Wireless Security.pdf - PDF Archive

464 Chapter 19
Device A: Master
Device B: Slave
BD_ADDR (A)
RAND A
BD_ADDR (A)
clock (A)
E0
clock (A)
E0
Kc
Kc
Kstr
Kstr
Data A→B
Data A→B
Data
Data B→A
Data B→A
Figure 19.9: Bluetooth encryption
Preamble
Access code Header Data
Sync word
Trailer
LT_
ADDR
Type
Flow,
ARQN,
SEQN
HEC
Payload
Figure 19.10: Bluetooth packet format
the ciphertext. There are a few important things to note about the encryption process in
Bluetooth.
First, not all bits of the Bluetooth packet are encrypted. Figure 19.10 shows the format
of a Bluetooth packet. It consists of an access code followed by a header and finally the
payload. The access code is derived from the BD_ADDR of the master of the piconet and
since every piconet has a unique master, the access code uniquely identifies a piconet.
The access code is therefore used by the devices in a piconet to determine if a packet is
for another piconet, in which case the packet is discarded.
The access code also defines where a slot boundary lies and is therefore also used by the
slaves in a piconet to synchronize their clocks to the master’s clock. It is therefore not
a surprise that the access code in Bluetooth packets is not encrypted. Next, the header
in the Bluetooth packet is also not encrypted. The reason for this is also pretty obvious
when you consider that the header contains the address of the destination device. This
www.newnespress.com