46	Bluetooth Security

It is important to stress the fact that the initialization key is used in only one pairing instance; afterward it is discarded.

3.4 Baseband events

At the baseband level, the LM protocol key management commands are turned into series of baseband events. The most important key management baseband events are those that support the pairing of two devices, the establishment of a link key, and the establishment of the ciphering offset and ciphering keys. Figure 3.1 gives an overview of the events.

As previously described, the LM initiates a pairing operation between two devices when the two devices meet the first time or a link key is missing due to other reasons. We recall from Table 2.1 that the Bluetooth system recognizes two types of link keys: semipermanent and temporary keys. There are two types of semipermanent link keys: unit keys and combination keys. Besides the combination key and the unit key, two other link key types are used: master and initialization keys.

A unit key is a link key that one device generates by itself and uses to pair with any other device, and a combination key is a key that a device generates in cooperation (combination) with another device. Therefore, the unit keys that a specific device shares with other paired devices are identical, whereas the combination keys are different for each pair of devices. Unit keys can only be safely used when there is full trust among the devices that are paired with a unit key, since every paired device can impersonate any other device holding the same unit key. For this reason, the use of unit keys has been deprecated in Bluetooth

Pairing

Combination

Pass-key

Initialization

KINIT

Link key

or unit key

Cipher offset

Authentication

key

generation

Public

random

Ciphering key

KC

values

generation

Key length

Encryption

Constraint key

K’C

constraints

generation

(pre) keys

Clock

Payload key

KP

generation

Figure 3.1 Overview of key management baseband events.

Bluetooth Pairing and Key Management	47

version 1.2. A further discussion on the vulnerabilities of the unit key can be found in Section 7.5.

A simple, yet important, step in the pairing procedure is the entering of the pass-key. From a baseband perspective, this means that the baseband cannot by itself complete the pairing but requires the input of the pass-key value. The pass-key is a byte string of 0 to 16 octets that is passed to the baseband. We come back to the details in Section 3.5, but for the moment one can imagine that the pass-key is entered via a man machine interface (MMI) interaction or a higher layer protocol.

3.4.1Initialization key generation

Initialization keys are short lived, temporary keys that are used during the pair-

ing of two devices. The initialization key, denoted by KINIT, is the link key during the initialization process when no combination or unit key is present. KINIT is

computed by the algorithm E22 from the claimant’s BD_ADDR, the entered

pass-key PKEY and its length LPKEY (in octets), and a 128-bit random value IN_RAND. In fact, KINIT is computed from the three values PKEY ′, L′PKEY, and

IN_RAND, where1

PKEY		BD _ ADDR			when LPKEY ≤	10
		BD _ ADDR [0K(15−			L )] when 10 < LPKEY ≤ 15 (3.1)
PKEY ′ = PKEY
					when LPKEY	= 16
PKEY
		L ′	= min	L	+ 6, 16	(3.2)
		PKEY		( PKEY	)

are derived from PKEY and BD_ADDR by the padding mechanism described above when the length of PKEY is less than 16 octets. Now we are able to compute KINIT by

K	INIT	= E	22	(PKEY ′, IN _ RAND, L ′	)	(3.3)
				PKEY

The details of E22 are given in Section 4.2.3.

3.4.2Unit key generation

Although the use of unit keys is deprecated due to the risks explained in Section 7.5, we describe for completeness, the baseband events that produce a unit key.

1. x y denotes the concatenation of the two strings x and y.

48	Bluetooth Security

The starting point is the case of two devices that have no possession of a link key for their connection.

Suppose device A is the initiator and B is the responding device. If A does not yet hold a unit key, it starts by generating one. If the unit key of device A is used, the unit key is denoted by KA. If, on the other hand, the unit key of unit B is used, the unit key is denoted by KB.

The unit key KA is computed by using the algorithm E21 from a locally generated (secret) 128-bit random value LK_RANDA and the units’ BD_ADDR; that is,

K A = E 21 (LK _ RANDA , BD _ ADDR A )

(3.4)

The details of E21 are given in Section 4.2.2. Once the unit key is generated, it is sent to device B. However KA is not sent by itself; instead, A sends

K ′A = K A K INIT

(3.5)

Hence, the unit key is encrypted by using the initialization key. See Figure 3.2. Since device B also knows the initialization key, the recovery of the key is simply performed by the computation.

K ′	K	INIT	= K	K	K =	K	A
A			A	INIT	INIT

where the latter follows from the properties of the (XOR) operation. Hence, unit B now also knows KA.

If both device A and device B require the use of a unit key, there will be a conflict. Hence, if the semipermanent link key between A and B is a unit key, it must be the unit key of either unit A or unit B.

Device A KINIT KINIT Device B

KA KA

Figure 3.2 Process of transferring the unit key KA to device B using the initialization key KINIT. The key KINIT is erased after the successful establishment of KAB = KA.

Bluetooth Pairing and Key Management	49

3.4.3Combination key generation

The combination key is a link key that two pairing devices A and B generate together. Like the unit key, the combination key is generated when the two devices possess no common link key. The combination key is computed by combining their respective secret keys, KA and KB. The two keys are generated from locally generated (secret) 128-bit random values (LK_RANDA and LK_RANDB, respectively) and the units’ BD_ADDR, using the algorithm E21. To be more precise,

K A	= E 21 (LK _ RAND A , BD _ ADDR A )	(3.6)
K B	= E 21 (LK _ RAND B , BD _ ADDR B )	(3.7)
The combination key KAB is then calculated as
	K AB = K A K B	(3.8)

The latter calculation is only possible to perform if the units know the secret key of the other unit. This is realized by sending the secret random values LK_RANDA and LK_RANDB to each other, protected by the current link key K. The current link key might be a KINIT or an existing combination key for the link. Thus, toward the final computation of KAB the units send

C A	= LK _ RAND A		K ,	sent by A to B	(3.9)
C B	= LK _ RAND B		K ,	sent by B to A	(3.10)
Now, say unit A receives CB and computes
C B K=	(LK _ RAND B		K ) =K LK _ RAND B
where the latter follows again from the properties of the					(XOR) operation.

Hence, unit A now knows LK_RANDB, and since it knows B ′s BD_ADDR value, it can compute KB using (3.6). Unit B determines the combination key in a similar fashion from the received value CA. Figure 3.3 illustrates the establishment of the combination key.

When two devices have exchanged a link key, the pairing is finalized with a (peer) authentication in which the devices prove to each other that they possess the correct link key. If the authentication fails, the pairing is not successful and a new pairing must be initiated.