BLUFFS: Bluetooth Forward andFuture Secrecy Attacks andDefenses
ACM CCS’23

Daniele Antonioli(EURECOM, S3)

Bluetooth (BT)● BT is a pervasive low-power wireless technology○ Specified in bluetooth-core.pdf (v5.4) (layers, security, …)○ BC: Bluetooth Classic○ BLE: Bluetooth Low Energy○ Used by smartphones, laptops, cars, wearables, sensors, …
● One BT spec vulnerability → Billions of exploitable devices○ 2021: BLUR cross-transport overwrites on BC/BLE○ 2020: BIAS authentication bypasses on BC○ 2019: KNOB key downgrades on BC and BLE
Daniele Antonioli - BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses

2

BT Security● Pairing○ Pairing key (PK), long term, BLE entropy negotiation○ Optionally authenticated (numeric PIN, …)● Session Establishment○ Session key (SK), fresh, BC entropy negotiation○ SK = kdf(PK, pars)● Negotiable security mode
○ Secure Connections (SC)○ Legacy Secure Connections (LSC)
Daniele Antonioli - BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses

3Forward and Future Secrecy (FoS, FuS)
● Forward Secrecy (FoS)○ Protects past sessions against key compromise○ Eg: key = HKDF(const, key_past)● Future Secrecy (FuS)○ Protects future sessions against key compromise○ Eg: key_future = HKDF(dhss, key)

● BT FoS and FuS guarantees?
○ Not discussed in the BT spec and no prior evaluation○ Despite widespread in the real-world (TLS1.3, Signal, …)Daniele Antonioli - BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses

4

Contributions● First study on BT FoS and FuS● Uncover 2 FoS/FuS vulns in BC SK derivation● Develop 6 BLUFFS attacks breaking BC sessions’ FoS/FuS● Exploit 18 popular devices (Intel, Broadcom, Apple, Google,Microsoft, CSR, Logitech, Infineon, Bose, Dell, Xiaomi, …)● Fix the attacks with a compliant and practical protocol● Report critical findings to BT SIG, get CVE-2023-24023● Release BLUFFS toolkit to test the attacks and BC FoS/FuS
Daniele Antonioli - BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses

5BLUFFS Threat model● BC should provide FoS and FuS among sessions○ Fresh SKs, PK not compromised● Alice (Central) and Bob (Peripheral)○ Paired and share PK○ Use SC or LSC● Charlie (attacker)○ Model: proximity-based, cannot compromise PK or all SKs○ Goals: break sessions’ FoS and FuS○ Impact: impersonate and MitM devices across sessions
Daniele Antonioli - BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses

6

BLUFFS Attacks
t0: Alice and Bob establish PK
t1: Charlie forces weak SKC, saves SKC kdf pars, sniffs st1, …
t2: Charlie brute forces SKC and breaks st1, …, st2 (breaks FoS)
t3: Charlie re-forces SKC and breaks st3, st4, … (breaks FuS)

Daniele Antonioli - BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses

7

BLUFFS Attacks
t0: Alice and Bob establish PK
t1: Charlie forces weak SKC, saves SKC kdf pars, sniffs st1, …
t2: Charlie brute forces SKC and breaks st1, …, st2 (breaks FoS)
t3: Charlie re-forces SKC and breaks st3, st4, … (breaks FuS)
t∞: Charlie celebrates (One More Time)!

Daniele Antonioli - BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses

8t1: Force weak SKC, save SKC kdf pars, sniff [A3, A6]
Alice (Central)

Charlie (MitM)

Bob (Peripheral)

BAA , SC or LSC

BAA , LSC

BAB , LSC

BAB , SC or LSC

ACAC

CR
SE = 16CR
SE = 7

SE = 7SD

SK entropy OKSD

SKC=kdf(PK, LSC, BAB, AC, SE, SD)

Save BAB, AC, SD, SE
Sniff c1, c2, …

SKC=kdf(PK, LSC, BAB, AC, SE, SD)

c1 = Enc(m1, SKC)

c1c2

c2 = Enc(m2, SKC)

Daniele Antonioli - BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses

KNOB SKdowngrade9t2: Brute force SKC and break st1, …, st2 (break FoS)
● SKC has 56 bits of entropy (SE = 7)○○○○

255 trials on average (other than 255 x sessions)
56 bit sym keys broken since DES (Deep Crack, COPACOBANA)
keylenght.com sets a min of 84 bits (56 bits in 1982)
Doable in weeks with a low-cost setup● SKC has 8 bits of entropy (SE = 1)
○ Doable in real time (even with pen and paper)

Daniele Antonioli - BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses

10t3: Re-force SKC and break st3, st4, … (break FuS) [A1, A4]
Charlie (as Alice)

Bob (Peripheral)
BAA , LSC
BAB , SC or LSC
ACCR
SE = 7
SK entropy OKSD

Knows SKC

BIAS PK
auth skip

KNOB SK
downgrade

SKC=kdf(PK, LSC, BAB, AC, SE, SD)
c1 = Enc(m1, SKC)
c2 = Enc(m2, SKC)

Daniele Antonioli - BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses

11t3: Re-force SKC and break st3, st4, … (break FuS) [A2, A5]Charlie (as Bob)

Alice (Central)
BAB , LSC
BAA , SC or LSC
Role Swich, ACCR
SE = 7
SK entropy OKSD

Knows SKC

BIAS PK
auth skip

KNOB SK
downgrade

SKC=kdf(PK, LSC, BAB, AC, SE, SD)
c1 = Enc(m1, SKC)
c2 = Enc(m2, SKC)

Daniele Antonioli - BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses

12t3: Re-force SKC and break st3, st4, … (break FuS) [A3, A6]
Alice (Central)

Charlie (MitM)

Bob (Peripheral)

BAB , LSC

BAA , LSC

BAA , SC or LSC

BAB , SC or LSC

Role switch, ACACCR
SE = 7CR
SE = 7SK entropy OKSD

SK entropy OKSD

SKC=kdf(PK, LSC, BAB, AC, SE, SD)

Knows SKCKNOB SKdowngrade

SKC=kdf(PK, LSC, BAB, AC, SE, SD)

c1 = Enc(m1, SKC)

c1c2

c2 = Enc(m2, SKC)

Daniele Antonioli - BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses

BIAS PK
auth skip

13

BLUFFS Attacks Summary and Root Causes (Vulns)

RC1: LSC SK diversification is unilateral
RC2: LSC SK diversification does not use nonces
RC3: LSC SK diversifiers are not integrity protected
RC4: Downgrading SC to LSC does not require authentication
Daniele Antonioli - BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses

14

BLUFFS Attacks Exploiting 18 devices (17 chips)

Daniele Antonioli - BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses

15

Conclusion and Q&A● First study on BT FoS and FuS (paper, slides)● Uncover 2 FoS/FuS vulns in BC SK derivation● Develop 6 BLUFFS attacks breaking BC sessions’ FoS/FuS● Exploit 18 popular devices (Intel, Broadcom, Apple, Google,Microsoft, CSR, Logitech, Infineon, Bose, Dell, Xiaomi, …)● Fix the attacks with a compliant and practical protocol● Report critical findings to BT SIG, get CVE-2023-24023● Release BLUFFS toolkit to test the attacks and BC FoS/FuS
Daniele Antonioli - BLUFFS: Bluetooth Forward and Future Secrecy Attacks and Defenses

16