PaperlayerView exact revision on arXiv

Source-linked AI summary

Plug-and-Play Quantum-Resistant BLE Pairing for Medical Implants via NFC Out-of-Band

Muhammad Asim Javaid, Muhammad Shafay Tanveer Hassan, Faaiz Umer, Sotirios Panagiotou, Christos Strydis, Naveed Anwar Bhatti, Muhammad Adeel Pasha, Muhammad Ali Siddiqi

arXiv:2610.07870v1cs.CR

TL;DR

IMDs lack the interfaces required by common MITM-resistant BLE pairing methods, while NFC OOB pairing faces channel risks and classical key exchange remains quantum-vulnerable. The paper performs a post-quantum KEM entirely over NFC without changing the BLE stack. On an IMD-class testbed, projected battery-life reduction is below 0.57% for Kyber-1024 and 0.56% for FireSABER under operational usage assumptions.

  • Problem

    IMDs typically lack the user interfaces required for Numeric Comparison or Passkey Entry, while NFC OOB schemes face eavesdropping and active injection risks and classical BLE key establishment is quantum-vulnerable.

    Source: §I · p. 1

  • Method

    The protocol performs a post-quantum KEM entirely over NFC for OOB pairing while leaving the BLE stack unmodified.

    Source: §I · pp. 1–2

  • Results

    Projected battery-life reduction is below 0.57% for Kyber-1024 and 0.56% for FireSABER under operational usage assumptions on an IMD-class testbed.

    Source: §VIII · p. 6

  • Takeaways & Limitations

    The testbed results demonstrate feasible post-quantum OOB pairing on resource-constrained IMD-class devices without BLE stack modifications.

    Source: §I · p. 2, §VIII · p. 6

    The 11.4–20.7 s exchange duration is suited to infrequent, supervised medical procedures.

    Source: §VII · p. 5

Abstract

from arXiv · show

Bluetooth Low Energy (BLE) pairing establishes the cryptographic foundation for secure device communication. However, mainstream man-in-the-middle (MITM)-resistant pairing methods, such as Numeric Comparison and Passkey Entry, require user interfaces that implantable medical devices (IMDs) inherently lack, making Near-Field Communication (NFC)-assisted Out-of-Band (OOB) pairing an attractive alternative. Existing NFC-assisted OOB schemes authenticate a classical BLE key exchange that remains vulnerable to quantum attacks, while the NFC channel itself is susceptible to eavesdropping and active injection under stronger threat models. To address these limitations, we propose a lightweight, plug-and-play NFC-based OOB pairing protocol that performs a post-quantum key encapsulation mechanism (KEM) entirely over the NFC channel, ensuring that no shared secret is transmitted over NFC while reducing long-range radio-frequency (RF) exposure during pairing. The proposed protocol requires no modifications to the BLE stack and inherently resists RF battery-depletion attacks. Evaluation on an IMD-class proof-of-concept testbed demonstrates that post-quantum OOB pairing is practical on resource-constrained devices, reducing projected battery life by less than 0.57\% for Kyber-1024 and 0.56\% for FireSABER under an operational usage model relative to the MITM-vulnerable Just Works method.

I. INTRODUCTION

IMDs lack the interfaces needed for user-mediated BLE pairing, while certificate-based public-key exchange is impractical for devices without Internet connectivity. The paper proposes a post-quantum NFC OOB protocol and evaluates its security and feasibility on an IMD-class testbed.

I. INTRODUCTION

  • IMDs typically lack the screens or keypads required for Numeric Comparison or Passkey Entry, and certificate-based public-key exchange is impractical without Internet connectivity.These constraints make both approaches infeasible in practice for many IMDs.Source: §I · p. 1
  • NFC OOB pairing avoids a device-interface requirement, but NFC can face eavesdropping or active injection, and BLE’s classical elliptic-curve key establishment remains vulnerable to quantum adversaries.The security of OOB pairing depends on both the auxiliary channel and the underlying key-establishment mechanism.Source: §I · p. 1
  • The proposed protocol performs a post-quantum KEM entirely over NFC, strengthening the OOB exchange against passive eavesdropping and active MITM under the stated NFC threat model.It also reduces long-range RF exposure during pairing.Source: §I · pp. 1–2
  • The design requires no BLE stack or Bluetooth Core Specification modifications, and its application-layer OOB exchange supports plug-and-play compatibility with existing BLE stacks.The authors implement it on a real-world testbed and evaluate Kyber and SABER for execution time, energy consumption, and battery lifetime.Source: §I · p. 2

II. BACKGROUND

BLE association models determine how devices establish shared keying material, with their security depending partly on device I/O capabilities. OOB pairing is suitable for devices without user interfaces, but its security depends on the auxiliary channel.

A. BLE Association Models

  • Just Works establishes a shared key without user verification and offers no active MITM protection, making it unsuitable for safety-critical IMDs.It is the default fallback for endpoints without displays or keypads.Source: A. BLE Association Models · p. 2
  • Passkey Entry and Numeric Comparison provide strong MITM resistance through user verification, but their display and input requirements make them impractical for IMDs.Passkey Entry requires a display on one device and input on the other; Numeric Comparison requires displays on both.Source: A. BLE Association Models · p. 2
  • OOB pairing exchanges authentication data over a secondary channel such as NFC, eliminating the need for displays or keypads while making security dependent on that channel’s trustworthiness.Source: A. BLE Association Models · p. 2

B. The Need for Post-Quantum Cryptography

Post-quantum cryptography addresses the prospective quantum vulnerability of widely deployed public-key schemes, while its computational and memory costs challenge constrained platforms. Prior BLE and OOB approaches leave gaps that the paper’s quantum-resistant, unmodified-stack OOB design targets.

B. The Need for Post-Quantum Cryptography

  • Quantum algorithms such as Shor’s could render RSA, Diffie-Hellman, and BLE’s elliptic-curve cryptography insecure, while PQC’s computational and memory overhead challenges constrained IoT and IMD platforms.Lattice-based KEMs are presented as comparatively efficient for establishing shared secrets from which symmetric keys are derived; the paper studies Kyber and SABER.Source: B. The Need for Post-Quantum… · p. 2

C. Related Work

  • Liu et al. map KYBER-512 operations onto GATT, but sensitive exchanges still traverse long-range RF and the design requires both endpoints to support a 404-byte negotiated MTU.Source: C. Related Work · p. 2
  • NFC is a practical OOB option for IMDs, yet prior studies report passive eavesdropping beyond nominal range and active injection with specialized hardware,.The paper claims its approach is the first quantum-resistant OOB pairing mechanism that leaves the BLE stack unmodified, with protection against passive eavesdropping, active MITM under its stated NFC threat model, and RF battery DoS.Source: C. Related Work · p. 3

III. SYSTEM AND THREAT MODELS

The system uses an IMD and a resource-rich programmer, with NFC bootstrapping cryptographic material and BLE carrying ongoing encrypted data. Its adversary model includes a probabilistic polynomial-time algorithm interacting over both channels.

A. System Overview

  • The IMD is the resource-constrained endpoint, while a smartphone or tablet programmer uses NFC to bootstrap cryptographic material before BLE carries ongoing encrypted data.Source: A. System Overview · p. 3

B. Threat Model

  • The threat model represents the adversary as a probabilistic polynomial-time algorithm interacting with honest participants over both BLE and NFC.Source: B. Threat Model · p. 3

1) Channel Model:

The model gives an adversary full control of Bluetooth transmissions, while NFC is proximity-constrained. Remote active NFC attacks are excluded; an in-range adversary is assumed limited to passive eavesdropping.

1) Channel Model:

  • Bluetooth follows the Dolev–Yao model, allowing eavesdropping, blocking, delay, replay, reordering, arbitrary message injection, and concurrent sessions.Source: 1) Channel Model · p. 3
  • NFC requires close-range interaction; passive eavesdropping may reach approximately 10 m under favorable conditions, while active injection and relay are generally limited to below approximately 0.5 m in laboratory conditions.Source: 1) Channel Model · p. 3
  • The model treats active NFC injection, replay, and relay as infeasible against remote adversaries, limiting in-range adversaries to passive eavesdropping.Source: 1) Channel Model · p. 3

2) Cryptographic Assumptions:

The security arguments assume standard security for the employed cryptographic primitives and IND-CCA security for the lattice-based KEM. Under the stated NFC channel model, they conclude that textbook NFC-KEM MITM and remote RF battery DoS attacks are infeasible.

2) Cryptographic Assumptions:

  • The analysis assumes standard security for the hash functions, MACs, authenticated encryption, and key-derivation functions, fresh keying material per NFC exchange, and IND-CCA security of the lattice-based KEM.Source: 2) Cryptographic Assumptions · p. 3

3) Security Arguments:

  • A textbook MITM on the NFC-based post-quantum KEM is infeasible under the stated channel models and cryptographic assumptions.Public-key substitution is excluded by the NFC model, and IND-CCA security prevents passive observation from revealing the derived shared secret.Source: 3) Security Arguments · p. 3
  • A remote PPT adversary without close physical proximity cannot induce unbounded IMD energy consumption through BLE under the stated channel models.Protocol initiation requires NFC interaction, and BLE remains disabled until successful NFC interaction; within NFC range, the adversary is limited to passive eavesdropping.Source: 3) Security Arguments · p. 3

IV. PROPOSED PROTOCOL

The protocol performs post-quantum key encapsulation over NFC, then uses the resulting shared secret to secure BLE communication without changing the BLE stack. Public-key transfer from programmer to IMD uses NFC fragmentation and stop-and-wait acknowledgments.

IV. PROPOSED PROTOCOL

  • The proposed secure BLE protocol performs the entire post-quantum key encapsulation over NFC while leaving the BLE stack and SMP unchanged.This avoids sending public-key exchange material over long-range BLE and avoids dependence on larger negotiated BLE MTUs.Source: Figure 2 · p. 4, §IV · p. 4

A. Public Key Transfer (Programmer →IMD)

  • The programmer selects the NFC application, generates the KEM key pair, and sends the public key to the IMD, which performs one encapsulation operation.Key generation and decapsulation remain with the programmer, avoiding certificate overhead under the stated MITM assumptions.Source: A. Public Key Transfer (Programmer →IMD) · p. 4
  • Because PQC public keys exceed NFC payload limits, the programmer fragments them and sends one fragment at a time, awaiting acknowledgment before continuing.Stop-and-wait transmission supports reconstruction without exceeding limited IMD memory while preventing loss, duplication, or reordering.Source: A. Public Key Transfer (Programmer →IMD) · p. 4

B. Ciphertext Transfer (IMD →Programmer)

After receiving the public key, the IMD encapsulates a shared secret and returns the ciphertext over NFC. The endpoints derive a symmetric key from that secret to protect application data sent over BLE.

B. Ciphertext Transfer (IMD →Programmer)

  • The IMD encapsulates a shared secret with the programmer’s public key and returns the resulting ciphertext over NFC, fragmenting it when needed.The programmer reassembles the ciphertext and decapsulates it with the private key to recover the shared secret.Source: B. Ciphertext Transfer (IMD →Programmer) · p. 4

C. Key Derivation and Secure Communication

  • Both endpoints derive a symmetric key from the shared secret and use authenticated encryption for application data sent over BLE.NFC carries the KEM public key and ciphertext, not the symmetric key; BLE remains disabled until the NFC exchange completes.Source: C. Key Derivation and Secure… · p. 4

V. IMPLEMENTATION

The implementation pairs an ESP32-S3-based IMD with a smartphone programmer over NFC and BLE, using separate embedded and mobile software components.

A. Hardware Setup

  • The IMD uses an ESP32-S3 connected to an NXP PN532 NFC transceiver, with the setup measuring current during NFC key exchange and BLE transmission.The ESP32-S3 provides BLE connectivity and processing for post-quantum operations; the PN532 is a commodity NFC frontend.Source: A. Hardware Setup · pp. 4–5, Figure 3 · p. 5
  • A Samsung Galaxy A54 running Android 14 acts as the NFC initiator and BLE central in the experimental setup.The programmer application uses Flutter with native Kotlin modules to access Android NFC and BLE APIs; the IMD uses Bluedroid and post-quantum cryptography libraries.Source: A. Hardware Setup · p. 5, B. Software Setup · p. 5

B. Software Setup

  • The IMD software uses Bluedroid and cryptographic libraries, while the Flutter programmer app accesses Android NFC and BLE APIs through Kotlin modules.The implementations use liboqs for Kyber and the COSIC reference implementation for SABER.Source: B. Software Setup · p. 5

C. Packet Fragmentation and Reassembly

The implementation fragments post-quantum messages for NFC transfer; measurements show exchange time is dominated by transfer overhead, while projected battery impact remains small under monthly re-pairing.

C. Packet Fragmentation and Reassembly

  • Each message fragment has a fixed 34-byte header and carries up to 200 data bytes, producing fragments of at most 234 bytes that fit within a 255-byte short-APDU data field.The header records message type, total length, byte offset, fragment length, and session ID.Source: C. Packet Fragmentation and Reassembly · p. 5

B. Energy Consumption and Autonomy

  • Less than 0.57% for Kyber-1024 and 0.56% for FireSABER: projected battery-life reductions versus Just Works under one monthly re-pairing event.The model assumes a 1.5 Ah, 3.3 V battery, one daily 60-second BLE session, and a symmetric key retained across daily sessions.Source: Figure 4 · p. 5, B. Energy Consumption and Autonomy · p. 5

A. Execution Time and Memory Footprint

  • NFC-OOB session durations range from 11.4–20.7 s for Kyber and 11.8–20.3 s for SABER; KEM encapsulation takes 10.0–47.2 ms, under 0.25% of session duration.Larger public keys and ciphertexts require more NFC fragments, so transfer and fragmentation overhead dominate KEM computation.Source: Figure 4 · p. 5, A. Execution Time and Memory Footprint · p. 5
  • Firmware images are 0.93–0.96 MB and reported DRAM usage remains below 45%, within the stated resource limits of IMD-class microcontrollers.Source: A. Execution Time and Memory Footprint · p. 5

VII. DISCUSSION

The discussion reports practical post-quantum pairing on an IMD-class testbed without BLE-stack changes, with NFC transport—not KEM computation—identified as the main latency target. The conclusion reports low projected battery impact under operational assumptions.

VII. DISCUSSION

  • The 11.4–20.7 s exchange is suited to infrequent, supervised procedures; NFC transfer dominates latency, so larger payloads, higher bit rates, or fewer acknowledgments are the primary optimization options.Hardware acceleration is described as a smaller, complementary improvement.Source: §VII · p. 5
  • The security argument assumes close physical access provides a basis for trust and that NFC adversaries cannot synthesize compliant messages or modify frames in real time.Keeping BLE disabled until NFC initiation is described as limiting remote RF-based battery DoS exposure.Source: §VII · p. 6

VIII. CONCLUSION

  • Projected battery-life reduction is below 0.57% for Kyber-1024 and 0.56% for FireSABER under operational usage assumptions, while testbed results show feasible execution time, memory, and energy use.Source: §VIII · p. 6
Loading 2610.07870v1…