Bluetooth® Low Energy (BLE) Link Layer Security

Last modified by Microchip on 2023/11/10 11:16

BLE Link Layer Security Features

When in a Bluetooth® Low Energy (BLE) connection, data within the payload can be encrypted, ensuring the confidentiality of the data against attackers. Encrypted packets also include a message integrity check (MIC) value to authenticate the validity of a sender, as well as packet counters to prevent replay attacks.

The BLE Link Layer uses the AES-128 block cipher for authenticated encryption using Cipher Block Chaining-Message Authentication Code (CCM) Mode.

Basic Security Workflow in BLE

The BLE core specification defines rules and algorithms in the Security Manager (SM) and Generic Access Profile (GAP) layers to provide secure communications.

To keep it simple, when two devices who initially do not have security, wish to do something which requires security, the devices must first pair. This process could be triggered (for example) by a Client/Central/Master device that is attempting to access a data value (a "characteristic") on a Server/Peripheral/Slave that requires authenticated access.

​

Security modes and procedures are always deployed after a BLE connection is established. The Discovery and Connection processes are always unencrypted.

Pairing involves authenticating the identity of two devices, encrypting the link, and then distributing keys (for faster reconnection in the future, i.e., bonding) used for encryption.

Please refer to the "GAP Security" page for a detailed discussion on BLE security.