Subject: Bluetooth security

From: "Loganathan Ramasamy" <[email-masked]>
Date: 10 Jan 2001 03:42:03 -0000

Sir/Madam,
     As you all know that , the main problem for the BT(Bluetooth) right now is entering the PIN , to generate the intial shared key(kinit).
So i thought of a security protocol for BT using DFH(diffie-hellman).I want to know the opinion of yours.

My suggestion:
----------------
1)when 2 devices meet for the first time , they  will initiate the DFH key exchange.
2)At the end of the key exchange , both devices will have shared secret, so the master(the device which initiates the connection) will generate a 64 bit PIN  and send it across by encrypting  with the shared secret.
3)Now both devices can genearte the Kinit using this 64 bit PIN.

As you know that this DFH is subject to middle-man attack.To avoid this , both the devices will display a response string on their displays, which the user has to cross check manually across the devices.
For eg: if device A talks to B, then both the devices will display a random string "XYZSD" ,so the user will check  that the strings displayed on both the devices are  same.If the strings are same then it means that only A is talking to B and B is talking to A, there is no middle-man.

Does it mean that all BT devices has to have a display ? NO.
The devices which don't have display will redirect their response to a control device which has display.
Generally the devices that don't have display are in a environment, not much mobile.So there can be one control device in that environment which displays all the other devices response strings.
And if these devices are taken out of their environment then any device which supplies the proper credentials can act as a control display device for this device.

The other concern here is to generate the reponse string of very short length, may be 10-15 characters.

Before proceeding  further i need your opinion about
1)this new way of authentication , ie accepting the connnection by cross checking the string, instead of entering a PIN
2)  the user accepting the connection manually by cross checking a string of length 10-15 characters.

Thanks for your time.

Thanks
loganathan.R

_____________________________________________________
Chat with your friends as soon as they come online. Get Rediff Bol at
http://bol.rediff.com

-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]