11.3 Bluetooth, NFC, and Wireless Pairing Safety
The Ceremony Is the Security
Bluetooth pairing does two jobs: it derives a link key, and it proves no one is relaying the exchange. The derivation has been strong since LE Secure Connections -- an ECDH P-256 exchange yields a DHKey that feeds key derivation into the long-term key -- but the authentication phase decides the outcome. Numeric comparison shows the same six-digit value on both devices and a human confirms; a man-in-the-middle cannot force both screens to display matching attacker-chosen values, so the check binds the keys to your eyes. Passkey entry is stronger still. Just Works, the default for keyboards, earbuds, and IoT with no display or buttons, performs no out-of-band check: the attacker relays confirmations in both directions and neither device can tell. Legacy pairing was worse -- Just Works skipped authentication entirely.
When Radios Talk Too Much
BLE advertising is unauthenticated, and that enables "BLE spam": Apple Continuity and AirDrop, or Microsoft Swift Pair prompts, can be triggered by broadcast packets alone, so an attacker floods a room with spoofed pairing requests your phone cannot reject at the protocol layer -- the OS rate-limits the popups, it cannot filter the spoof. Meanwhile KNOB showed legacy key negotiation could be coerced toward tiny entropy, letting recorded traffic be decrypted, and cross-transport key derivation bugs (BLURtooth-style) let a weak legacy pairing poison a secure one. Boring defenses win: radios off when not pairing, non-discoverable by default, and never accept a pairing prompt you did not start.
NFC Relay: Proximity Is an Assumption
Contactless cards trust physics -- ISO 14443 works at ten centimeters, so the terminal assumes presence. Split that ten centimeters into two attacker positions joined by a fast link and nothing notices: one relay talks to the card in the victim's pocket, the other talks to the real terminal, and every challenge-response frame forwards verbatim. The card is not fooled because it genuinely is talking to the real reader. Distance-bounding round-trip timing is the true fix, but most deployed tap-to-pay stacks do not enforce it. Phone-based credentials help mainly by adding dynamic tokens and user verification to the transaction, not by being immune to relaying.
Practical Pairing Discipline
Pair in private when it matters -- the ceremony is the control, so do not perform it where an attacker shares the radio range. Remove old pairings you no longer use, since every stored link key is attack surface, and apply firmware updates that close KNOB-class flaws. Treat unprompted pairing requests as probes, not glitches.
Architecture Diagram
Key Takeaways
- Pairing security lives in the authentication phase: numeric comparison and passkey entry stop MITM; Just Works does not.
- Legacy pairing plus Just Works means unauthenticated keys -- prefer LE Secure Connections devices and patch firmware.
- BLE spam exploits unauthenticated advertising that triggers pairing popups; deny anything you did not initiate.
- NFC relay defeats the ten-centimeter assumption by forwarding ISO 14443 frames; only distance-bounding truly stops it.
- Turn radios off when not pairing, keep devices non-discoverable, and prune old pairings.