points by evan_a_a 16 hours ago | 0 comments
BLE is not insecure if you configure the pairing process to use LE Secure Connections with authenticated pairing, which does exactly what you have implemented (ECDH key agreement). "Just Works" pairing is the only method vulnerable to MITM because it doesn't require out-of-band confirmation.
It shares exchanges a pre-shared key one time at pairing then trusts that both sides will remember the PSK.
So long as you pair while there is definitely nobody around and sniffing Bluetooth traffic, it’s an excellent system.
But the author clearly wanted to go through the effort of implementing Duffy Hellman for this.