Is it ok to use a MAC Address as a serial number in an SoC with BLE? Are there any security threats to this perhaps? Or drawbacks?


2 Answers 2


Yes it is ok, why wouldn't it be? Example is a cc2640 BLE chip from TI - here you can read the BLE MAC assigned by TI either by JTAG and Flash Programmer 2

enter image description here

or via the GAP protocol in software

GAPRole_GetParameter(GAPROLE_BD_ADDR, ownAddress);

What security risk would it present ? This is the information I get when I look it up.

Result for: 54-6C-0E-A0-4A-D5

Address Prefix 54:6C:0E

Vendor / Company Texas Instruments

Start Address 546C0E000000

End Address 546C0EFFFFFF

Company Address 12500 Ti Blvd Dallas Tx 75243 Us

  • \$\begingroup\$ Hi @sorenp, thank you for your answer. Just wanted to ensure that it is ok since I'm not sure if others have used it before as a serial no. \$\endgroup\$
    – Luke Galea
    Feb 12, 2020 at 9:57
  • \$\begingroup\$ I use it as a unique identifier, which it is, and then I have a service that allows a user to enter their own identifier. But the MAC is my fail safe. \$\endgroup\$
    – Sorenp
    Feb 12, 2020 at 9:58
  • \$\begingroup\$ Good to know. I was concerned because online I read that the MAC can be changed through software and so I did not want to risk having duplicate MACs. \$\endgroup\$
    – Luke Galea
    Feb 12, 2020 at 9:59

It depends on MAC Address (or more correctly, BDADDR) type. See Core V.5.2, 6.B.1.3.2. In BLE, there are two kinds of addresses:

  • Public, that are IEEE-allocated as per IEEE 802.3 MA-L (ex OUI) registry,

  • Random, that are not uniquely allocated at all. In turn, Random addresses may be:

    • Resolvable, they are short-lived and renewed periodically with some properties that make the address identifiable to whom knows something (IRK) about the device already (See 6.B.,

    • Unresolvable, they are short-lived and renewed periodically, but with no guarantee whatsoever,

    • Static, they are constant for a given device, but with no uniqueness guarantee, just a (somewhat) low probability of collision, look for birthday problem to see how likely it is for a 46-bit address (because two bits are fixed).

So, if you want to use BDADDR as an identifier guaranteed to be unique, you can use it for sure when address is of the Public type, not in other cases. Depending on manufacturer, and SoC variant, you may get a Public address or a Random address. Some vendors make it a feature listed in the datasheet, others not. If this is not listed in the features, this may change in time. Check with your vendor for confirmation.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.