I am using an HC-05 bluetooth Module. How can I stop someone from pairing with my device by brute forcing the key? Failing that, and if someone does pair with my device, is there a way to authenticate the user? I was thinking of salted hash with a shared secret key. Is there anything better?

  • Are you thinking that a device could repeatedly try and pair with you by submitting different keys over and over? I'm not sure about the spec of bluetooth nor maximum allowable key size ... but I'm guessing that you can set a key to be at least 8 bytes in length ... which makes a brute force attack on your device no more or less likely than a brute force attack on any other password protected environment. – Kolban Jun 9 '15 at 16:46
  • Why is your device always accepting pair requests? – Ignacio Vazquez-Abrams Jun 9 '15 at 17:07
  • @Kolban HC-05 does not take any more than 4 numbers. tec.reutlingen-university.de/uploads/media/… – Lord Loh. Jun 9 '15 at 17:07
  • @IgnacioVazquez-Abrams It does not. But with just 10000 pins, it is not hard to brute force. Should I add an application layer security? Nonce / salting / hashing etc? – Lord Loh. Jun 9 '15 at 17:09
  • 2
    @IgnacioVazquez-Abrams How do I disable pairing on an HC-05? – Lord Loh. Jun 9 '15 at 18:10

Configure your Bluetooth module to AT Command Mode

Then use AT+PIN Command to change the default PAIRING PIN of the Bluetooth Module.

Visit this link for more information about how to configure bluetooth to AT Mode

| improve this answer | |
  • The question was not how to change the PIN, but whether on not to trust the link layer security? For my application. – Lord Loh. Jun 9 '15 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.