Extended version: Tamarin-based Analysis of Bluetooth Uncovers Two Practical Pairing Confusion Attacks

This paper provides a Tamarin-based formal analysis of all key agreement protocols available in Bluetooth technologies, i.e., Bluetooth Classic, Bluetooth Low Energy, and Bluetooth Mesh. The automated analysis finds several unreported attacks, including two attacks (reported by Bluetooth SIG as CVEs) that exploit the confusion of pairing modes, i.e., when a communicating party uses the secure pairing mode while the other one uses the legacy pairing mode. They have been validated in practice using off-the-shelf implementations for the genuine communicating parties, and a custom BR/EDR machine-in-the-middle framework for the attacker.

Keywords

Protocol security Formal models Bluetooth Attacks Protocol security Formal models Bluetooth Attacks

Domains

Computer Science [cs]

Fichier principal

master.pdf (605.17 Ko)

models.zip (2.45 Mo)

models_v2.zip (2.45 Mo)

Origin	Files produced by the author(s)
Licence	Attribution

Licence	Attribution

Tristan Claverie : Connect in order to contact the contributor

https://hal.science/hal-04079883

Submitted on : Monday, April 24, 2023-2:48:42 PM

Last modification on : Friday, September 13, 2024-2:32:16 PM

Dates and versions

hal-04079883 , version 1 (24-04-2023)

Licence

Attribution

Identifiers

HAL Id : hal-04079883 , version 1

Cite

Tristan Claverie, Gildas Avoine, Stéphanie Delaune, José Lopes Esteves. Extended version: Tamarin-based Analysis of Bluetooth Uncovers Two Practical Pairing Confusion Attacks. 2023. ⟨hal-04079883⟩

Export

BibTeX XML-TEI Dublin Core DC Terms EndNote DataCite

Collections

UNIV-RENNES1 CNRS INRIA INSA-RENNES IRISA IRISA-INSA-R CENTRALESUPELEC UR1-MATH-STIC UR1-UFR-ISTIC UNIV-RENNES INSA-GROUPE ANR UR1-MATH-NUM CYBERSCHOOL CYBERSCURITE

426 View

589 Download