 CHAPTER 5.1 Wireless local area networks free-space margin required sensitivity obstructed margin excess noise budget thermal noise transmit antenna antenna receive (S/N) output efficiency directivity efficiency signal requirement Figure 5.1-25 Bluetooth example link budget: 10 m, 0 dBm TX power. are constrained to be quite small to fit into portable/ Authentication and encryption are both provided and use handheld devices. At 3 m the free-space path loss is about distinct keys. The cipher stream generation uses the E0 51 dB; we assumed that if a person is in the way of the sequence generator, which is at the present regarded as direct path, an additional 10 dB of obstructed loss is en- harder to attack than RC4. However, just like in 802.11, countered. If we assume a modest 4 dB (S/N) is required weaknesses are present due to the usage models. Keys for by the GMSK modulation, we find that we have room for devices with a user interface are based on manually en- 39 dB of excess noise from the receiver while still tered identifier (PIN) codes. Users won't remember long providing 10 dB of link margin in the presence of an complex codes and don't do a very good job of choosing obstruction. This is a huge noise figure; practical Bluetooth the codes they use at random, SO links are likely to be devices can do much better. The Bluetooth specifications vulnerable to brute force key-guessing attacks. Devices are appropriate for inexpensive devices meant to com- without a user interface have fixed PIN codes, obviously municate at moderate rates over ranges of a few meters. more vulnerable to attack. Devices that wish to com- A few words about the security of a Bluetooth link municate securely must exchange keys in a pairing seem appropriate. Bluetooth links have two fundamental operation; if an eavesdropper overhears this operation, security advantages over 802.11 irrespective of any en- they are in an improved position to attack the data. cryption technology. The first is a physical limit: a Blue- Although there hasn't b