Pairing

What Is BLE Pairing?

Pairing is the security procedure through which two BLE devices establish a shared set of encryption keys. Once paired, the link is encrypted with AES-128-CCM, protecting data exchanged over GATT operations from eavesdropping and tampering. Pairing is managed by the Security Manager Protocol (SMP) and is distinct from bonding, which adds persistent key storage.

Pairing Phases

BLE pairing proceeds in three phases:

Phase 1 -- Feature Exchange. The two devices exchange their I/O capabilities (display, keyboard, yes/no buttons), authentication requirements (MITM protection), and supported pairing methods. This exchange determines which association model will be used: Just Works, Passkey Entry, Numeric Comparison, or OOB.

Phase 2 -- Key Generation. For LE Secure Connections (LESC), both devices perform an Elliptic Curve Diffie-Hellman (ECDH) key exchange on the P-256 curve, producing a shared secret that is then used to derive the Long Term Key (LTK). For Legacy Pairing, a Temporary Key (TK) is generated from the association model output, and a Short Term Key (STK) encrypts the link.

Phase 3 -- Key Distribution. The devices exchange additional keys over the now-encrypted link: the LTK (for future reconnections), the Identity Resolving Key (IRK, for LE Privacy), and optionally the Connection Signature Resolving Key (CSRK).

Initiating Pairing

Pairing can be triggered in several ways. The most common is a security request from the peripheral, which prompts the central to begin the pairing procedure. Alternatively, accessing a ATT">gatt-characteristic/" class="glossary-term-link" data-term="GATT characteristic" data-definition="Data value within a BLE service with R/W/N properties." data-category="GATT & ATT">GATT characteristic that requires authentication will cause the stack to return an Insufficient Authentication error, which a well-implemented central handles by automatically initiating pairing.

Security Levels

BLE defines four security levels (modes):

Choose the minimum level that your application's threat model requires. Over-specifying security (e.g., requiring Passkey Entry for a temperature sensor) degrades user experience without meaningful benefit.