11.10.1 — Message Sequence for LE Legacy Pairing

The textbook shows a real BLE sniffer capture of a complete SMP transaction. Two devices are labelled Side 1 (Initiator/Master) and Side 2 (Responder/Slave). Security procedures start at Frame #690 with the Pairing Request. This is what you would see with Wireshark + a BLE sniffer dongle, or with btmon on Linux.

Figure 11.11 — Pairing Request Capture (Frame 690)

The Pairing Request from Side 1 (the Initiator) carries full capability information. The four main observations from this capture:

Figure 11.12 — Pairing Response Capture (Frame 693)

Side 2 (the Responder) replies with its own capabilities. Three critical observations that determine everything that follows:

Figure 11.13 — Full SMP Message Sequence Chart

This chart shows the complete pairing sequence derived from the air logs above, covering all three phases with the actual hex values seen in the capture.

Key observations from this capture:

• The Pairing Confirm values are opaque 128-bit blobs — without knowing TK and the random, they reveal nothing about the session key
• Just Works means TK=0, making the confirm and random values predictable to any eavesdropper who was listening. This is acceptable only because the pairing method was forced by the peripheral’s lack of display/keyboard — not because it is secure
• Only Encryption Information and Master Identification appear in Phase 3 — Side 2’s limited key distribution field (only EncKey=1) means no IRK or CSRK are distributed in this session
• After Phase 3, the channel map update at the end indicates normal data exchange is starting

Phase 1 Setup for LE Secure Connections (Figures 11.14–11.16)

The textbook references Figures 11.14–11.16 which show the LE Secure Connections sequence. Side 1 is the Master. The key difference in Phase 1 compared to legacy pairing is the AuthReq byte — the SC bit (bit 3) is set to 1 by both sides to signal that they both support and want Secure Connections pairing.

/* Triggering LE Secure Connections pairing with bluetoothctl */
/* Both devices must support BLE 4.2 and have SC feature bit  */

/* Check if your controller supports SC:                      */
hcitool cmd 0x08 0x0003  /* LE Read Local Supported Features */
/* Bit 6 (0x40) = LL Privacy, Bit 7+ = Extended Scanner      */
/* SC is advertised in SMP, not in LE features bitmap         */

/* Force SC with BlueZ (in main.conf):                        */
/* /etc/bluetooth/main.conf:                                  */
/* [Policy]                                                   */
/* JustWorksRepairing = always                                */

/* To pair from bluetoothctl:                                 */
/* [bluetooth]# pairable on                                   */
/* [bluetooth]# pair AA:BB:CC:DD:EE:FF                        */
/* If SC supported: Request confirmation: 384291 yes/no       */
/* (Numeric Comparison appears if both have display+buttons)  */

/* Monitor SC pairing with btmon:                             */
/* sudo btmon | grep -A 5 "SMP"                               */
/* Look for: Authentication requirement: Bonding, MITM, SC    */
/*                                                   ^^        */

Chapter 11 Security Manager — Complete Series