Assistive Listening Knowledge Base
  • Security design guidance

Bluetooth Security and Privacy Best Practices Guide, revision R04

From https://assistivelisteningknowledgebase.org/evidence/bluetooth-sig-security-best-practices/ · record checked 13 October 2026

  • Bluetooth SIG Security and Privacy Improvement Program
  • Bluetooth SIG

Standards body (Bluetooth SIG, an industry association funded by its member companies, which owns the Auracast trademark)

Summary

Advises implementers to protect broadcast-code exchange and use long, random codes, while discussing usability and the limits of short codes.

Key findings

  • Section 4.22, page 54, recommends LE Security Mode 3 Level 3 for private broadcast content. It explains that authenticating code exchange helps prevent an intermediary obtaining the code, and says the authentication method was not specified by Core 5.3.
  • Section 4.23, page 55, warns that someone with a recorded encrypted broadcast can try possible codes offline without a limit on attempts. It recommends a long random code where content must be protected from listening or manipulation, and occasional changes when a suitable exchange mechanism exists.
  • Long codes are harder to remember and enter; sharing them through another encrypted channel can reduce that burden. Even a short code can protect against packet modification during the time an attacker is still searching for it.
  • For publicly accessible media such as airport announcements, the guide allows an easy-to-remember code and recommends changing it periodically to hinder false data injection. The guide does not establish protection against an attacker who is legitimately given that code.

Limits

Implementation guidance, expressly intended to clarify rather than specify; revision date taken from the cover. Sections 4.22 and 4.23 were read in full. No venue measurements, listener sample or evaluation against malicious code holders. Its advice about public codes needs the shared-code threat model in BISON and BACON alongside it.

Read the original

www.bluetooth.com/download/bluetooth-security-and-privacy-best-practices-guide

Link checked . We link to the original and do not host copies.

Cited in

Cite this source

Bluetooth SIG Security and Privacy Improvement Program. Bluetooth Security and Privacy Best Practices Guide, revision R04. Bluetooth SIG. 24 January 2023. https://www.bluetooth.com/download/bluetooth-security-and-privacy-best-practices-guide/ (accessed 13 October 2026).

The accessed date is when this library last checked the link; use the date you read it. To point readers to this summary instead, link to https://assistivelisteningknowledgebase.org/evidence/bluetooth-sig-security-best-practices/

Every finding here cites its source, and who funded each source is labelled. This site does not recommend products. Found an error or a missing study? Suggest a correction.