BLE LE Secure Connections pairs two devices with a real Elliptic-Curve Diffie-Hellman (ECDH) handshake over the curve secp256r1. Each side picks a secret scalar and publishes a point on a shared curve:
Curve: y² = x³ + a·x + b (mod p)
Watch: picks d_w → publishes Q_w = d_w · G
Phone: picks d_p → publishes Q_p = d_p · G
Shared: S = d_w · Q_p = d_p · Q_w = (d_w·d_p) · G
Scalar multiplication uses real modular point-addition (chord-and-tangent group law with a modular inverse), so both sides land on the exact same point without either ever transmitting its private scalar — an eavesdropper only ever sees Qw and Qp, public points that reveal no computationally feasible path back to dw or dp.
Why the demo curve is crackable: this visualizer uses p ≤ 193 so the "Eavesdropper brute-force" panel finishes on screen. Real secp256r1 has roughly 2²⁵⁶ points — the identical exhaustive search would still be running long after the sun burns out. Security here comes entirely from key size, not from a different algorithm.
Just Works vs Numeric Comparison: "Just Works" accepts whatever public key arrives with no out-of-band check, so an active attacker can run two separate ECDH handshakes — one impersonating the phone to the watch, one impersonating the watch to the phone — and relay traffic while decrypting it, undetected. "Numeric Comparison" derives a 6-digit code from both devices' public keys and displays it on each screen for the user to confirm matches; because the attacker's two forged key pairs are different, the codes diverge and the mismatch exposes the man-in-the-middle before any data is exchanged.
- p selector — swaps the field prime, changing the curve's point count and how long brute force takes.
- dw / dp sliders — each device's private scalar.
- Association model — toggles whether a 6-digit comparison code is computed and checked.
- Attacker — off, a silent eavesdropper (tries to brute-force dw), or an active MITM relay.