Wireless Security.pdf - PDF Archive

Security in Wireless Ad Hoc Networks 455
should enter the same PKEY. On the other hand, fixed PKEYs refer to PKEYs that are
preconfigured into the Bluetooth device. Again, both the communicating devices should
be preconfigured with the same PKEY. Even though variable PKEYs are more secure
(since the PKEY can be changed on a per-pairing basis), both variable and fixed PKEYs
serve specific purposes. Consider for example, a scenario where users in a conference
room wish to form a Bluetooth network using their laptops. Such a scenario is well-suited
for using variable PKEYs, since each device has user interaction capabilities. On the
other hand, consider the Bluetooth network between the headset and its cell phone. The
Bluetooth headset must use a fixed PKEY since there is no 5 user interaction capability on
the headset. The Bluetooth standard also allows the use of higher layer key-establishment
protocols to generate the PKEY and pass it on to the Bluetooth stack.
Since the PKEY can come from one of many sources, instead of specifying the exact
length of the PKEY, the Bluetooth standard specifies that the PKEY can be as long as
128 bits. This allows for devices prompting the user for a PKEY to enter a much smaller
PKEY (or a PIN) thus making user interaction a little more convenient. However, using
a smaller PKEY has other drawbacks. As we will see in the next few sections, the PKEY
is the starting point for establishing the Link Key, which in turn forms the basis of all
security in Bluetooth. To be precise, the PKEY is the shared secret between the two
communicating endpoints that ensures the Link Key is known only to the communicating
end-points. The use of a smaller PKEY means that an attack like the dictionary attack
becomes much easier to launch. In this context, a dictionary attack involves calculating
all the link keys that can be derived from all possible PKEYs. This list of link keys is
maintained in a table and can then be used against plaintext, ciphertext pairs 6 to
determine which link key is being used.
19.2.3.2 Initialization Key
The next level in the hierarchy is the Initialization Key (IK or K INIT ). The K INIT is a shortlived
temporary key that is used (and exists only) during the pairing process when two
Bluetooth devices start communicating for the first time. The K INIT is derived using the
E 22 algorithm and three inputs: PKEY, IN_RAND and L PKEY . The PKEY is the pass-key
that we just talked about and L PKEY is the length of this pass-key in bytes. Finally, the
5
Or rather hardly any.
6
For example AU_RAND, SRES pairs.
www.newnespress.com