728x90

 

TK : Temporary Key
STK를 만들기 위해 생성(128bit Numeric)

STK : Short Term Key
s1 함수의 경우 입력 매개변수에는 다음이 포함
* TK (Temporary Key)
* Srand (응답장치가 생성한 난수)
* Mrand (시작장치가 생성한 난수)

페어링된 장치는 STK와 암호화된 연결 사용

LTK : Long Term Key
링크키 개념, 다음 연결에 사용, MITM 공격 방지

IRK : Identify Resolving Key
private random address를 public address로 분석하는데 사용되는 키
pairing할 때 LTK, IRK를 저장

 

728x90
728x90

Security algorithms

secure only connection : secure connection만 연결 받아줌

secure connection : LMP feature ext host/controller supported 가 있음(SSP, encryption 지원 여부도 있음)

 

Level 4 : secure connection

Level 3 : secure connection을 지원하지 않을 경우 :SSP는 지원

Level 2 : SSP 지원하지 않음, encryption은 지원

Level 1 : SSP를 지원하지 않고 core 2.0 이하일 경우

Level 0 : security 사용하지 않음(profile에서 none으로 설정하는 경우에만 사용할 수 있음)

 

 

 

Chip level

  • SHA - Secure Hash Algorithms
  • HMAC - Hash-based message authentication code
  • RSA - Rivest–Shamir–Adleman ( A public-key cryptosystem )
  • ECC - Elliptic-curve cryptography
  • ECDH - Elliptic Curve Diffie-Hellman Exchange
  • ECDSA - Elliptic Curve Digital Signature Authentication
  • SE - Secure enclave
728x90
728x90

Nomenclature

 

Active Peripheral Broadcast(APB) The logical transport that is used to transport L2CAP user traffic and some kinds of LMP traffic to all active devices in the piconet over the BR/EDR Controller. See Section 3.5.4.4
Ad Hoc Network A network typically created in a spontaneous manner. An ad hoc network requires no formal infrastructure and is limited in temporal and spatial extent.
Advertiser A Bluetooth Low Energy device that broadcasts advertising packets during advertising events on advertising channels
Advertising event A series of between one and three advertising packets on different advertising physical channels sent by an advertiser.
Advertising Packet A packet containing an advertising PDU. See [Vol 6] Part B, Section 2.3.1
Angle of Arrival (AoA) Angle of Arrival is the relative direction at which a propagating RF wave that was transmitted by a single antenna is incident on an antenna array.
Angle of Departure (AoD) Angle of Departure is the relative direction from which a propagating RF wave that was transmitted using an antenna array is incident on another antenna.
BD_ADDR The Bluetooth Device Address, BD_ADDR, is used to identify a Bluetooth device.
Bluetooth Bluetooth is a wireless communication link, operating in the unlicensed ISM band at 2.4 GHz using a frequency hopping transceiver. It allows real-time AV and data communications between Bluetooth Hosts. The link protocol is based on time slots.
Bluetooth Baseband The part of the Bluetooth system that specifies or implements the medium access and physical layer procedures to support the exchange of real-time voice, data information streams, and ad hoc networking between Bluetooth Devices.
Bluetooth Clock A 28 bit clock internal to a BR/EDR Controller sub-system that ticks every 312.5 µs. The value of this clock defines the slot numbering and timing in the various physical channels.
Bluetooth Controller A generic term referring to a Controller.
Bluetooth Device A device that is capable of short-range wireless communications using the Bluetooth system.
Bluetooth Device Address A 48 bit address used to identify each Bluetooth device.
BR/EDR Bluetooth basic rate (BR) and enhanced data rate (EDR).
BR/EDR Controller A term referring to the Bluetooth Radio, Baseband, Link Manager, and HCI layers.
BR/EDR Piconet Physical Channel A Channel that is divided into time slots in which each slot is related to an RF hop frequency. Consecutive hops normally correspond to different RF hop frequencies and occur at a standard hop rate of 1600 hops per second. These consecutive hops follow a pseudo-random hopping sequence, hopping through a 79 RF channel set, or optionally fewer channels when Adaptive Frequency Hopping (AFH) is in use.
BR/EDR/LE Bluetooth basic rate (BR), enhanced data rate (EDR) and low energy (LE).
C-plane Control plane
Channel Either a physical channel or an L2CAP channel, depending on the context.
Channel Sounding A Bluetooth Low Energy feature that measures and distributes information that can be used to approximate distances between devices.
Channel Sounding event A group of Channel Sounding subevents that are anchored from a common LE connection event.
Channel Sounding procedure A group of Channel Sounding events that are sequenced serially for the purpose of gathering information useful for estimating the distance between two devices.
Channel Sounding step In Channel Sounding, an individual exchange between two devices.
Channel Sounding subevent A group of Channel Sounding steps that are associated with a specific coherent timing.
Connect (to service) The establishment of a connection to a service. If not already done, this also includes establishment of a physical link, logical transport, logical link and L2CAP channel.
Connectable device A BR/EDR device in range that periodically listens on its page scan physical channel and will respond to a page on that channel. An LE device that is advertising using a connectable advertising event.
Connected devices Two BR/EDR devices and with a physical link between them.
Connecting A phase in the communication between devices when a connection between the devices is being established. (Connecting phase follows after the link establishment phase is completed.)
Connection A connection between two peer applications or higher layer protocols mapped onto an L2CAP channel.
Connection establishment A procedure for creating a connection mapped onto a channel.
Connection event A series of one or more pairs of interleaving data packets sent between a Central and a Peripheral on the same physical channel.
Connectionless Peripheral Broadcast (CPB) A feature that enables a Central to broadcast information to an unlimited number of Peripherals.
Connectionless Peripheral Broadcast Receiver A Bluetooth device that receives broadcast information from a Connectionless Peripheral Broadcast Transmitter. The device is a Peripheral of the piconet.
Connectionless Peripheral Broadcast Transmitter A Bluetooth device that sends Connectionless Peripheral Broadcast messages for reception by one or more Connectionless Peripheral Broadcast receivers. The device is the Central of the piconet.
Controller A collective term referring to all of the layers below HCI.
Coverage area The area where two Bluetooth devices can exchange messages with acceptable quality and performance.
Creation of a secure connection A procedure of establishing a connection, including authentication and encryption.
Creation of a trusted relationship A procedure where the remote device is marked as a trusted device. This includes storing a common link key for future authentication, or pairing, when a link key is not available.
Device discovery A procedure for retrieving the Bluetooth Device Address, clock, and Class of Device from discoverable devices.
Discoverable device A BR/EDR device in range that periodically listens on an inquiry scan physical channel and will respond to an inquiry on that channel. An LE device in range that is advertising with a connectable or scannable advertising event with a discoverable flag set in the advertising data. This device is in the discoverable mode.
Discoverable Mode A Bluetooth device that is performing inquiry scans in BR/EDR or advertising with a discoverable or connectable advertising event with a discoverable flag set in LE.
Discovery procedure A Bluetooth device that is carrying out the inquiry procedure in BR/EDR or scanning for advertisers using a discoverable or connectable advertising event with a discoverable flag set in LE.
HCI The Host Controller interface (HCI) provides a command interface to the baseband Controller and link manager and access to hardware status and control registers. This interface provides a uniform method of accessing the Bluetooth baseband capabilities.
Host A logical entity defined as all of the layers below the non-core profiles and above the Host Controller interface (HCI); i.e., the layers specified in Volume 3. A Bluetooth Host attached to a Bluetooth Controller may communicate with other Bluetooth Hosts attached to their Controllers as well.
Initiator From the perspective of an advertising bearer, a Bluetooth Low Energy device that listens on advertising physical channels for connectable advertising events to form connections. From the perspective of Channel Sounding, the device that transmits first within a Channel Sounding step. 
Inquiring device A BR/EDR device that is carrying out the inquiry procedure. This device is performing the discovery procedure.
Inquiry A procedure where a Bluetooth device transmits inquiry messages and listens for responses in order to discover the other Bluetooth devices that are within the coverage area.
Inquiry scan A procedure where a Bluetooth device listens for inquiry messages received on its inquiry scan physical channel.
Interoperability The ability of two or more devices to exchange information and to use the information that has been exchanged.
Isochronous data Information in a stream where each information entity in the stream is bound by a time relationship to previous and successive entities.
Known device A Bluetooth device for which at least the BD_ADDR is stored.
L2CAP Logical Link Control and Adaptation Protocol
L2CAP Channel A logical connection on L2CAP level between two devices serving a single application or higher layer protocol.
L2CAP Channel establishment A procedure for establishing a logical connection on L2CAP level.
LE Bluetooth Low Energy
Link Shorthand for a logical link.
Link establishment A procedure for establishing the default ACL link and hierarchy of links and channels between devices.
Link key A secret key that is known by two devices and is used to authenticate the link.
LMP authentication An LMP level procedure for verifying the identity of a remote device.
LMP pairing A procedure that authenticates two devices and creates a common link key that can be used as a basis for a trusted relationship or a (single) secure connection.
Logical link The lowest architectural level used to offer independent data transport services to clients of the Bluetooth system.
Logical transport Shared acknowledgment protocol and link identifiers between different logical links.
Name discovery A procedure for retrieving the user-friendly name (the Bluetooth Device Name) of a connectable device.
Packet Format of aggregated bits that are transmitted on a physical channel.
Page The initial phase of the connection procedure where a device transmits a train of page messages until a response is received from the target device or a time-out occurs.
Page scan A procedure where a device listens for page messages received on its page scan physical channel.
Paging device A Bluetooth device that is carrying out the page procedure.
Paired device A Bluetooth device for which a link key has been created (either before connection establishment was requested or during connecting phase).
Passkey A 6-digit number used to authenticate connections when Secure Simple Pairing is used.
Periodic advertising synchronization information The control information describing a periodic advertisement that a Bluetooth Low Energy device uses to synchronize to the advertisement it describes.
Physical Channel Characterized by synchronized occupancy of a sequence of RF carriers by one or more devices. A number of physical channel types exist with characteristics defined for their different purposes.
Physical link A Baseband or Link Layer level connection between two devices.
Physical Transport PHY packet transmission and/or reception on an RF channel using one or more modulation schemes.
Piconet A collection of devices (up to eight devices in BR/EDR, exactly two devices in LE) occupying a shared physical channel where one of the devices is the Piconet Central and the remaining devices are connected to it.
Piconet Central The BR/EDR device in a piconet whose Bluetooth Clock and Bluetooth Device Address are used to define the piconet physical channel characteristics. The LE device in a piconet which initiates the creation of the piconet, chooses the Access Address that identifies the piconet, and transmits first in each connection event. 
Piconet Peripheral Any BR/EDR device in a piconet that is not the Piconet Central, but is connected to the Piconet Central. The LE device in a piconet which is not the Central but communicates with it.
PIN A user-friendly number that can be used to authenticate connections to a device before pairing has taken place.
Profile Broadcast Data (PBD) A logical link that carries data from a Connectionless Peripheral Broadcast Transmitter to one or more Connectionless Peripheral Broadcast Receivers.
Pseudo-Noise Bit Sequence A series of bits that are generated randomly.
Reflector In Channel Sounding, the device that transmits second within a Channel Sounding step in response to a transmission from an initiator.
Resolving List A list of records used to generate and resolve Resolvable Private Addresses. Each record contains a local Identity Resolving Key, a peer Identity Resolving Key, and a peer Identity Address.
Round-Trip Time The time it takes for a packet to travel from an originating device to a responding device and back again to the originating device.
Scanner A Bluetooth Low Energy device that listens for advertising events on the advertising physical channels.
Scatternet Two or more piconets that have one or more devices in common.
Service discovery Procedures for querying and browsing for services offered by or through another Bluetooth device.
Service Layer Protocol A protocol that uses an L2CAP channel for transporting PDUs.
Silent device A Bluetooth enabled device appears as silent to a remote device if it does not respond to inquiries made by the remote device.
Synchronization Scan Physical Channel A physical channel that enables a Peripheral to receive synchronization train packets from a Central.
Synchronization Train A series of packets transmitted on a set of fixed frequencies that deliver sufficient information for a receiving device to start receiving corresponding Connectionless Peripheral Broadcast packets or to recover the current piconet clock after missing a Coarse Clock Adjust.
Tick (BR/EDR) the time between changes of the value of the Bluetooth Clock: 312.5 µs.
U-plane User plane
Unknown device A Bluetooth device for which no information (Bluetooth Device Address, link key or other) is stored.
728x90
728x90

LIST OF ACRONYMS AND ABBREVIATIONS

 

Acronym or
abbreviation
Writing out in full Comments
8DPSK 8 phase Differential Phase Shift Keying 3 Mb/s modulation type used by Enhanced Data rate
AAD Additional Authenticated Data  
ACI Antenna Configuration Index  
ACK Acknowledge/Acknowledgment  
ACL Asynchronous Connection-oriented [logical transport] Reliable or time-bounded, bi-directional, pointto-point
ACL-C ACL Control [logical link] (LMP)  
ACL-U ACL User [logical link] (L2CAP)  
ACO Authenticated Ciphering Offset  
AD Advertising Data  
Adv_idx Advertising channel index  
ADVB LEAdvertising Broadcast  
ADVB-C LE Advertising Broadcast Control(Logical Link)  
ADVB-U LE Advertising Broadcast User Data (Logical Link)  
ADI AdvDataInfo  
AES Advanced Encryption Standard  
AES-CCM Advanced Encryption Standard - Counter with CBC-MAC  
AFH Adaptive Frequency Hopping  
AHS Adapted Hop Sequence  
AoA Angle of Arrival  
AoD Angle of Departure  
APB Active Peripheral Broadcast [logical transport] Unreliable, uni-directional broadcast to any devices synchronized with the physical channel
APB-C APB Control [logical link] (LMP)  
APB-U APB User [logical link] (L2CAP)  
ARQ Automatic Repeat Request  
ASK Amplitude Shift Keying  
ATT Attribute Protocol  
BB Baseband  
BCH Bose, Chaudhuri & Hocquenghem Type of code The persons who discovered these codes in 1959 (H) and 1960 (B&C)
BD_ADDR Bluetooth Device Address  
BER Bit Error Rate  
BIG Broadcast Isochronous Group A group of one or more time-related Broadcast Isochronous Streams
BIS Broadcast Isochronous Stream Connectionless isochronous logical transport
BT Bandwidth Time  
C Central  
C.# Conditional Any number may be used. See [Vol 1] Part E, Section 2.11  
CAC Channel Access Code  
CBC-MAC Cipher Block Chaining Message Authentication Code  
CCM Counter with CBC-MAC  
CIG Connected Isochronous Group A group of one or more time-related Connected Isochronous Streams
CIS Connected Isochronous Stream Point-to-point isochronous logical transport
CLKN Native Clock  
CLK  Central's Clock  
CLKE Estimated Clock  
CODEC COder DECoder  
COF Ciphering Offset  
CP CTEInfo Present A field in the Data Channel PDU Header to indicate the presence of the CTEInfo field
CPB Connectionless Peripheral Broadcast The logical transport enabled by the Connectionless Peripheral Broadcast feature
CRC Cyclic Redundancy Check  
CS Channel Sounding  
CS Tone Channel Sounding Tone Unmodulated carrier associated with the phase-based ranging technique
CSA Core Specification Addendum (In plural Addenda)  
CSRK Connection Signature Resolving Key  
CTE Constant Tone Extension  
CTEInfo Constant Tone Extension Information A field in the Data Channel PDU Header and the extended advertising header
CTS Clear to send  
CVSD Continuous Variable Slope Delta Modulation  
DAC Device Access Code  
DCI Default Check Initialization  
DEVM Differential Error Vector Magnitude Measure of modulation error used for Enhanced Data Rate transmitter testing
DH Data-High Rate Data packet type for high rate data  
DHK Diversifier Hiding Key  
DIAC Dedicated Inquiry Access Code  
DID (Advertising) Data ID  
DIV Diversifier  
DM Data - Medium Rate Data packet type for medium rate data
DPSK Differential Phase Shift Keying Generic description of Enhanced Data Rate modulation
DQPSK Differential Quaternary Phase Shift Keying Modulation type used by Enhanced Data Rate
DRBG Deterministic Random Bit Generator  
DTM Direct Test Mode  
DV Data Voice Data packet type for data and voice  
E Excluded See [Vol 1] Part E, Section 2.11
ECLD Early Commit Late Detect  
EDIV Encrypted Diversifier  
EDLC Early Detect Late Commit  
EDR Enhanced Data Rate  
EIR Extended Inquiry Response Host supplied information transmitted in the Inquiry Response substate
EIRP Effective Isotropic Radiated Power Equivalent power that an isotropic antenna must transmit to provide the same field power density
(e)SCO Synchronous logical link or Extended Synchronous logical link SCO or eSCO
eSCO Extended Synchronous Connection-Oriented [logical transport] Bi-directional, symmetric or asymmetric, point to-point, general regular data, limited retransmission
eSCO-S Stream eSCO (unframed) Used to support isochronous data delivered in a stream without framing
ETSI European Telecommunications Standards Institute  
FAE Fractional Frequency Offset Actuation Error  
FCC Federal Communications Commission  
FCS Frame Check Sequence  
FDMA Frequency Division Multiple Access  
FEC Forward Error Correction code  
FFO Fractional Frequency Offset  
FHS Frequency Hop Synchronization  
FHSS Frequency Hopping Spread Spectrum  
FIFO First In First Out  
FIPS Federal Information Processing Standards  
FM Frequency Modulation Modulation type
GAP Generic Access profile  
GATT Generic Attribute profile  
GFSK Gaussian Frequency Shift Keying  
GIAC General Inquiry Access Code Used for GAP General Discoverable mode and General Inquiry procedure. See Assigned Numbers.
HCI Host Controller interface  
HEC Header-Error-Check  
HID Human Interface Device  
HV High quality Voice e.g. HV1 packet  
HW Hardware  
IAC Inquiry Access Code  
IC Industry Canada  
IEC International Electrotechnical Commission  
IEEE Institute of Electrical and Electronics Engineers  
IETF Internet Engineering Task Force  
IFS Inter Frame Space  
IP Internet Protocol  
IPv4 Internet Protocol version 4  
IPv6 Internet Protocol version 6  
IQ In-phase and Quadrature  
IrDA Infra-red Data Association  
IRK Identity Resolving Key  
ISM Industrial, Scientific, Medical  
ISO International Organization for Standardization  
ISO Isochronous  
ISOAL Isochronous Adaptation Layer The layer that converts data units from the upper layer to data units in the Link Layer and vice versa
ITU International Telecommunication Union  
IUT Implementation Under Test  
IV Initialization Vector  
IV_C Initialization Vector (Central)  
IV_P Initialization Vector (Peripheral)  
L2CAP Logical Link Control and Adaptation protocol  
LAP Lower Address Part  
LC Link Controller Link Controller (or Baseband) part of the Bluetooth protocol stack. Low level Baseband protocol handler
LC Link Control [logical link] The control logical links LC and ACL-C are used at the link control level and link manager level, respectively
LE Low Energy  
LEB-C Low Energy Broadcast Control A logical link for control of Broadcast Isochronous Streams in a Broadcast Isochronous Group
LE-C Low Energy Control (link)  
LE-F Low Energy Framed A logical link for transferring framed isochronous data packets using a Connected or Broadcast Isochronous Stream logical transport
LE-S Low Energy Stream A logical link for transferring unframed isochronous data packets using a Connected or Broadcast Isochronous Stream logical transport
LE-U LE User [logical link]  
LFAE Local Frequency Actuation Error  
LFSR Linear Feedback Shift Register  
LIAC Limited Inquiry Access Code Used for GAP Limited Discoverable mode and Limited Inquiry procedure. See Assigned Numbers.
LL Link Layer  
LLID Logical Link Identifier  
LM Link Manager  
LMP Link Manager protocol For LM peer to peer communication
LR Loudness Rating  
LSB Least Significant Bit  
LSO Least Significant Octet  
LSTO Link Supervision Timeout event Controller can send LSTO event to Host
LT_ADDR Logical Transport ADDRess  
LTK Long-Term Key  
M Mandatory See [Vol 1] Part E, Section 2.11
MAC Message Authentication Code  
Mb/s Megabits (millions of bits) per second MD More Data  
MIC Message Integrity Check  
MITM Man-in-the-middle  
Msym/s Megasymbols per second  
MSB Most Significant Bit  
mSBC modified Sub Band Codec Hands-Free Profile v1.6 or later
MSC Message sequence chart  
MSO Most Significant Octet  
MTU Maximum Transmission Unit  
MWS Mobile Wireless Standards For example LTE and WiMAX
N_AP Number of Antenna Paths  
NADM Normalized Attack Detector Metric  
NAK Negative Acknowledge  
NAP Non-significant Address Part  
NESN Next Expected Sequence Number  
NIST National Institute of Standards and Technology  
O Optional See [Vol 1] Part E, Section 2.11
OBEX OBject EXchange protocol  
OCF Opcode Command Field  
OGF Opcode Group Field  
OOB Out of Band  
π/4-DQPSK π/4 Rotated Differential Quaternary Phase Shift Keying 2 Mb/s modulation type used by Enhanced Data Rate
P Peripheral  
PADVB LE Periodic Advertising Broadcast(Logical Transport)  
PAwR Periodic Advertising with Responses  
PBD Profile Broadcast Data The name of the logical link enabled by the Connectionless Peripheral Broadcast feature
PBF Packet Boundary Flag The device supports the capability to correctly handle HCI ACL Data packets
PBR Phase-Based Ranging  
PCM Pulse Coded Modulation  
PCT Phase Correction Term  
PDU Protocol Data Unit A message
PHY Physical Layer  
PIN Personal Identification Number  
PN Pseudo-random Noise  
ppm Part Per Million  
PPP Point-to-Point Protocol  
PRBS Pseudo Random Bit Sequence  
PRNG Pseudo Random Noise Generation  
PSK Phase Shift Keying Class of modulation types
ptt Packet Type Table The ptt parameter is used to select the logical transport types via LMP.
QoS Quality of Service  
RAND Random number  
RF Radio Frequency  
RFC Request For Comments  
RFCMode Retransmission and Flow Control Mode  
RFCOMM   Serial cable emulation protocol based on ETSI TS 07.10
RFU Reserved for future use  
RMS Root Mean Square  
RPA Resolvable Private Address  
RPL Reference Power Level  
RSSI Received Signal Strength Indication  
RTT Round-Trip Time  
RX Receive  
SAR Segmentation and Reassembly  
SCA Sleep Clock Accuracy  
SCO Synchronous Connection-Oriented [logical transport] Bi-directional, symmetric, point-to-point, AV channels
SCO-S Stream SCO (unframed) Used to support isochronous data delivered in a stream without framing
SDP Service Discovery protocol  
SDU Service Data Unit  
SEQN Sequential Numbering scheme  
SID (Advertising) Set ID  
SK Session Key  
SKD_C Session Key Diversifier (Central) Central portion of the Session Key Diversifier
SKD_P Session Key Diversifier (Peripheral) Peripheral portion of the Session Key Diversifier
SM Security Manager  
SMP Security Manager Protocol  
SN Sequence Number  
SNR Signal-to-Noise Ratio  
SRES Signed Response  
SRK Signature Resolving Key  
SSI Signal Strength Indication  
SSP Secure Simple Pairing  
STK Short Term Key  
SW Software  
T_FCS Time for Frequency Change Spacing  
T_FM Time for Frequency Measurement  
T_GD Time for Guard period  
T_IFS Time Inter Frame Space Time interval between consecutive packets on same channel index in the situation indicated by the suffix. See [Vol 6] Part B, Section 4.1.1.
T_IP1 Time for Interlude Period 1 (between CS packets)  
T_IP2 Time for Interlude Period 2 (between CS tones)  
T_MCES Time Minimum Connection Event Spacing Minimum time interval between connection events. See [Vol 6] Part B, Section 4.1.5.
T_MSS Time Minimum Subevent Spacing Minimum time interval between subevents in the situation indicated by the suffix. See [Vol 6] Part B, Section 4.2.2.
T_PM Time for Phase Measurement  
T_RD Time for (transmission) RampDown  
T_SY Time for synchronization sequence (CS packet)  
TCP/IP Transport Control Protocol/Internet Protocol  
TCS Telephony Control protocol Specification  
TDD Time-Division Duplex  
TDMA Time Division Multiple Access  
TK Temporary Key  
ToA Time of Arrival  
ToD Time of Departure  
ToF Time of Flight  
TX Transmit  
UAP Upper Address Part  
UART Universal Asynchronous receiver Transmitter  
UI User Interface  
ULAP Upper and Lower Address Parts  
USB Universal Serial Bus  
UTF-8 8-bit UCS/Unicode Transformation Format  
UUID Universal Unique Identifier  
728x90

+ Recent posts