Smartwatch BLE Pairing & Key Exchange (2D)

Pairing Handshake

Watch and phone derived a matching key

Curve size (field prime p)

Watch private key d_w —

Phone private key d_p —

Pairing Association Model

Attacker in BLE Range

Session Keys

Watch's session key x

—

Phone's session key x

—

Curve order (points)

—

Eavesdropper brute-force

idle

How it works

BLE LE Secure Connections pairs two devices with a real Elliptic-Curve Diffie-Hellman (ECDH) handshake over the curve secp256r1. Each side picks a secret scalar and publishes a point on a shared curve:

Curve:   y² = x³ + a·x + b  (mod p)
Watch:   picks d_w  → publishes  Q_w = d_w · G
Phone:   picks d_p  → publishes  Q_p = d_p · G
Shared:  S = d_w · Q_p  =  d_p · Q_w  =  (d_w·d_p) · G

Scalar multiplication uses real modular point-addition (chord-and-tangent group law with a modular inverse), so both sides land on the exact same point without either ever transmitting its private scalar — an eavesdropper only ever sees Q_w and Q_p, public points that reveal no computationally feasible path back to d_w or d_p.

Why the demo curve is crackable: this visualizer uses p ≤ 193 so the "Eavesdropper brute-force" panel finishes on screen. Real secp256r1 has roughly 2²⁵⁶ points — the identical exhaustive search would still be running long after the sun burns out. Security here comes entirely from key size, not from a different algorithm.

Just Works vs Numeric Comparison: "Just Works" accepts whatever public key arrives with no out-of-band check, so an active attacker can run two separate ECDH handshakes — one impersonating the phone to the watch, one impersonating the watch to the phone — and relay traffic while decrypting it, undetected. "Numeric Comparison" derives a 6-digit code from both devices' public keys and displays it on each screen for the user to confirm matches; because the attacker's two forged key pairs are different, the codes diverge and the mismatch exposes the man-in-the-middle before any data is exchanged.

p selector — swaps the field prime, changing the curve's point count and how long brute force takes.
d_w / d_p sliders — each device's private scalar.
Association model — toggles whether a 6-digit comparison code is computed and checked.
Attacker — off, a silent eavesdropper (tries to brute-force d_w), or an active MITM relay.
Drag / scroll on the lattice — pan and zoom the GF(p)×GF(p) field of curve points.

Field points (curve E) Generator G Watch's public key Q_w Phone's public key Q_p Attacker key(s)

drag to pan · scroll to zoom