3 ms·
Bluetooth SIG Security Update
- okket 8y agoSee also "Breaking the Bluetooth Pairing: Fixed Coordinate Invalid Curve Attack" https://www.cs.technion.ac.il/~biham/BT/ https://www.cs.technion.ac.il/~biham/BT/
- PappaPatat 8y agoThanks, has a much better link with more information.
- MrXOR 8y agoThanks, interesting
- PappaPatat 8y ago[...]the Bluetooth SIG is not aware of any devices implementing the attack having been developed, including by the researchers who identified the vulnerability. Well that is odd. Did the researchers really convince the Bluetooth SIG just by pointing the issue(s) out on paper?
- IshKebab 8y agoI still haven't ever found an answer to these claims that BLE 4.2's "Secure Connections" passkey (PIN) mode is totally insecure, and that the flaw was discovered in 2008 (yes, a long time before BLE 4.2 existed). https://pomcor.com/2015/06/03/has-bluetooth-become-secure/ https://pomcor.com/2015/06/03/has-bluetooth-become-secure/
- baybal2 8y agoA yet another flimsy DH implementation I guess?
- MrXOR 8y agoYes, flimsy DH implementation+ invalid curve attack "Bluetooth implementations may not sufficiently validate elliptic curve parameters during Diffie-Hellman key exchange" https://www.kb.cert.org/vuls/id/304725 https://www.kb.cert.org/vuls/id/304725
- bsder 8y agoIs this specific to P-256? I thought Curve25519, for example, didn't have this problem because it didn't have any invalid points.