Security Analysis Of Bluetooth Channel Sounding Protocol And Implementations

### Overview In this talk, security consultant Sultan analyzes the Bluetooth Channel Sounding protocol, introduced in Bluetooth 6.0 to provide secure distance bounding and high-precision ranging. While traditionally distance bounding has leveraged Ultra-Wideband (UWB) or relied on insecure Bluetooth RSSI and Angle of Arrival (AoA) techniques, Channel Sounding aims to deliver secure distance estimates using existing 2.4 GHz radio hardware without substantial cost increases. The technology is primarily targeted at access control systems such as phone-as-a-key for automotive and building entry.

### Key Topics - **Ranging Modes**: The core specification defines Mode 1 (packet-based round-trip time of flight), Mode 2 (multicarrier phase-based ranging across 72 channels), and Mode 3 (a combination of both). Mode 0 measures crystal frequency offsets between initiator and reflector. - **Packet-Based Ranging (Mode 1)**: Employs CS sync packets with 32-bit access addresses and optional 32-to-128 bit sounding or random sequences generated by an AES-based pseudo-random number generator (PRNG). This gives 32 to 160 bits of pseudo-random data per packet, preventing simple early-response spoofing. - **Phase-Based Ranging (Mode 2)**: Measures phase shift and amplitude variations across multiple frequencies in the 2.4 GHz band to infer time of flight via phase slope. Because unmodulated tones carry little entropy, it relies on a single-bit pseudo-random "extension slot" per step where a tone may or may not be transmitted. - **Multipath Handling Algorithms**: To separate direct line-of-sight paths from multipath reflections, implementations analyze the sparse frequency response using Inverse Fast Fourier Transform (IFFT), the Multiple Signal Classification (MUSIC) algorithm, or trained neural networks.

### Technical Details & Implementation Flaws Although Channel Sounding contains primitives intended for security, Sultan identifies critical architectural and implementation deficiencies across major vendor SDKs (TI, Nordic Semiconductor, NXP, and Silicon Labs): 1. **Lack of Specification Mandates**: The Bluetooth specification defines measurement primitives but leaves the method of combining data and calculating final distance to vendors. It also fails to mandate how security signals should be validated. 2. **Precision vs. Security Mismatch**: Packet-based ranging offers strong cryptographic protection against spoofing but suffers from extremely poor distance precision (~37.5 meters per sample period at common 4 MHz sampling rates) due to narrow channel bandwidth. Conversely, phase-based ranging delivers the necessary centimeter-level precision but has minimal entropy. 3. **Discarding Security Primitives**: In practice, vendor SDKs prioritize phase-based measurements and either omit, disable by default, or discard packet-based estimates. None of the examined implementations cross-validate phase measurements against packet time-of-flight. 4. **Ignored Extension Slots**: While hardware measures extension slots and reports their presence/absence over the Host Controller Interface (HCI), higher-layer SDK stacks completely discard extension slot data, leaving phase-based ranging vulnerable to tone-injection and phase-manipulation attacks. 5. **Absence of NATAM**: The Normalized Attack Detector Metric (NATAM), designed to detect Early Detect Late Commit (EDLC) attacks via cross-correlation or harmonic analysis, is optional in the specification and was not implemented by any evaluated vendor.

### Takeaways Despite marketing claims promoting Channel Sounding as a secure ranging solution, current real-world implementations take the path of least resistance. Vendors default to unverified phase-based ranging for high precision while ignoring extension slots and omitting NATAM. Consequently, existing implementations fail to provide true secure distance bounding against active RF adversaries.