluetooth-pairing-part-5-legacy-pairing-out-of-band

Thanks

\$\endgroup\$
2
\$\begingroup\$

If you need security, you need pairing and bonding.

There is another term called "bonding" in BLE, which might be exactly what you want. Let me give you a short recap...

Pairing This is the process of key generation and setting up a secure communication for a connection. Of course, this involves some communication overhead (exchanging public keys, generating a common symmetric long term key, ...). You won't do that EVERY time you connect devices but just once.

Bonding After pairing, it is important to STORE the generated keys from the pairing process. This is called bonding. It enables two devices to securely communicate with each other with a key that was generated during the pairing process. After bonding, communication between devices has no overhead other than the cypher.

Just Works This is basically the input/output capabilities of your device. Consider a device without buttons or display. The only way to setup a secure communication is "just works", because there is no possibility to have additional passwords or numbers that can be exchanged out-of-band (e.g. pin code entry or NFC).

One other thing: In BLE, there is always "legacy" security and since version 4.2 the newer "LESC" security. LESC is the only one that is considered secure today.

\$\endgroup\$
  • \$\begingroup\$ Thank you for your answer. So when it comes to pairing, it sounds like it happens automatically once the master wants to connect to the slave device? Is it possible to have unpaired connections? If unpaired is possible it sounds like it is an unsecured channel for communication between devices, correct? \$\endgroup\$ – luckyging3r Apr 2 at 5:52
  • 1
    \$\begingroup\$ It is possible to have unpaired connections, but then the BLE native communication is not secure (Of course you can still do your "own" security measures on top of a unpaired connection). \$\endgroup\$ – Stefan Wyss Apr 2 at 5:57
  • \$\begingroup\$ One would have to encrypt everything before it goes through the characteristic write channels, yeah? And then be able to decrypt on the other side? So it would be kind of an makeshift pairing system. \$\endgroup\$ – luckyging3r Apr 2 at 6:03
  • \$\begingroup\$ Exactly. Just stick to the pairing/bonding process if you want security with BLE. \$\endgroup\$ – Stefan Wyss Apr 2 at 6:05
  • \$\begingroup\$ In addition to Stefan Wyss's answer, please have a look at this:- stackoverflow.com/questions/42862560/… \$\endgroup\$ – Youssif Saeed Apr 4 at 6:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.