Bluetooth can operate in one of three security models:

• Mode 1 is non security.
• Mode 2 provides security at the service level, after the channel is established.
• Mode 3 provides security at the link level, before the channel is established.

Each Bluetooth device has a unique 48-bit device address. The authentication scheme is challenge-response, using symmetric keys, and encryption is done with a key that can be up to 128 bits (negotiated by the communicating devices, with each device having a maximum key length defined). A 128 bit random link key handles security transactions between two or more devices.

When two Bluetooth devices establish a communications channel, they both create an initialization key. A passkey or Personal Identification Number is input and the inititalization key is created, and the link key is calculated using it. Then the link key is used for authentication.

The first security concern is the passkey or PIN. As with any key, long keys are more secure than short ones. If a hacker is able to discover the passkey, he can calculate possible initiation keys, and then from that, calculate the link key. Making the passkey long will make it much harder to accomplish the first step.

The initial key exchange takes place over an unencrypted link, so it is especially vulnerable. It’s best if this part of the BT device pairing process takes place in a more physically secure location (that is, where there are not likely to be any lurkers with BT devices who could intercept the communications). A hacker could record transmissions sent over the BT frequency and use them to recreate the PIN.

Rather than using the same fixed passkey all the time, it should be changed frequently (how frequently depends on the types of devices and the required security level).

Link keys can be combination keys or unit keys. Best security practice is to use combination keys instead of unit keys. When you use a unit key, you must use the same key for all secure transactions, and the key has to be shared with other trusted devices. This means any trusted device can potentially access traffic with other trusted devices using this key.

It’s possible to use the Bluetooth address to identify a particular device (and associated user) and log those transactions, which can create privacy concerns.