Overview of the security weaknesses in Bluetooth Dave Singelée COSIC seminar 11/06/2003

Outline of the talk 1. Introduction 2. Protocols in Bluetooth 3. Security problems 4. Recommendations / solutions 5. Conclusion

Outline of the talk 1. Introduction 2. Protocols in Bluetooth 3. Security problems 4. Recommendations / solutions 5. Conclusion

Personal Area Network (PAN) Small number of mobile devices Heterogeneous Ad-hoc network Wireless (WPAN) Small range

Personal Area Network (PAN)

Constraints Limited battery power Computational power Small amount of memory Small range Ad-hoc network Not always I/O-interface

Different technologies Infrared (IrDA) Radio propagation (Bluetooth) Human body (Body Area Networks) …

Different technologies Infrared (IrDA) Radio propagation (Bluetooth) Human body (Body Area Networks) …

Bluetooth 1998: Bluetooth SIG IEEE Range < 10m 2.4 GHz ISM band Spread spectrum & frequency hopping 1 Mbit/s Piconets: 1 master and up to 7 slaves

Outline of the talk 1. Introduction 2. Protocols in Bluetooth 3. Security problems 4. Recommendations / solutions 5. Conclusion

My colour convention XXX = public value XXX = secret value XXX = sent in clear XXX = sent encrypted

Protocols in Bluetooth 1. Generation of unit key 2. Generation of initialization key 3. Generation of link key 4. Mutual authentication 5. Generation of encryption key 6. Generation of key stream 7. Encryption of data

1. Generation unit key E21 RAND A ADDR A KAKA

2. Generation initialization key E22 PIN IN_RAND PIN LL IN_RAND K init

3. Generation link key (1) K init K A = K link K K init K A = K link

3. Generation link key (2) K AB = K link LK_RAND A LK_RAND B E21 ADDR A ADDR B LK_RAND A LK_RAND B K AB = K link ADDR B ADDR A LK_RAND B LK A LK B

4. Mutual authentication ADDR B E1 ADDR B AU_RAND K link AU_RAND SRES AU_RAND K link ADDR B SRES ACO

5. Generation encryption key EN_RAND E3 EN_RAND K link ACO KCKC KCKC

6. Generation key stream E0 ADDR A clock MASTER KCKC K CIPHER ADDR A clock MASTER KCKC

7. Encryption of data K CIPHER DATA

Outline of the talk 1. Introduction 2. Protocols in Bluetooth 3. Security problems 4. Recommendations / solutions 5. Conclusion

Most important security weaknesses Problems with E0 Unit key PIN Problems with E1 Location privacy Denial of service attacks

Problems with E0 Output (K CIPHER ) = combination of 4 LFSRs Key (K C ) = 128 bits Best attack: guess some registers -> 2 66 (memory and complexity)

Unit key K A = K link AB

Unit key K A = K link A C B K A = K’ link

PIN Some devices use a fixed PIN (default=0000) Security keys = security PIN !!!! Possible to check guesses of PIN (SRES) -> brute force attack Weak PINs (1234, 5555, …)

Problems with E1 E1 = SAFER+ Some security weaknesses (although not applicable to Bluetooth) slow

Location privacy Devices can be in discoverable mode Every device has fixed hardware adress Adresses are sent in clear -> possible to track devices (and users)

Denial of service attacks Radio jamming attacks Buffer overflow attacks Blocking of other devices Battery exhaustion (e.g., sleep deprivation torture attack)

Other weaknesses No integrity checks No prevention of replay attacks Man in the middle attacks Sometimes: default = no security …

Outline of the talk 1. Introduction 2. Protocols in Bluetooth 3. Security problems 4. Recommendations / solutions 5. Conclusion

Recommendations Never use unit keys!!!! Use long and sufficiently random PINs Always make sure security is turned on …

Interesting solutions Replace E0 and E1 with AES Use MACs to protect integrity Pseudonyms Identity based cryptography Elliptic curves Use MANA protocols instead of PIN Use network layer security services (IPSEC) to provide end-to-end security

Outline of the talk 1. Introduction 2. Protocols in Bluetooth 3. Security problems 4. Recommendations / solutions 5. Conclusion

Conclusion Bluetooth has quite a lot of security weaknesses! Need for secure lightweight protocols More research needed!!

Questions ?