Consider a system where two devices are connected via a wireless encrypted channel. The channel requires manual pairing and the data passed over the channel is also encrypted using an ephemeral symmetric key. Each exchange will occur within its own session.

How does the system authenticate the initial request for a session?

Is it adequate that the devices were manually paired to 'trust' a session initialisation request or are there more secure schemes that can be use to increase the odds that the session connection request is from a trusted source?


  • $\begingroup$ Do you mean specific cryptographic algorithms or do you also mean things like identification, time limitations, maximum number of devices (1) that can pair etc? In that case it might be better to migrate this to the IT security site. You could use Bluetooth or Wifi access schemes as starting point, of course. $\endgroup$ – Maarten Bodewes Aug 30 '16 at 13:16
  • $\begingroup$ @MaartenBodewes I mean a cryptographic algorithm. The connection will most likely be over Bluetooth and there will not be lots of devices, intially ~5. I was wondering what I can do to authenticate a valid user WITHOUT having some kind of secret data built into an app? $\endgroup$ – err Aug 31 '16 at 10:51
  • $\begingroup$ Well, usually it's possible to use identity and time based authentication (click on OK button of device D, within X minutes, possibly using a (displayed) code on the device you're connecting to. Have you looked at BT pairing / security, and why doesn't it suffice? $\endgroup$ – Maarten Bodewes Aug 31 '16 at 11:10
  • $\begingroup$ @MaartenBodewes yes, I understand the pairing part. I am wondering if there is something extra I can do if an attacker gets access to the BT channel. In the design I was hoping to put an extra layer of security if the channel somehow gets compromised. The master for the pairing will be physically secured so maybe I don't need the extra, I was hoping to get some clarification. $\endgroup$ – err Aug 31 '16 at 11:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.