Classic Bluetooth Encryption

To decrypt a Classic Bluetooth link there are two options in the Security pane.

1. PIN : Enter into the PIN/TK field; legacy pairing only.

   Note: The only time a PIN can be used is when the datasource has captured Legacy Pairing in the current trace. The datasource uses information transferred during the Legacy Pairing process to calculate a Link Key.

2. Link Key: Enter into the Link Key field.
   

Passkey/PIN

The first option uses a PIN to generate the Link Key. If the analyzer is given the PIN and has observed complete pairing it can determine the Link Key. Since the analyzer also needs other information exchanged between the two devices, the analyzer must catch the entire Pairing Process or else it cannot generate the Link Key and decode the data.

The PIN/TK can be up to a maximum of 16 alphanumeric ASCII characters or a hexadecimal value that the user enters. When entering a hexadecimal value it must include a “0x” prefix, for example, “0x1234ABCD”.

Link Key

If you know the Link Key in advance you may enter it directly. To enter the Link Key click on the device row Link Key field and enter the Link Key in hex followed by the keyboard Enter key. If the link key has previously been entered it is automatically entered in the edit box after the Master and Slave have been selected. Once the Link Key is entered the ACO automatically appears in the Security pane for the devices in the link.

Note: The Link Key does not have to be prefixed with "0x" because the Link Key field will only accept hex format, and the "0x" prefix is added automatically. Entering "0x..." will result in an invalid entry result.

If the Link Key is correct the Link Key field for the devices in the encrypted link will appear green with "valid" below the link key. If the Link Key is not correct the Link Key field will appear red with "invalid" below the link key. To re-enter the Link Key click on the Link Key field and follow the procedure above.

SSP Debug Mode

If one of the Bluetooth devices is in SSP Debug Mode then the Frontline Sodera analyzer can automatically figure out the Link Key, under certain conditions. To obtain the information for figuring out the Link Key, the software must actively observe the SSP pairing process in the capture. If the SSP pairing previously took place and encrypted data is later captured the software does not have the necessary information to figure out the Link Key. The only alternatives are

• to again pair the devices in SSP Debug Mode, or
• to independently determine the Link Key and enter it directly..

Note: Only one device in the link must be in SSP Debug Mode.

If the Bluetooth devices do not allow Debug Mode activation, enter the Link Key as described above.

Also see these related topics...