Real BLE headphones use LE Secure Connections pairing: both devices generate a real elliptic-curve key pair, exchange their public keys, and each derives the same shared secret via ECDH — crypto.subtle.deriveBits below runs the actual algorithm, no toy math:
Phone: real keypair (skPhone, pkPhone) — genuinely generated on device
Headset: real keypair (skHead, pkHead)
Shared: ECDH(skPhone, pkHead) === ECDH(skHead, pkPhone) (same 256/384/521-bit secret)
Only the public keys ever cross the air; the shared secret itself is never transmitted, so a purely passive eavesdropper who only records pkPhone/pkHead cannot compute it without solving the elliptic-curve discrete-log problem.
An active MITM is different: the attacker sits between phone and headset during pairing and generates two separate real ECDH key pairs, running one genuine ECDH exchange with the phone and a second, independent genuine ECDH exchange with the headset — it never touches either victim's private key, it just substitutes its own public keys on the wire. Whether that gets caught depends entirely on the association model BLE negotiates:
| Model | Authenticates public keys? | MITM outcome |
|---|
| Just Works | No | Silent success — attacker holds two real shared keys and can decrypt/re-encrypt every packet it relays |
| Numeric Comparison | Yes (user compares two 6-digit codes) | Each side's code is a real SHA-256 commitment over the public keys it actually saw → the attacker's two independent key pairs make the two codes differ → user rejects |
| Passkey Entry | Yes (shared passkey commits both sides out-of-band) | Same real mismatch detection as Numeric Comparison |
This sim's confirmation code is SHA-256(sorted(pkA, pkB)) over the two real raw public keys each side actually received — a genuine cryptographic commitment, computed with crypto.subtle.digest. Under Just Works no code is ever shown, so a substituted key goes unnoticed. When a pairing succeeds (no attacker, or an authenticated model with no attacker), the demo derives a real AES-256-GCM key from the ECDH secret and actually encrypts/decrypts a sample "audio packet" with crypto.subtle.encrypt/decrypt to prove both sides hold the identical key. When Just Works is silently MITM'd, the same real AES-GCM operations run through the attacker's two independent keys, so the log shows the attacker genuinely reading the plaintext mid-relay.