Authentication on top of Bluetooth JUSTWORKS encrypted channel

Question

I have an embedded device with which I need to establish a secure Bluetooth LE connection. Unfortunately, the device does not have a display. However, the device will have a private key whose corresponding public key is signed by me. The client connecting to the device also has a private key whose public counterpart is signed by me. Anyone in possession of a private key with a public key signed by me can be considered authorized.

Thus, a two-way authenticated secure channel can certainly be established, but I was wondering if it could be done by merely implementing authentication on top of JUSTWORKS Bluetooth LE encryption.

Does JUSTWORKS use Diffie-Hellman or a similar algorithm to generate a shared secret that cannot be known to an attacker?

I think if JUSTWORKS uses Diffie-Hellman or similar, then generating random challenges on the embedded device and client, mutually authenticating the other and making sure to also use the secure channel shared secret as an input to generating the response from the challenge should be sufficient and the existing Bluetooth LE encrypted channel can be used afterwards. Is this correct? Using signatures seems the most straightforward way to do this, i.e. signing (a hash of) the challenge concatenated with the shared secret and responding with the signature (and the node's public key (signed by me), in case the other node doesn't have it).

I read something along the lines of anyone eavesdropping the first connection establishment of the JUSTWORKS secure channel can deduce the shared secret, and thus recreate the channel and pose as a man-in-the-middle. Sadly, I don't remember where I read that, but if that were true, am I correct in assuming that the above authentication scheme can't work because linking the authentication process to the channel is useless because the attacker can recreate the exact same channel?

Answer 1

You need to use the LE Secure Connections pairing method, which does feature a JustWorks authentication method.

JustWorks is generally not recommended because even with LE Secure Connections it is vulnerable to an active MITM attack. However, if you authenticate the received public key with your own methods, and therefore you can be sure that the received public key is not something that an active MITM attacker has injected, then LE Secure Connections + JustWorks becomes safe, provided that you don't have any other leaks in your custom authentication protocol.