What is the difference between pairing with a bluetooth device vs connecting to a bluetooth device?

Question

I am working on a Flutter app that connects to a bluetooth IOT device. I am using the flutter_blue library. This library allows for the scanning of nearby bluetooth devices. Based on that scan you can "connect" to a device. There is no concept of pairing to a device.

From my previous experience using bluetooth on my phone (when connecting to my car and my bluetooth speaker), I have to pair the device at the Android OS.

I am curious, from a high level, what are the differences between pairing a device vs connecting to a device. In addition, more specifically, what is the difference between pairing a device within the OS, vs scanning and connecting to the device from an app?

Solution 1

At a high level, you will always use "connect" to connect to a device, but you may have to "pair" the devices first. Bluetooth pairing is a security procedure. A one-off provisioning step that equips the two devices in a pairing with a series of shared security keys which allow communication to be encrypted.

A Bluetooth Low Energy device can have three levels of security, the lowest of which pairing is not required, and then two levels that require pairing.

A device opting to use No Pairing provides the greatest simplicity but obviously, no security. Communication is not encrypted and any other device can connect.

The two pairing method that can be used provide the same level of security when connected. However, during the pairing procedure itself, one of the two methods is more secure than the other. Passkey Pairing is the most secure of the two procedures and requires a 6 digit number to be entered. This offers protection against machine-in-the-middle (MITM) attacks. Just Works Pairing is not as secure but it does not require you to enter anything and therefore is very simple to use.

Once a pairing is established, then connection can happen without the need to establish pairing every time.

More detailed explanation of the pairing options are available at: https://www.bluetooth.com/blog/bluetooth-pairing-part-1-pairing-feature-exchange/

Solution 2

According to the Bluetooth Core Specification Version 5.2 | Vol. 1, Part A, Chapter 5.1 pairing is defined as

the process for creating one or more shared secret keys

The keys themselves are not shared but established using a procedure called Diffie-Hellman key exchange. This means that pairing is only necessary if a connection is encrypted. If you connect to a device that requires security measures on one of its characteristics Android will prompt the user of your app with a pairing request automatically.

Another term you might have heard is bonding, which is defined as:

the act of storing the keys created during pairing for use in subsequent connections in order to form a trusted device pair

Bonding allows a reconnection of your devices without another pairing process since the keys have been established before.

When using Bluetooth Low Energy (BLE) pairing a manually Device within the OS is not needed. You can always scan for a device that advertises its presence. As I said before: Pairing is handled by the OS automatically if needed.

Comments

[Michael Kotzjan]

Don't forget the pairing methods Out of Band (OOB) and Numeric Comparison