According to the Bluetooth Specification, the pairing process starts with Slave sending a connectable advertising packet and then the Master initiates the connection. In LE Legacy OOB authentication a secret 128-bit Temporary Key (TK) is supposed to be shared via some other secure channel, e.g. NFC, to be used in a challenge-response authentication, which goes like this:
- Master chooses random Mrand and calculates Mconfirm = AES(TK, AES(TK, Mrand XOR p1) XOR p2)
- Slave chooses random Srand and calculates Sconfirm = AES(TK, AES(TK, Srand XOR p1) XOR p2)
- Master sends Mconfirm
- Slave sends Sconfirm
- Master sends Mrand and Slave confirms
- Slave sends Srand and Master confirms
- Short Term Key is calculated as STK = AES(TK, Srand[65:128] || Mrand[65:128])
- Further communication is encrypted with STK.
where p1 and p2 contains the addresses of Master and Slave along with some information about the pairing command, etc.
Now suppose Master and Slave share a secret key (SK) which is burned into them at factory. I intend to send a 128-bit random data (RD) in the advertising package so both sides can use it to calculate TK as TK = AES(SK, RD). I haven't seen this approach anywhere else and there is very little literature on the analysis of LE Legacy OOB authentication as far as I can see.
So, is this a valid approach? What are the problems with it?
Other related information and assumptions:
- The payload of the connectable advertising packet is already encrypted and authenticated via CCM using another key along with replay protection via counter and/or timestamp.
- There are many master and slaves where masters are at fixed locations and slaves are mobile. Each slave has a unique SK and masters can look it up from a secure database.
- Bonding cannot be used because there should be no user interaction for authentication and the bonding keys cannot be shared between masters.
- LE Secure Connections is supposed to be more secure but requires user interaction for authentication, which we cannot provide.
- Connection will be made every 1-10 minutes for each slave.