In my previous blog on Key Generation Methods, I talked about Key Generation Methods—if the initiating and responding device meet some IO capability conditions, they choose LE legacy Bluetooth pairing Passkey Entry method.

In this blog, I look at legacy pairing with Passkey Entry and how it works.

Figure 1: LE Legacy Pairing, Passkey Entry

Temporary Key (TK) and Random Number Generation

When you use LE legacy pairing, the pairing is performed by each device generating a Temporary Key (TK).

  • If the IO capabilities of a device, either the initiating or responding device, has a display capability, then it will display a randomly generated passkey value between “000000” and “999999.” The other device should have an input capability like a keyboard so a user can input the value displayed for the TK
  • If the IO capabilities of both the initiating and responding devices don’t have display capabilities but are both “Keyboard Only,” the user needs to guarantee that the TKs between the initiating and responding device are the same. This is a special case for Passkey Entry.

Below is a device named “Authentication” that wants to pair with an iOS device, and it displays TK on its output interface. The iOS device then pops up a dialog box and asks the user to input the TK value.

Picture 2: Passkey Entry on iOS Device

When the TK value is ready, the initiating and responding device generate a 128-bit random number: Mrand for the initiating device, Srand for the responding device.

Mconfirm and Sconfirm

Mconfirm and Sconfirm is 128-bit confirm value which can be calculated using the confirm value generation function c1. The detail for this function can be found here: Bluetooth Core Spec V4.2, Vol.3, Part H, Section 2.2.3.

For c1 function, the input parameters include:

  • TK
  • Mrand for Mconfirm; or Srand for Sconfirm calculation
  • Pairing Request command
  • Pairing Response command
  • Initiating device address type
  • Initiating device address
  • Responding device address type
  • Responding device address


When Mconfirm and Sconfirm are ready, the initiating device transmits Mconfirm to the responding device. When the responding device receives Mconfirm it transmits Sconfirm to the initiating device. When the initiating device receives Sconfirm it transmits Mrand to the responding device.

The responding device verifies the Mconfirm value by repeating the calculation the initiating device performed using the Mrand value received.

  • If the responding device’s calculated Mconfirm value does not match the received Mconfirm value from the initiating device then the pairing process will be aborted and the responding device will send the Pairing Failed command with reason code “Confirm Value Failed.”
  • If the responding device’s calculated Mconfirm value matches the received Mconfirm value from the initiating device, the responding device transmits Srand to the initiating device.

The initiating device verifies the received Sconfirm value by repeating the calculation the responding device performed using the Srand value received.

  • If the initiating devices calculated Sconfirm value does not match the received Sconfirm value from the responding device then the pairing process will be aborted and the initiating device will send the Pairing Failed command with the reason code “Confirm Value Failed.”
  • If the initiating device’s calculated Sconfirm value matches the received Sconfirm value from the responding device the initiating device then calculates Short Term Key (STK) and tells the Controller to enable encryption.

STK Generation

You generate the STK using the key generation function s1 detailed in the Bluetooth Core Spec V4.2, Vol.3, Part H, Section 2.2.4.

For s1 function, the input parameters include:

  • TK
  • Srand
  • Mrand

The paired devices establish an encrypted link with STK.

In Part 4, I introduce a new pairing algorithm in LE Secure Connection: Numeric Comparison.


Bluetooth 5: Go Faster, Go Further

Download this comprehensive overview to discover how Bluetooth 5 significantly increases the range, speed, and broadcast messaging capacity of Bluetooth applications, making use cases in smart home automation, enterprise, and industrial markets a reality.


Updates to the Bluetooth Internet Gateway Study Guide

According to the ABI report Installed Base of IoT Devices by Connectivity Technology, published…

In Case You Missed It: What’s New With Blue This Summer

The Bluetooth® developer community is always pushing the technology forward, and this summer has…

New Core Specification v5.3 Feature Enhancements

One of the key reasons why Bluetooth® technology has emerged as the global wireless…

Bluetooth® Core Specification Version 5.3 Feature Enhancements

Bluetooth® Core Specification version 5.3 includes several feature enhancements with the potential to improve…

Connect: Car Access Demo

In this demo, Texas Instruments will discuss and demonstrate Bluetooth 5.1 and its cutting…

Wireless Connectivity Options for IoT Applications - Commercial Lighting

Industry 4.0 is no longer a thing of the future. The term describes the…

4 Essential Tools for Every Bluetooth Low Energy Developer

One of the biggest challenges of learning any new technology is knowing which tools…

Is Remote IOP Testing Here To Stay?

Like many organizations around the world, the Bluetooth Special Interest Group (SIG) has made…

Bluetooth 5.2新機能のポイントを10分で解説!(日本語字幕)

この動画では2020年1月に発表されたBluetoothバージョン5.2新機能の概要を中心に話します。Enhanced Attributeプロトコル(EATT)、LE Power Control (LEPC)、Isochronous (アイソクロナス)チャネルなど、これらの各機能について詳しく説明します。最後に、アイソクロナスチャネルを利用した「LE Audio」と呼ばれる次世代のBluetoothオーディオについて日本語翻訳付きで解説します。

Designing and Developing Bluetooth® Internet Gateways

Learn about Bluetooth internet gateways, how to make them secure and scalable, and design and implement your own working prototype gateway and web application for use with either Bluetooth LE Peripherals or with Bluetooth mesh networks.

An Introduction to Bluetooth Low Energy for Swift Developers

All smartphones support Bluetooth® Low Energy (LE) and it is used in all manner…

Building a Sensor-Driven Lighting Control System Based on Bluetooth® Mesh

A technical examination of which Bluetooth mesh models to use in different types of…

How Bluetooth Low Energy Works: 21 Interesting Facts

Whether you’re a beginner or an expert in Bluetooth Low Energy development, it’s always…

Advanced Bluetooth for Android Developers

Android developers can take this guided tour of the most recent features and interesting…

How to Deploy BlueZ on a Raspberry Pi Board as a Bluetooth Mesh Provisioner

This step-by-step study guide will teach you: How to rebuild the kernel on a…

The Bluetooth LE Security Study Guide

Learn about fundamental security concepts, the security features of Bluetooth Low Energy, and gain some hands-on experience using those features in device code.

How Bluetooth 5 Increases the Achievable Range of a Bluetooth Low Energy Connection

Texas Instruments offers their theory on how to achieve long range with a Bluetooth…

Testing Long Range (Coded PHY) with Nordic Solution (It Simply Works)

There has been a lot of discussion and confusion about testing the long range…

 Get Help