Extended version: Tamarin-based Analysis of Bluetooth Uncovers Two Practical Pairing Confusion Attacks
Résumé
This paper provides a Tamarin-based formal analysis of all key agreement protocols available in Bluetooth technologies, i.e., Bluetooth Classic, Bluetooth Low Energy, and Bluetooth Mesh. The automated analysis finds several unreported attacks, including two attacks (reported by Bluetooth SIG as CVEs) that exploit the confusion of pairing modes, i.e., when a communicating party uses the secure pairing mode while the other one uses the legacy pairing mode. They have been validated in practice using off-the-shelf implementations for the genuine communicating parties, and a custom BR/EDR machine-in-the-middle framework for the attacker.
Fichier principal
master.pdf (605.17 Ko)
Télécharger le fichier
models.zip (2.45 Mo)
Télécharger le fichier
models_v2.zip (2.45 Mo)
Télécharger le fichier
