Relay Attacks on Bluetooth Authentication and Solutions

  • Albert Levi
  • Erhan Çetintaş
  • Murat Aydos
  • Çetin Kaya Koç
  • M. Ufuk Çağlayan
Part of the Lecture Notes in Computer Science book series (LNCS, volume 3280)


We describe relay attacks on Bluetooth authentication protocol. The aim of these attacks is impersonation. The attacker does not need to guess or obtain a common secret known to both victims in order to set up these attacks, merely to relay the information it receives from one victim to the other during the authentication protocol run. Bluetooth authentication protocol allows such a relay if the victims do not hear each other. Such a setting is highly probable. We analyze the attacks for several scenarios and propose practical solutions. Moreover, we simulate attacks to make sure about their feasibility. These simulations show that current Bluetooth specifications do not have defensive mechanisms for relay attacks. However, relay attacks create a significant partial delay during the connection that might be useful for detection.


Authentication Scheme Connection Establishment Request Authentication Zone Route Protocol Current Delay 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Bluetooth SIG. Specification of the Bluetooth System – Bluetooth Core Specification, Vol. 0-3, Version 1.2 (2003),
  2. 2.
    Jakobsson, M., Wetzel, S.: Security Weaknesses in Bluetooth. In: Naccache, D. (ed.) CT-RSA 2001. LNCS, vol. 2020, pp. 176–191. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  3. 3.
    Vainio. J.T.: Bluetooth Security (2000),
  4. 4.
    Kügler, D.: Man in the Middle Attacks on Bluetooth. In: Wright, R.N. (ed.) FC 2003. LNCS, vol. 2742, pp. 149–161. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  5. 5.
    Welsh, E., Murphy, P., Frantz, P.: Improving Connection Times for Bluetooth Devices in Mobile Environments. In: International Conference on Fundamentals of Electronics, Communications and Computer Sciences (ICFS), Tokyo, Japan (2002)Google Scholar
  6. 6.
    Bray, J., Sturman, C.F.: Bluetooth: Connect Without Cables. Prentice-Hall, Englewood Cliffs (2000)Google Scholar
  7. 7.
    Bhagwat, P., Segall, A.: A Routing Vector Method (RVM) for Routing in Bluetooth Scatternets. In: IEEE International Workshop on Mobile Multimedia Communications, MoMuC 1999 (1999)Google Scholar
  8. 8.
    Wang, Z., Thomas, R.J., Haas, Z.: Bluenet - A New Scatternet Formation Scheme. In: 35th Annual Hawaii International Conference on System Sciences (2002)Google Scholar
  9. 9.
    Kapoor, R., Gerla, M.: A Zone Routing Protocol for Bluetooth scatternets. In: WCNC (2003)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2004

Authors and Affiliations

  • Albert Levi
    • 1
  • Erhan Çetintaş
    • 2
  • Murat Aydos
    • 3
  • Çetin Kaya Koç
    • 4
  • M. Ufuk Çağlayan
    • 5
  1. 1.Fac. of Eng. & Nat. Sci.Sabanci UniversityIstanbulTurkey
  2. 2.National Research Institute of Electronics and Cryptology GebzeTUBITAK – UEKAEKocaeliTurkey
  3. 3.Dept. of Computer EngineeringPamukkale UniversityDenizliTurkey
  4. 4.School of Electr. Eng. & Comp. Sci.Oregon State Univ.CorvallisUSA
  5. 5.Dept. of Computer EngineeringBoğaziçi UniversityIstanbulTurkey

Personalised recommendations