L3 requirements for Bluetooth and Wifi aren't high enough about iot-security-verification-standard-isvs HOT 2 OPEN

Notes (will tidy up).

WPA2:

• Use Management Frame Protection
• KRACK, October 2017
• Kr00k, August 2019

WPA3:

• Dragonblood, April 2019

Bluetooth 4.2 (December 2014) and up offer four pairing models, depending on HW capability:
https://www.bluetooth.com/blog/bluetooth-pairing-part-1-pairing-feature-exchange/

1. Just works.
   • Vulnerable to MITM.
2. Numeric comparison. Both devices must have screens and input mechanisms. The user compares the 6 digit PIN displayed by both devices and confirms it's the same using an input mechanism.
3. Passkey Entry.
   • Uses a 6 digit PIN that can be cracked.
4. Out Of Band (OOB).

Bluetooth vulnerabilities:

• BlueBorne, April 2017
• Fixed Coordinate Invalid Curve Attack, July 2018
• Key Negotiation of Bluetooth Attack, August 2019
  • https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/statement-key-negotiation-of-bluetooth/

from iot-security-verification-standard-isvs.

Our goal is cover common IoT Wi-Fi and BT implementations. Usually devices will act as an AP to onboard onto a network, act as a gateway to sensor devices communicating to the internet via BT/ZigBee, or requiring BT pairing in combination with Wi-Fi for management functionality.

Not sure if we should add specifics around LTK or LK based on BLURtooth but it may not be prevalent in IoT since this is specific to dual mode devices.

WPA3 support is not widely used in IoT AFAIK. Could be too early to add requirements until industry adoption. Interested in hearing benefits and use cases.

Looking forward to your additions.

from iot-security-verification-standard-isvs.