Smart Headphone BLE Pairing Security

Pairing (Association) Model

Attacker

Toy key size 16-bit

Live Status

MITM-resistant?

—

Keys match

—

Passive brute-force (offline)

—

Phone confirms:——————

Headset confirms:——————

Match:n/a for this model

Ready. Pick a pairing model and press Start Pairing.

How it works

Real BLE headphones use LE Secure Connections pairing: both devices generate an elliptic-curve (P-256) key pair, exchange public keys, and each derives the same shared secret via ECDH. This sim uses the same algebraic structure with a small toy modulus so the exponentiation is visible and instant, instead of real P-256 points:

Phone:     private a, public A = g^a mod p
Headset:   private b, public B = g^b mod p
Shared:    K = B^a mod p  =  A^b mod p   (Diffie–Hellman)

Passive eavesdropping (just listening to A, B over the air) never recovers K without solving the discrete-log problem — that's why the brute-force estimate below only matters if an attacker tries to crack the toy key size directly.

An active MITM is different: the attacker sits between phone and headset during pairing and runs two separate DH exchanges — (a, attacker) and (attacker, b) — relaying nothing genuine. Whether that gets caught depends entirely on the association model BLE negotiates:

Model	Authenticates public keys?	MITM outcome
Just Works	No	Silent success — attacker relays & decrypts everything
Numeric Comparison	Yes (user compares two 6-digit codes)	Codes on each device derive from different peer keys → mismatch → user rejects
Passkey Entry	Yes (shared passkey commits both sides)	Same mismatch detection as Numeric Comparison

This sim derives each device's 6-digit confirmation code as a toy hash of (own public key × the public key it actually received). Under Just Works no code is ever shown, so an attacker's substitution goes unnoticed — a real reason many cheap earbuds default to Just Works and are the weaker link in a phone/headset pair. Real BLE also folds in HMAC-based commitment values and a fixed elliptic curve, which this simplification omits for clarity.

Phone → Headset key Headset → Phone key Attacker-relayed traffic

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.