What Bluetooth encryption covers
Bluetooth has its own security: devices pair, agree on keys, and then encrypt the traffic on their connection. Bluetooth Low Energy has used AES-CCM for this since version 4.0, and version 4.2 added LE Secure Connections, which uses P-256 elliptic curve key agreement during pairing.
That protection belongs to one link. NIST’s Guide to Bluetooth Security, SP 800-121, is direct about it: only individual links are encrypted and authenticated, data is decrypted at intermediate points, and end-to-end security needs additional controls on top of the Bluetooth stack. Its example is a phone talking to a laptop over Bluetooth, with the laptop on Wi-Fi: Bluetooth protects the first hop, Wi-Fi security protects the second, and the wired network beyond gets neither.
The same guide lists other things the standard leaves to the application. Bluetooth authenticates devices, not users. Audit and non-repudiation are not part of the standard.
Why relays break the protection
In a chain of devices, each hop is its own Bluetooth connection with its own keys. A message is decrypted when it arrives at a relay and encrypted again for the next link, so it exists in readable form on every device in between. That covers a phone in a mesh network, a gateway that forwards sensor data, and any app that passes messages along.
Encryption on each link stops a stranger with a radio from reading that hop. It does nothing about the devices doing the relaying, which are exactly the devices a private message most needs protecting from when they belong to other people.
Pairing decides how strong one link is
Even for a single hop, Bluetooth security is a range of options, not one setting. The Bluetooth SIG describes its specifications as offering a number of security options and publishes guidance to help developers choose. SP 800-121 sets out the levels for LE Security Mode 1:
- Level 1: no authentication and no encryption.
- Level 2: unauthenticated pairing with encryption.
- Level 3: authenticated pairing with encryption.
- Level 4: authenticated LE Secure Connections pairing with encryption.
NIST recommends Level 4 for all LE connections where devices support version 4.2, and says Level 1 should never be used. It also warns that LE Legacy Pairing gives no protection against passive eavesdropping, so someone who captures the pairing exchange can recover the keys, and that the Just Works pairing method gives no protection against a man-in-the-middle. Which method two devices end up using depends on what each supports, including whether they have a screen or keypad.
Attacks on the link layer
Researchers have repeatedly found ways around Bluetooth’s own protection, which is one more reason not to rely on it alone.
- KNOB. Antonioli, Tippenhauer, and Rasmussen showed at USENIX Security 2019 that an attacker could make two Bluetooth Classic (BR/EDR) devices agree on an encryption key with only 1 byte of entropy, then brute-force it, decrypt traffic, and inject messages. The Bluetooth SIG responded by recommending a minimum encryption key length of 7 octets for BR/EDR connections.
- BLESA. Wu and colleagues showed at USENIX WOOT 2020 that when two previously paired BLE devices reconnect, link-layer authentication can be optional or skipped, letting an attacker impersonate one device and feed spoofed data to the other. They also found a related logic bug in the BLE stacks used by Android and iOS, which they reported to Google and Apple.
These flaws sit in the specification, the chip firmware, or the operating system’s Bluetooth stack. An app developer controls none of those.
What private messages need instead
Private messages need protection that travels with the message rather than with the link:
- End-to-end encryption between the sender’s and recipients’ keys, so relays and gateways handle only ciphertext. What is end-to-end encryption? explains the idea, and how a relay can carry a message it cannot read shows how it works hop by hop.
- Identity checks above the device level, with keys and signatures that tie a message to a person or account, since Bluetooth only authenticates devices.
- Bluetooth link encryption kept on as well. SP 800-121 describes layering application-level encryption over Bluetooth encryption, and the two together cover more than either alone.
Even then, encryption hides content, not everything. Who is near whom, when devices talk, and how much they send can still be visible, as encryption and metadata explains.