Extended version: Tamarin-based Analysis of Bluetooth Uncovers Two Practical Pairing Confusion Attacks

This paper provides a Tamarin-based formal analysis of all key agreement protocols available in Bluetooth technologies, i.e., Bluetooth Classic, Bluetooth Low Energy, and Bluetooth Mesh. The automated analysis finds several unreported attacks, including two attacks (reported by Bluetooth SIG as CVEs) that exploit the confusion of pairing modes, i.e., when a communicating party uses the secure pairing mode while the other one uses the legacy pairing mode. They have been validated in practice using off-the-shelf implementations for the genuine communicating parties, and a custom BR/EDR machine-in-the-middle framework for the attacker.

Mots clés

Protocol security Formal models Bluetooth Attacks Protocol security Formal models Bluetooth Attacks

Domaines

Informatique [cs]

Fichier principal

master.pdf (605.17 Ko)

models.zip (2.45 Mo)

models_v2.zip (2.45 Mo)

Origine	Fichiers produits par l'(les) auteur(s)
Licence	Paternité

Licence	Paternité

Tristan Claverie : Connectez-vous pour contacter le contributeur

https://hal.science/hal-04079883

Soumis le : lundi 24 avril 2023-14:48:42

Dernière modification le : vendredi 13 septembre 2024-14:32:16

Dates et versions

hal-04079883 , version 1 (24-04-2023)

Licence

Paternité

Identifiants

HAL Id : hal-04079883 , version 1

Citer

Tristan Claverie, Gildas Avoine, Stéphanie Delaune, José Lopes Esteves. Extended version: Tamarin-based Analysis of Bluetooth Uncovers Two Practical Pairing Confusion Attacks. 2023. ⟨hal-04079883⟩

Exporter

BibTeX XML-TEI Dublin Core DC Terms EndNote DataCite

Collections

UNIV-RENNES1 CNRS INRIA INSA-RENNES IRISA IRISA-INSA-R CENTRALESUPELEC UR1-MATH-STIC UR1-UFR-ISTIC UNIV-RENNES INSA-GROUPE ANR UR1-MATH-NUM CYBERSCHOOL CYBERSCURITE

440 Consultations

604 Téléchargements