Bluetooth and Microsoft Desktop Products

Transcription

1 M Bluetooth and Microsoft Desktop Products Microsoft Corporation Published: June 2005 Abstract This paper provides an overview of Bluetooth technology with a specific focus on security and one class of Bluetooth Human Interface Devices: keyboards and mouse products. Bluetooth computing has created a major advance in personal computer interaction and, as with any new technology, understanding it is the key to envisioning how it can make a contribution in the workplace.

2 M The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This White Paper is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property Microsoft Corporation. All rights reserved. Microsoft is either a registered trademark or trademark of Microsoft Corporation in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners.

3 Contents Contents...1 Introduction...2 What is Bluetooth?...3 Bluetooth Compared to 27 MHz Technology...3 Bluetooth Devices...4 Range...4 Master/Slave Relationship...4 Virtual Cable...4 Encryption...5 Frequency Hopping Technology...6 Pairing...7 Discovery...7 Keys...7 Authentication...8 Understanding Pairing An Example...9 Bluetooth Settings...9 Adding a Device...10 Passkey Challenge...10 Summary...12 Appendix 1: Bluetooth Security on Microsoft Desktop Products...13 Pairing Process for Microsoft Bluetooth Keyboards...13 Length and entropy of the PIN...13 Length and entropy of the Random Number...14 Length and entropy of the Bluetooth address...14 Algorithms used to derive the Security Keys...14 Conclusion...15 Appendix 2: Bluetooth Specification v1.2 Controller Volume, Part H SECURITY SPECIFICATION16 Related Links...17 Bluetooth and Microsoft Desktop Products 1

4 Introduction Connections between people are changing as an ever-increasing number of wireless products enable them to enjoy mobility and simplicity without cabling. Introduced in 1999 and evolving, Bluetooth is a low power, short range radio technology that revolutionizes communications for a wide array of products from mobile phones to computer peripherals. An open specification, Bluetooth offers convenience, enhanced immunity from interference, and security * which have made it the choice of a large and growing number of companies. This paper provides an overview of Bluetooth technology with a specific focus on communications security and reliability for one class of Bluetooth Human Interface Devices: keyboards and mouse products. Bluetooth computing has created a major advance in personal computer interaction and, as with any new technology, understanding it is the key to envisioning how it can make a contribution in the workplace. There are two technical appendices to this paper: Appendix 1: Bluetooth Security on Microsoft Desktop Products For readers who wish some additional technical detail, this appendix provides a brief summary of the implementation for Microsoft Bluetooth keyboards. Appendix 2: Bluetooth Specification v1.2 Controller Volume, Part H SECURITY SPECIFICATION For readers interested in gaining a more thorough understanding of Bluetooth security, the relevant section of the Bluetooth specification is contained herein. * The Microsoft products referenced within use Bluetooth wireless technology so that users have a more secure computing experience. The degree of security achieved with any technology depends upon the specific circumstances under which it is deployed. Bluetooth and Microsoft Desktop Products 2

5 What is Bluetooth? Bluetooth is an open technology specification owned by the Bluetooth Special Interest Group (SIG), a trade association comprised of members from the telecommunications, computing, and various other technology industries. Ensuring compatibility in a wide variety of products from many manufacturers, Bluetooth technology is increasingly seen as a smart choice for local, private device networking. Bluetooth is a low power, short range, 2.4 GHz radio technology that eliminates cables between electronic devices such as phones, computers, keyboards, mouse products, printers, and other equipment. Bi-directional radio transmission between these devices delivers physical freedom and ease of use through automatic wireless connection. Up to 7 devices may be connected in a piconet, the fundamental Bluetooth network. The maximum data rate is 1 Mbps, with typical performance in the range of several hundred to 700 kbps. Recently there has been confusion surrounding security and Bluetooth wireless technology. These have typically involved mobile phones. How these issues apply to other classes of devices has not been discussed. I d like to do that here. To the best of my knowledge, the encryption algorithm in the Bluetooth specifications has not been compromised [emphasis added]. As such, once paired, the communication between Bluetooth devices is secure. This includes devices such as keyboards connecting to a PC, a mobile phone synchronizing with a PC, and a PDA using a mobile phone as a modem to name just a few of the many other use cases. Cases where data has been compromised on mobile phones are the result of implementation issues on that platform. The Bluetooth SIG diligently works with our members to investigate any issues that are reported to understand the root cause of the issue. If it is a specification issue, we work with the membership to address that issue in the specification. If it is an implementation issue, we work with the membership to get patches out and ensure future devices don t suffer from the same vulnerability. This is an on-going process. Mike Foley, Bluetooth SIG March 11, 2005 The primary security of Bluetooth communications is provided by encryption. Bluetooth devices can be designed to implement a very secure, industry standard encryption scheme, known as SAFER+, that has not been compromised (see sidebar). Because Bluetooth is low power it operates over short distances, contributing to reduced radio frequency interference. Interference immunity is further enhanced because Bluetooth employs frequency-hopping spread spectrum technology. Bluetooth Compared to 27 MHz Technology Devices that communicate at the frequency of 27 MHz do not enjoy the same range, flexibility, and security benefits of Bluetooth. 27 MHz devices tend to be limited by dedicated, proprietary designs, while Bluetooth is an open standard that enables device networking. The same wireless transceiver supplied with a Bluetooth keyboard and mouse enables printing to a Bluetooth printer, transferring files to a PDA, and synchronizing phone contacts with the PC, for example. Bluetooth has a longer range and yet is less susceptible to interference, enabling co-location of more devices in a smaller area than is possible with 27 MHz devices. The range of Bluetooth devices such as keyboards is generally 10 meters or about 30 feet. 27 MHz devices are much more susceptible to interference and have to contend with signal loss if interference is encountered. Frequency hopping makes Bluetooth devices more immune to interference. Devices that encounter interference on a channel will switch channels and retransmit a packet. This is possible because Bluetooth transmission is bi-directional, and devices are able to communicate whether a packet is not received. Bluetooth and Microsoft Desktop Products 3

6 Industry standard encryption is the basis for Bluetooth security, which is not the case for 27 MHz technology. 27 MHz devices generally do not use encryption or, if they do, it is a proprietary implementation. Bluetooth Devices Range The Bluetooth specification accommodates different devices that are organized into device profiles based on the capabilities of the device. For example, Bluetooth devices range in functionality from headsets to printers and modems. Each class of device has a suitable set of commands, but it is not practical or desirable for all devices to understand all possible commands. For example, a printer without FAX functionality will never need to make a phone call, so the modem commands are not necessary for the printer. For this reason the Bluetooth specification classifies devices based on their functionality. These classes are called profiles. Keyboards and mouse products fall into the general Human Interface Device (HID) profile. Because HID devices have fewer and simpler capabilities, such devices tend to represent a lower security risk. They have fewer potential avenues for compromise than devices such as mobile phones, which support a large variety of device profiles. Bluetooth devices are grouped into three power classes or levels with typical operating range distances of 10 m, 20 m, and 100 m (approximately 30, 60, and 300 feet, respectively). Most keyboards and mouse products operate at the 10 or 20 meter ranges. The actual effective range for any device may be less, as radio signals can be affected by the physical environment. Since keyboards are generally used within a building, which attenuates radio signals, the actual range could be less than 10 m. A consideration for using Bluetooth in offices is that the range may extend through a floor or ceiling. Many Bluetooth radios, including the radios used in Microsoft products, have an active transmit power control feature. If the keyboard is moved closer to the transceiver, the two radios will reduce transmission power accordingly so that they are not transmitting any louder than necessary. This further reduces the effective range, but helps to minimize potential interference with other networks. Master/Slave Relationship A Bluetooth piconet employs a master/slave topology where there is a single master and multiple slave devices. The master device controls communication timing and frequency hopping, as well as determines encryption keys used within the network. While certain classes of devices in one piconet may also be connected to other Bluetooth piconets, this is never the case for keyboards and mouse products. The HID profile requires a single master. In this paper the term PC will refer to the master while the keyboard is a slave. PC is used throughout and is interchangeable with host or master. Virtual Cable The keyboard and mouse are so tightly coupled with the PC, the master device to which they are paired, that this pairing is described as being a virtual cable. That is, they have a 1:1 relationship that permits no other devices to join that pairing. Once a device has been virtually cabled, it acts Bluetooth and Microsoft Desktop Products 4

7 The Virtual Cable protects against connection intrusion attacks (which has been a problem for some phone implementations). The term virtual cable is used to indicate that the HID* has a 1:1 association with a particular host [PC]. (*From section 6.4 of the Bluetooth Human Interface Device Profile 1.0 specification.) The Microsoft Bluetooth keyboard supports only one connection at a time. For example, a device cannot connect to a keyboard by forming a second connection in order to listen to or manipulate the devices. If a keyboard device is virtually cabled to a PC it means: The device has identified itself as virtually cabled. There is a 1:1 relationship with that PC. The HID device will refuse any attempts by other devices to connect to it. The device will automatically reconnect to its bonded PC if the connection is dropped. as if a physical cable exists between it and its PC. A paired keyboard will refuse to connect to any other device, therefore making it very difficult to attack through a Bluetooth connection. The latter problem has been encountered with some phone implementations of the Bluetooth standard. This virtual cable remains intact even if power is removed and reapplied to the device, and can only be broken if either the PC or keyboard unplugs itself via a specific Bluetooth command. Should the connection between the paired devices be broken for any other reason (for example, moving out of range), the virtual cable will not be broken. The devices will automatically attempt to reconnect when the cause for the break is removed (moving back into range). Breaking the virtual cable requires user intervention, e.g., pressing the Make/Break Connection button on the bottom of the Encryption Microsoft Bluetooth keyboard, or clicking the Encryption is at the core of Bluetooth security, Remove button from the Bluetooth Devices dialog in Windows Control Panel. employing a strong algorithm with high speed Pages 35-38, section 6.4, of the Bluetooth Human encryption, long encryption keys (or passwords), and Interface Device Profile 1.0 specification contain more details about virtual cables. encryption keys that change for each working session. Communications are secured by up to 128-bit encryption using an enhanced version of a strong, publicly available encryption algorithm known as SAFER+. Encryption is a Bluetooth recommendation for HID devices such as keyboards, which are often used to enter sensitive information. For example, all Microsoft Bluetooth keyboards use 128-bit Bluetooth encryption, although Windows permits unencrypted connections to Bluetooth keyboards. Simple devices, such as a mouse or pointer, may use encryption, but they are not required to do so and generally do not. A Microsoft Bluetooth mouse is not encrypted. The foundation for encryption is built by the pairing process (described later) which begins with a user-entered PIN (password) and ultimately results in the creation of a semi-permanent Link Key. The Link Key is also knows as the Combination Key or KAB in the Bluetooth Specification. That Link Key is, in turn, used to create the Encryption Keys for communication. No keys are ever transmitted over the radio; only random numbers are exchanged when devices are establishing keys. While the Link Key must be 128 bits, the Bluetooth specification allows the Encryption Key to be as short as 8 bits. Microsoft Bluetooth keyboards always use 128-bit encryption. The keys are generated through a combination of three inputs: an input key, a 128-bit random number received from the other device, and a third number. The third number is either a 48-bit device address or another generated number. Such a combination key is more secure than a static random number, plus it enables the PC and each slave device pair to have its own unique key. Additional information on encryption can be found in the appendix Bluetooth Security on Microsoft Desktop Products. Bluetooth and Microsoft Desktop Products 5

8 Frequency Hopping Technology High speed frequency hopping technology significantly reduces radio interference. The general frequency hopping technique is employed in a broad range of products and applications because of this inherent benefit. Bluetooth devices operate at a frequency of 2.4 GHz, an open, license-free band that is shared around the world by a wide range of applications and devices. One application is wireless Ethernet based on the IEEE standards. This sharing of the frequency band is a key reason why Bluetooth communications need to be robust and resistant to interference. Frequency-hopping spread spectrum technology greatly reduces the likelihood of interference from other Bluetooth devices operating on another network in the same area. The actual pattern of channel switching is determined by the PC, and it is different for all Bluetooth PCs that may be operating within range of each other. Should interference be encountered on a single channel, packet retransmission will follow immediately on a different channel, one that is likely to be free. The frequency band is divided into 79 frequency channels, and time is divided into slots that are 625 s long. Data packets are 1 to 5 slots in length. Two Bluetooth devices will synchronously switch to a new channel in a random manner after each packet is received. Thus channel switching is very fast, up to 1,600 times every second. Figure 1 provides a graphical depiction of this channel switching. The 79 channels are shown with a total of 16 horizontal elapsed time slots, which represent a total time of just 0.01 second. The channel that was selected for transmission for each time slot is shown and graphed. New devices compatible with Bluetooth version 1.2 may use a technology called Adaptive Frequency Hopping, in which the device marks frequencies that are known to have interference, and avoids these frequencies for a period of time. For example, there may be a situation where an interfering device is transmitting on a single block Figure 1 Frequency Hopping of frequencies. The probability of transmission error is reduced by adjusting the hopping pattern accordingly. Microsoft s Optical Desktop Elite for Bluetooth, a combination keyboard, mouse, and USB transceiver, is a product that meets the 1.2 specification. Communications can be monitored once the sequence is known, so Bluetooth s security defense is based principally on encryption. Frequency hopping makes it more difficult for communication to be intercepted and monitored, but it does not prevent it. Bluetooth and Microsoft Desktop Products 6

9 Pairing Discovery Secure, encrypted communication between two devices requires that they share a common starting point, or password/pin, for encryption and decryption. Nearly everyone recognizes that a password can be weak (simple to break) or strong (difficult to break). Longer passwords are more difficult to break than shorter passwords. Security is also enhanced if passwords are changed frequently, and if there is more than just a single password. And, of course, passwords should never be shared (communicated) openly. These same security characteristics are found in Bluetooth encryption: Use of an initial password Strong, 128-bit password length Dual passwords for operation (a single Link Key for every connected device, plus an additional Encryption Key for each session) Changing operational password (Encryption Key) Keys/passwords are never communicated over the radio Pairing is the process by which two Bluetooth devices bond and share a key, which is another word for password. Both devices begin with an initial password, but pairing is a highly secure multi-step, multi-password process. Its purpose is to create the semi-permanent key, called the Link Key. The Link Key is the password that is used to generate a second key, the Encryption Key, which is unique for each operating session (defined below). The creation of the Link Key begins with the use of a PIN or Passkey. Devices must be discovered before actual communication can begin. For Bluetooth devices, this involves enabling device discovery and making inquiry scans. Once the PC finds a device, it requests basic information that identifies the device s type and capabilities. Discovery is not certain. Devices may or may not be discoverable depending on their applications or configuration settings. While discovery might happen automatically for some Bluetooth devices, for added security Windows XP SP2 (SP2) and Microsoft keyboards require user intervention. Discovery is turned off by default, which means the PC and device cannot be found unless a user specifically turns on that capability. Conversely, a mouse and keyboard that are paired to a PC can return from a powered-off state and find the PC even if it is not discoverable. The PC must respond to a connection request from a paired device. Keys For keyboards, the pairing process comprises the entry of a Passkey/PIN, the creation and verification of an Authentication key, and the creation and verification of the Link Key. Pairing is complete when the Link Key has been generated and verified. Figure 2 shows the sequential relationship between the keys. The first two keys are temporary and are discarded immediately after use. Once the Link Key has been created and verified, an Encryption Key is created for the next session and communication can begin: Bluetooth and Microsoft Desktop Products 7

10 Pairing Session Passkey/PIN Authentication Key Link Key Encryption Key Temporary 8-16 digits Used to create Authentication Key Temporary Semi-permanent 128 bits 128 bits Used to create Link Key Used to create Encryption Keys Figure 2 Bluetooth Security Keys Session only 128 bits Used to encrypt/ decrypt transmission Pairing is done only once. It is unaffected by powering the PC off and on, moving out of and back within range, or by battery replacement. Those actions do, however, constitute the end of an operating session and the beginning of a new session, so they result in the Link Key being used to generate a new Encryption Key for the new session. But the Link Key remains the same unless a user takes specific action to change it. The basic pairing and subsequent session process flow is shown from top to bottom in the simplified diagram in Figure 3: PC Enter Passkey/PIN Bluetooth Keyboard Enter Passkey/PIN Pairing Random number generated Authentication Key created Random number generated Link Key created Exchange and verify random numbers Exchange and verify random numbers Random number generated Authentication Key created Random number generated Link Key created Session Random number generated Encryption Key created Encrypt/Decrypt Exchange and verify random numbers Encrypted Traffic Random number generated Encryption Key created Encrypt/Decrypt Figure 3 Pairing Process Flow Authentication Link Keys are unique between each device and PC, so a PC paired with three devices would share three different Link Keys. Link Keys are used for each party (device and PC) to verify that the other party is in fact who it says it is, as well as for generating encryption keys. For device A to authenticate device B, device A creates a random number and sends it to B. Device B receives the random number, encrypts it with its Link Key, and sends it back to A. Device A then decrypts this transmission using its Link Key and compares it to the original random number. If those numbers match, then device A knows that device B has the same Link Key, and device B is therefore authenticated. Device B also performs the same process with device A to verify its identity. Authentication has taken place once both numbers are verified. It is important to reemphasize two points: At no time is any key transmitted over the Bluetooth radio. After the initial PIN, 128-bit encryption is used for all keys and random numbers. Bluetooth and Microsoft Desktop Products 8

11 Understanding Pairing An Example Microsoft Windows XP helps with discovering, authenticating, and connecting to Bluetooth devices through its wizard. The wizard serves as a good vehicle to describe and understand the pairing process. The discussion that follows uses the Microsoft Optical Desktop Elite for Bluetooth, a keyboard and mouse desktop combination, to illustrate pairing. Bluetooth Settings Figure 4 Control Panel The pairing process for Bluetooth devices can be started from the Control Panel, assuming that SP2 has been installed. Windows XP SP2 includes the drivers for certain Bluetooth radios ( It is important to note that standard user level rights are sufficient for installing the Bluetooth drivers or for pairing keyboards and mouse products. Clicking on Bluetooth Devices (Figure 4) in the Control Panel will display the Bluetooth Devices dialog. Before adding a new device, existing devices should be reviewed. The Devices tab will show all the devices that are currently paired with the PC. Figure 5 shows a situation in which there are two devices already paired with the PC: a mouse and keyboard. Notice that the keyboard has security enabled (Passkey enabled) while the mouse does not (No passkey). Figure 5 Devices The Options tab (Figure 6) contains the settings that control how Windows XP SP2 manages Bluetooth connections. In the Connections grouping, the checkbox Allow Bluetooth devices to connect to this computer should be on. This enables a keyboard and mouse to recover from their power saving states. Disabling this box will disallow Bluetooth communications with the Microsoft keyboard and mouse. Figure 6 Options If security is a concern, the Turn discovery on checkbox should be left unchecked. This will prevent the PC from responding to a general inquiry and make the PC undiscoverable by unpaired devices. Only a Bluetooth device that is already paired with the PC will be able to discover the PC. For security purposes, this is the default setting. The checkbox Alert me when a new Bluetooth device wants to connect is checked by default in Windows XP SP2. This can be Bluetooth and Microsoft Desktop Products 9

12 unchecked if security is a concern, with the effect that the user will not be prompted if a device tries to pair with the PC. Thus any connection attempt not initiated by the user through the PC will fail. Alternatively, leaving the box checked would also serve to detect and alert a user to the existence of potential threats. Any such attempt could simply be declined. Users always have the option to manually initiate pairing from the user interface by adding a new device through the Control Panel. Adding a Device On the Devices tab there is an Add button that will initiate pairing by running the Bluetooth Device Wizard (Figure 7). Note the security warning at the bottom: Add only Bluetooth devices that you trust. A trusted device is one that the user or the user s company owns and controls. An untrusted device is one that is public, or it may be one that is in a different physical location. A device in a different location could still be trusted if it is owned by and under company control, e.g., a shared Figure 7 Wizard printer in another room. Adding a public device that is not trusted is probably not a good idea. If a public device is added, the user may remove it or restrict it to only the minimum services necessary on the Services tab in the Bluetooth Devices dialog. Checking the box My device is set up and ready to be found. and clicking Next will initiate discovery. At this point the device must be discoverable. (For Microsoft Bluetooth hardware this is done with a Make/Break Connection button on the bottom of the devices.) Refer to the device documentation for specifics. The PC will scan for available Bluetooth devices that are within range, and display icons, names, and status: New device or Already connected (Figure 8). Figure 8 Device Selection Selecting the desired device and clicking Next continues the pairing process. Passkey Challenge Some Bluetooth devices require authentication before the device can be used with Windows. During authentication, the same passkey must be entered into the Bluetooth Connection Wizard and into the Bluetooth device. As discussed earlier, the passkey, or PIN, is a temporary key that is entered by the user. Its only purpose is to generate an initial Authentication key and then the PIN is discarded. The PIN and all keys are never transmitted over the radio. Windows XP SP2 offers the following PIN options when connecting a Bluetooth device (also shown in Figure 9 below): Bluetooth and Microsoft Desktop Products 10

13 Choose a passkey for me the default choice, this creates an 8-character random numerical string. Use the passkey found in the documentation not applicable for keyboards, this applies to devices like a printer that do not have a method for PIN input. Let me choose my own passkey Windows recommends that the user choose a numeric PIN 8-16 characters in length, but it does not enforce the minimum length. This is the recommended choice. Don t use a passkey this pairs both devices with security turned off. This option is meant for devices like mouse products that do not support authentication or encryption. (This is not recommended for keyboards, since this would mean that the keystrokes would be sent unencrypted. Windows will not enforce this, so it is possible for a user to pair a keyboard with security turned off.) Note the security warning at the bottom of Figure 9 that instructs the user to enter a strong PIN for the pairing process. If a user chooses to enter his own passkey, the passkey must first be entered from a keyboard other than the Bluetooth keyboard that is being connected. Figure 9 Passkey Selection Once the passkey has been entered on the PC, the user is prompted to enter the same PIN from the Bluetooth keyboard (Figure 10). If the PIN entered on the Bluetooth keyboard matches the PIN entered on the PC (with the attached keyboard), authentication succeeds. If the PINs do not match, authentication fails. For security purposes, there is a timeout for completion of this step. Figure 10 Passkey Entry Once the PIN is entered, the pairing process proceeds rapidly to completion. That completion process is important to understanding Bluetooth security. The PIN is simply an initial input to the generation of the temporary 128-bit Authentication key. This means that the PIN is only used for the next few transactions (typically under a minute) and then it is discarded. Bluetooth and Microsoft Desktop Products 11

14 Summary Bluetooth technology delivers on the promise of reliable wireless connectivity with respect to interference, security, and range, Bluetooth is the best wireless implementation available for personal computing hardware in the workplace. Security and freedom from interference are concerns whenever communications are involved, and they are particularly important when considering wireless technology instead of wired or cabled technology. In the previous discussion, and in the keyboard example, different elements of Bluetooth security and interference immunity have been mentioned. Some of those elements are fundamental to the Bluetooth specification, while others are application implementations unique to the devices. As we have seen, the Bluetooth standard basically encompasses the following: Frequency-hopping spread spectrum technology, which makes Bluetooth communications relatively immune to interference. Bidirectional communication that enables packet retransmission also contributes to interference immunity. Encryption algorithms, which are strong and employ 128-bit keys. Procedures for configuring and controlling security, such as the pairing sequence for creating Link and Encryption Keys, where keys are never transmitted over the radio. Virtual cable or an exclusive 1:1 relationship between the Bluetooth keyboard and the PC, meaning that no other devices are permitted to have that relationship. Additionally, when compared to 27 MHz devices, Bluetooth also offers the advantages of being able to connect multiple devices and longer range. We have also seen Bluetooth keyboard security elements that are provided by Windows XP SP2: Bluetooth Wizard for device connection that is fast and simple, relying on a Passkey/PIN that is not transmitted over the radio. Bluetooth Devices dialog in Control Panel for configuration, where, by default, the PC cannot be discovered by another Bluetooth device. Refer to for more information about Microsoft Bluetooth products. Bluetooth and Microsoft Desktop Products 12

15 Appendix 1: Bluetooth Security on Microsoft Desktop Products The information contained within this Appendix is a more detailed, technical description of how the Bluetooth encryption process works. Pairing Process for Microsoft Bluetooth Keyboards Pairing, or the process of creating a trusted relationship between two devices, involves a succession of security key creation: Entry of the one-time PIN Generation of the one-time Init Key (using the PIN) Generation of the semi-permanent Link Key (using the Init Key) Once the Link Key has been created, each working session begins with: Generation of the Encryption Key (using the Link Key). A new Encryption Key is generated each time a session is begun. As described previously, pairing is initiated by pressing the Make/Break Connection button under the keyboard and running the Add Bluetooth Device Wizard in Windows XP SP2. It is necessary to pair the keyboard to the PC only once. With the exception of the PIN, which can be generated by the user, all other input security keys employed by Microsoft Bluetooth keyboards are 128 bits in length. These keys are combination keys that require three inputs: Input key, which is one of the keys in the process. See Figure 11 for process flow. Random number Bluetooth address Length and entropy of the PIN The PIN chosen and entered by the user is comprised of only numerical characters. It is 1 to 16 characters in length. The Windows XP SP2 user interface presents the following options when pairing a Bluetooth device: Choose a passkey for me This default option creates a random numerical string of 8 characters. Use the passkey found in the documentation Not applicable for keyboards, this option applies to devices like printers that do not have a method for PIN input. Let me choose my own passkey Windows recommends that the user choose a numeric PIN 8 to 16 characters in length, but does not enforce the minimum length. Don t use a passkey This option pairs both devices with security turned off. This option is meant for devices like mice that do not support authentication or encryption. It is NOT recommended for keyboards, since keystrokes would be sent unencrypted. Windows does not enforce this, so it is possible for a user to pair a keyboard with security turned off. Bluetooth and Microsoft Desktop Products 13

16 Length and entropy of the Random Number The 128-bit random number is the output of the same Massey/Rueppel generator used for the encryption operations. The seed that is used in the random number generator is a 128-bit value which is a combination of the: 32-bit Bluetooth clock snapped at a random time in the firmware Other values read from the hardware, such as radio symbol tracking register values, piconet slot offset register values, and a few others. Length and entropy of the Bluetooth address The 48-bit Bluetooth address is a unique number assigned to the device. All Bluetooth devices have unique addresses that are assigned by the IEEE to device manufacturers. The top 24 bits identify the manufacturer and are assigned out of the same IEEE OUI space as MAC addresses. The lower 24 bits are assigned by the manufacturer to identify the specific device. Algorithms used to derive the Security Keys Refer to Appendix 2: Bluetooth Specification v1.2 Controller Volume, Part H SECURITY SPECIFICATION. The authentication functions are called E1, E2 and E3. E2 and E3 are variations of E1: The authentication function E1 is a computationally secure authentication code. E1 uses the encryption function SAFER+. The algorithm is an enhanced version of an existing 64- bit block cipher SAFER-SK128, and it is freely available. (From section 6.1 of Part H SECURITY SPECIFICATION.) The 128-bit Initialization Key is generated by the E2 algorithm and takes the following inputs: PIN 1-16 characters PIN E22 Generate Initialization Key E21 Generate Link Key E1 Authentication Link Key Random Numbers 128 bits Random Numbers 128 bits Authentication Exchange E22 Generate Initialization Key E21 Generate Link Key E1 Authentication Link Key E3 Generate Encryption Key E0 Stream Cipher Random Numbers 128 bits Encrypted Traffic E3 Generate Encryption Key E0 Stream Cipher Figure 11 PIN (8 to 128 bits) BD_ADDR of the Claimant device (the keyboard) (48 bits) Bluetooth and Microsoft Desktop Products 14

17 RND (128 bits) The Initialization Key is discarded after the combination Link Key is generated. The 128-bit Link Key is generated by the E1 algorithm and takes the following inputs: 128-bit Random Number from device A (RANDA) 128-bit Random Number from device B (RANDB) 128-bit Initialization Key 48-bit Bluetooth address of device A (BD_ADDRA) 48-bit Bluetooth address of device B (BD_ADDRB) A new 128-bit Encryption Key is generated by the E3 algorithm whenever a new encrypted connection is formed, i.e., a new session. In the case of a keyboard, this occurs when the keyboard reconnects to Windows XP through user activity after becoming disconnected, e.g., after 10 minutes of inactivity. The Bluetooth specification allows for the negotiation of the size of the Encryption Key, which can be as short as 8 bits and up to 128 bits. Microsoft keyboards with the Microsoft Wireless Transceiver for Bluetooth (included with the Microsoft Optical Desktop Elite for Bluetooth) and Windows XP SP2 always use 128-bit encryption keys. The Encryption Key takes the following inputs: 128-bit Link Key 128-bit Random Number 96-bit Ciphering Offset Number (COF) The COF is the number (Authentication Ciphering Offset or ACO) generated by E1 during pairing. Conclusion SAFER+ 128-bit encryption is employed. Keys are never transmitted over the radio. As previously discussed, the Virtual Cable protects against connection intrusion attacks (which has been a problem for some phone implementations). For further information refer to Appendix 2, Bluetooth Specification v1.2 Controller Volume, Part H SECURITY SPECIFICATION, which follows on the next page. Bluetooth and Microsoft Desktop Products 15

18 Appendix 2: Bluetooth Specification v1.2 Controller Volume, Part H SECURITY SPECIFICATION Bluetooth and Microsoft Desktop Products 16

19 Core System Package [Controller volume] Part H SECURITY SPECIFICATION This document describes the specification of the security system which may be used at the link layer. The Encryption, Authentication and Key Generation schemes are specified. The requirements for the supporting process of random number generation are also specified.

20 BLUETOOTH SPECIFICATION Version 1.2 [vol 2] page 746 of November 2003

21 BLUETOOTH SPECIFICATION Version 1.2 [vol 2] page 747 of 790 CONTENTS 1 Security Overview Random Number Generation Key Management Key Types Key Generation and Initialization Generation of initialization key, Authentication Generation of a unit key Generation of a combination key Generating the encryption key Point-to-multipoint configuration Modifying the link keys Generating a master key Encryption Encryption Key Size Negotiation Encryption of Broadcast Messages Encryption Concept Encryption Algorithm The operation of the cipher LFSR Initialization Key Stream Sequence Authentication Repeated Attempts The Authentication And Key-Generating Functions The Authentication Function E The Functions Ar and A r The round computations The substitution boxes e and l Key scheduling E2-Key Generation Function for Authentication E3-Key Generation Function for Encryption List of Figures List of Tables November

22 BLUETOOTH SPECIFICATION Version 1.2 [vol 2] page 748 of November 2003

23 BLUETOOTH SPECIFICATION Version 1.2 [vol 2] page 749 of SECURITY OVERVIEW Bluetooth wireless technology provides peer-to-peer communications over short distances. In order to provide usage protection and information confidentiality, the system provides security measures both at the application layer and the link layer. These measures are designed to be appropriate for a peer environment. This means that in each device, the authentication and encryption routines are implemented in the same way. Four different entities are used for maintaining security at the link layer: a Bluetooth device address, two secret keys, and a pseudo-random number that shall be regenerated for each new transaction. The four entities and their sizes are summarized in Table 1.1. Entity BD_ADDR Private user key, authentication Private user key, encryption configurable length (byte-wise) RAND Size 48 bits 128 bits bits 128 bits Table 1.1: Entities used in authentication and encryption procedures. The Bluetooth device address (BD_ADDR) is the 48-bit address. The BD_ADDR can be obtained via user interactions, or, automatically, via an inquiry routine by a device. The secret keys are derived during initialization and are never disclosed. The encryption key is derived from the authentication key during the authentication process. For the authentication algorithm, the size of the key used is always 128 bits. For the encryption algorithm, the key size may vary between 1 and 16 octets (8-128 bits). The size of the encryption key is configurable for two reasons. The first has to do with the many different requirements imposed on cryptographic algorithms in different countries both with respect to export regulations and official attitudes towards privacy in general. The second reason is to facilitate a future upgrade path for the security without the need of a costly redesign of the algorithms and encryption hardware; increasing the effective key size is the simplest way to combat increased computing power at the opponent side. The encryption key is entirely different from the authentication key (even though the latter is used when creating the former, as is described in Section 6.4 on page 783). Each time encryption is activated, a new encryption key shall be generated. Thus, the lifetime of the encryption key does not necessarily correspond to the lifetime of the authentication key. It is anticipated that the authentication key will be more static in its nature than the encryption key once established, the particular application running on the device decides when, or if, to change it. To underline the fundamental impor- Security Overview 05 November

24 BLUETOOTH SPECIFICATION Version 1.2 [vol 2] page 750 of 790 tance of the authentication key to a specific link, it is often be referred to as the link key. The RAND is a pseudo-random number which can be derived from a random or pseudo-random process in the device. This is not a static parameter, it will change frequently. In the remainder of this chapter, the terms user and application will be used interchangeably to designate the entity that is at either side November 2003 Security Overview

25 BLUETOOTH SPECIFICATION Version 1.2 [vol 2] page 751 of RANDOM NUMBER GENERATION Each device has a pseudo-random number generator. Pseudo-random numbers are used for many purposes within the security functions for instance, for the challenge-response scheme, for generating authentication and encryption keys, etc. Ideally, a true random generator based on some physical process with inherent randomness should be used as a seed. Examples of such processes are thermal noise from a semiconductor or resistor and the frequency instability of a free running oscillator. For practical reasons, a software based solution with a pseudo-random generator is probably preferable. In general, it is quite difficult to classify the randomness of a pseudo-random sequence. Within this specification, the requirements placed on the random numbers used are non-repeating and randomly generated. The expression non-repeating means that it shall be highly unlikely that the value will repeat itself within the lifetime of the authentication key. For example, a non-repeating value could be the output of a counter that is unlikely to repeat during the lifetime of the authentication key, or a date/time stamp. The expression randomly generated means that it shall not be possible to predict its value with a chance that is significantly larger than 0 (e.g., greater than 1 2 L for a key length of L bits). The LM may use such a generator for various purposes; i.e. whenever a random number is needed (such as the RANDs, the unit keys, K init, K master, and random back-off or waiting intervals). Random Number Generation 05 November

26 BLUETOOTH SPECIFICATION Version 1.2 [vol 2] page 752 of November 2003 Random Number Generation

27 BLUETOOTH SPECIFICATION Version 1.2 [vol 2] page 753 of KEY MANAGEMENT It is important that the encryption key size within a specific device cannot be set by the user this should be a factory preset entity. In order to prevent the user from over-riding the permitted key size, the Bluetooth baseband processing shall not accept an encryption key given from higher software layers. Whenever a new encryption key is required, it shall be created as defined in Section 6.4 on page 783. Changing a link key shall also be done through the defined baseband procedures. Depending on what kind of link key it is, different approaches are required. The details are found in Section on page KEY TYPES The link key is a 128-bit random number which is shared between two or more parties and is the base for all security transactions between these parties. The link key itself is used in the authentication routine. Moreover, the link key is used as one of the parameters when the encryption key is derived. In the following, a session is defined as the time interval for which the device is a member of a particular piconet. Thus, the session terminates when the device disconnects from the piconet. The link keys are either semi-permanent or temporary. A semi-permanent link key may be stored in non-volatile memory and may be used after the current session is terminated. Consequently, once a semi-permanent link key is defined, it may be used in the authentication of several subsequent connections between the devices sharing it. The designation semi-permanent is justified by the possibility of changing it. How to do this is described in Section on page 760. The lifetime of a temporary link key is limited by the lifetime of the current session it shall not be reused in a later session. Typically, in a point-to-multipoint configuration where the same information is to be distributed securely to several recipients, a common encryption key is useful. To achieve this, a special link key (denoted master key) may temporarily replace the current link keys. The details of this procedure are found in Section on page 759. In the following, the current link key is the link key in use at the current moment. It can be semi-permanent or temporary. Thus, the current link key is used for all authentications and all generation of encryption keys in the on-going connection (session). Key Management 05 November

28 BLUETOOTH SPECIFICATION Version 1.2 [vol 2] page 754 of 790 In order to accommodate different types of applications, four types of link keys have been defined: the combination key K AB the unit key K A the temporary key K master the initialization key K init Note: the use of unit keys is deprecated since it is implicitly insecure. In addition to these keys there is an encryption key, denoted K c. This key is derived from the current link key. Whenever encryption is activated by an LM command, the encryption key shall be changed automatically. The purpose of separating the authentication key and encryption key is to facilitate the use of a shorter encryption key without weakening the strength of the authentication procedure. There are no governmental restrictions on the strength of authentication algorithms. However, in some countries, such restrictions exist on the strength of encryption algorithms. The combination key K AB and the unit key K A are functionally indistinguishable; the difference is in the way they are generated. The unit key K A is generated in, and therefore dependent on, a single device A. The unit key shall be generated once at installation of the device; thereafter, it is very rarely changed. The combination key is derived from information in both devices A and B, and is therefore always dependent on two devices. The combination key is derived for each new combination of two devices. It depends on the application or the device whether a unit key or a combination key is used. Devices which have little memory to store keys, or are installed in equipment that will be accessible to a large group of users, should use their own unit key. In that case, they only have to store a single key. Applications that require a higher security level should use the combination keys. These applications will require more memory since a combination key for each link to a different device has to be stored. The master key, K master, shall only be used during the current session. It shall only replace the original link key temporarily. For example, this may be utilized when a master wants to reach more than two devices simultaneously using the same encryption key, see Section on page 759. The initialization key, K init, shall be used as the link key during the initialization process when no combination or unit keys have been defined and exchanged yet or when a link key has been lost. The initialization key protects the transfer of initialization parameters. The key is derived from a random number, an L-octet PIN code, and a BD_ADDR. This key shall only be used during initialization November 2003 Key Management