SWRA846 July   2025 CC2642R-Q1

 

  1.   1
  2.   Abstract
  3. 1Analysis of Bluetooth Pairing Technology Principles
    1. 1.1 LE Legacy Pairing and LE Secure Connections Pairing
    2. 1.2 Analysis of Association Mode Security Characteristics
    3. 1.3 Privacy Protection and Address Management
  4. 2Common Issues in Pairing Encryption
    1. 2.1 Integrity Check Fault—MIC Verification Failure (MIC failure)
    2. 2.2 Abnormal Key Negotiation—DHKey Verification Failure (DHKey check fail)
    3. 2.3 Key Management Defect—PIN/Key Loss (PIN or Key missing)
      1. 2.3.1 Key Missing During Pairing Phase
      2. 2.3.2 LTK Missing During Encryption Phase
  5. 3A Solution for Encryption Resource Conflicts
    1. 3.1 Environment Selection and Configuration
    2. 3.2 Implementing AES-256 Encryption and Decryption Using TinyAES Library
    3. 3.3 System-Level Optimization Exploration
      1. 3.3.1 Memory Allocation Inspection
      2. 3.3.2 Padding Processing and Thread Safety
  6. 4Conclusion
  7. 5References

1.2 Analysis of Association Mode Security Characteristics

As mentioned above, the LE Legacy mode supports three association modes, while LE Secure Connections supports four association modes. The critical difference between the two protocol versions lies in the security foundation of the key generation mechanism: LE Legacy relies on short-term key exchanges that are vulnerable to cracking, whereas LE Secure Connections achieves permanent forward secrecy through the cryptographically stronger ECDH algorithm. Developers can enforce the LE Secure Connections mode to circumvent known vulnerabilities of LE Legacy at the protocol layer. Two devices that have established a Bluetooth connection will negotiate the association mode to be adopted by both parties at the early stage of connection establishment. For specific rules to follow, please see GAP Bond Manager and LE Secure Connections — SimpleLink™ CC13XX/CC26XX SDK BLE5-Stack User's Guide 2.2.11.00 documentation. The association modes supported by BLE devices are divided into four types, and their characteristics and differences are shown in the table below:

Table 1-1 Comparison of Four Association Modes
Association Mode Just Works Passkey Entry Numeric Comparison Out of Band
Core Mechanism No user authentication; pairing completes automatically. The user enters a 6-digit numeric password displayed on one device into the other device. Both devices display a 6-digit number, and the user confirms whether they are identical. Pairing information is securely exchanged in advance via non-BLE methods (such as NFC or QR codes).
User Interaction None The user must input the password. The user only needs to **confirm** whether the displayed values match. Usually only requires bringing the devices close together or scanning once.
Security Level Lowest Medium to High High Highest
Mitigation of MITM Attacks None Requires the attacker to know and input the correct password in real time to successfully execute an MITM attack. Requires the attacker to simultaneously tamper with the values displayed to the user on both devices without being detected. Relies on the security of the OOB channel (usually physical security).
Applicable Connection Method Legacy Pairing / Secure Connections Legacy Pairing / Secure Connections Secure Connections Legacy Pairing / Secure Connections
Key Generation Foundation STK/LTK STK/LTK LTK LTK
Applicable Scenarios Devices with low security requirements, or devices lacking input/output capabilities. One device has display capability (displays password) and the other has input capability (keyboard to input password). Devices where both sides possess display capabilities. Scenarios requiring the highest security or pursuing ultimate convenience; devices supporting identical OOB technologies on both sides.

In the security ranking of association modes, Just Works offers the lowest security, while the OOB method provides the highest security. The system will automatically select the most secure association mode for pairing based on the capabilities supported by both devices. For the complete secure association mode selection flow and detailed specifications, please refer to the Bluetooth Core Specification version v5.2 [Vol 3] Part H, Section 2.3.5.1, Table 2.7 and Table 2.8.