3 ms·
> “BLE proximity authentication systems typically measure the distance of a device by the response time, so if the device is too far away from the device to be
by davidhyde 4y ago
> “BLE proximity authentication systems typically measure the distance of a device by the response time, so if the device is too far away from the device to be unlocked, the response time will be too long and the authentication won’t work.”
> “The tool that researchers at NCC Group developed adds just 8 milliseconds of latency in the response time”
Radio waves propagate at the speed of light so a signal can travel about 2400 km in 8ms. I think there are some key aspects of the Bluetooth le proximity auth protocol that the article is missing which makes the whole thing sound like nonsense.
I think the real reason that Bluetooth le proximity authentication is broken is that it is a passive communication protocol. They do hint at this in the article. Imagine how broken TLS would be if there was no two way communication to negotiate proofs.
- arghwhat 4y agoNot only that, their test was conducted at a paltry distance of 25 meters between authentication device and vehicle - only barely outside the normal range of the device. If they wanted to prove that they had bypassed the range limit with their relay device, they should relay the authentication over a few kilometers rather than a few meters.
- AshamedCaptain 4y agoBluetooth LE is not "passive" in the sense that there is definitely two way communication going on. They even mention GATT in the article and that is as two-way as it gets.
- wizee 4y agoDevices don’t use GATT response latency to estimate distance, but elevated levels of GATT latency are commonly used as indications of relay attacks. A lower latency relay attack can work around this defence. The researcher recommends time-of-flight measurement in a secure ranging protocol to mitigate such attacks.