Re [PATCH] Bluetooth: Fix the vulnerable issue on enc key size

2020-09-27 Thread 陆朱伟
Hi Marcel, > On September 27, 2020 20:05, Marcel Holtmann wrote: > > Hi Alex, > > > When someone attacks the service provider, it creates connection, > > authenticates. Then it requests key size of one byte and it identifies > > the key with brute force methods. > > > >

Re: [PATCH] Bluetooth: Fix the vulnerable issue on enc key size

2020-09-27 Thread Marcel Holtmann
Hi Alex, > When someone attacks the service provider, it creates connection, > authenticates. Then it requests key size of one byte and it identifies > the key with brute force methods. > > After l2cap info req/resp exchange is complete. the attacker sends l2cap > connect

Re: [PATCH] Bluetooth: Fix the vulnerable issue on enc key size

2020-09-26 Thread 陆朱伟
Hi Marcel, > On 26 September 2020 at 1:34, Marcel Holtmann wrote: > > Hi Alex, > > >>> When someone attacks the service provider, it creates connection, > >>> authenticates. Then it requests key size of one byte and it identifies > >>> the key with brute force methods. > >>> > >>> After l2cap

Re: [PATCH] Bluetooth: Fix the vulnerable issue on enc key size

2020-09-25 Thread Marcel Holtmann
Hi Alex, >>> When someone attacks the service provider, it creates connection, >>> authenticates. Then it requests key size of one byte and it identifies >>> the key with brute force methods. >>> >>> After l2cap info req/resp exchange is complete. the attacker sends l2cap >>> connect with

Re: [PATCH] Bluetooth: Fix the vulnerable issue on enc key size

2020-09-21 Thread 陆朱伟
Hi Marcel, > On September 20, 2020 14:10, Marcel Holtmann wrote: > > Hi Alex, > > > When someone attacks the service provider, it creates connection, > > authenticates. Then it requests key size of one byte and it identifies > > the key with brute force methods. > > > > After l2cap info

Re: [PATCH] Bluetooth: Fix the vulnerable issue on enc key size

2020-09-20 Thread Marcel Holtmann
Hi Alex, > When someone attacks the service provider, it creates connection, > authenticates. Then it requests key size of one byte and it identifies > the key with brute force methods. > > After l2cap info req/resp exchange is complete. the attacker sends l2cap > connect with specific PSM. > >

[PATCH] Bluetooth: Fix the vulnerable issue on enc key size

2020-09-18 Thread Alex Lu
When someone attacks the service provider, it creates connection, authenticates. Then it requests key size of one byte and it identifies the key with brute force methods. After l2cap info req/resp exchange is complete. the attacker sends l2cap connect with specific PSM. In above procedure, there