From 97d59a7c6d3fd1e997fca48729e1b914240b6fdc Mon Sep 17 00:00:00 2001 From: Joakim Andersson Date: Tue, 2 Feb 2021 15:36:53 +0100 Subject: [PATCH] Bluetooth: host: Mark the option BT_FIXED_PASSKEY as insecure Mark the option BT_FIXED_PASSKEY as an insecure option. During Legacy pairing the passkey is used as encryption key, and brute-forcing this is easy. During LE Secure Connections the passkey is checked one bit at a time, so when it is fixed the passkey can be deduced with series of pairing attempts. Signed-off-by: Joakim Andersson --- scripts/kconfig/hardened.csv | 1 + subsys/bluetooth/host/CMakeLists.txt | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/scripts/kconfig/hardened.csv b/scripts/kconfig/hardened.csv index 7c2a783505d..1f11da6af58 100644 --- a/scripts/kconfig/hardened.csv +++ b/scripts/kconfig/hardened.csv @@ -50,6 +50,7 @@ BT_HFP_HF,n,experimental BT_RFCOMM,n,experimental BT_DEBUG_SMP,n BT_OOB_DATA_FIXED,n +BT_FIXED_PASSKEY,n BT_DEBUG_KEYS,n BT_USE_DEBUG_KEYS,n BT_STORE_DEBUG_KEYS,n diff --git a/subsys/bluetooth/host/CMakeLists.txt b/subsys/bluetooth/host/CMakeLists.txt index 25cd87e2bdb..408431f9420 100644 --- a/subsys/bluetooth/host/CMakeLists.txt +++ b/subsys/bluetooth/host/CMakeLists.txt @@ -74,6 +74,12 @@ if(CONFIG_BT_DEBUG_SMP OR CONFIG_BT_DEBUG_KEYS) production." ) endif() +if(CONFIG_BT_FIXED_PASSKEY) + message(WARNING "CONFIG_BT_FIXED_PASSKEY is enabled + A fixed passkey is easy to deduce during the pairing procedure, do not use in + production." + ) +endif() if(CONFIG_BT_OOB_DATA_FIXED) message(WARNING "CONFIG_BT_OOB_DATA_FIXED is enabled. A hardcoded OOB data set will be stored in the image, do not use in