Bluetooth PIN Pairing in Windows Mobile 6.5

Windows Mobile 6.5 relied on legacy Bluetooth mechanisms to establish secure connections with accessories, computers, and other mobile devices. Under this system, pairing required exchanging a shared secret numeric PIN (Personal Identification Number) between both devices to generate a mutually trusted link key. This guide outlines the step-by-step workflow of PIN-based pairing in the Windows Mobile 6.5 operating system, the underlying security verification process, and how service profiles were negotiated once pairing succeeded.

The Pairing Workflow

To connect a Bluetooth peripheral or phone, the user initiated the pairing sequence through the Windows Mobile interface:

  1. Enable Bluetooth: The user turned on the Bluetooth radio, typically via the Comm Manager or by navigating to Start > Settings > Connections > Bluetooth.
  2. Device Discovery: In the Bluetooth settings, switching to the Devices tab and tapping Add new device... triggered a Bluetooth inquiry scan. Windows Mobile searched for local devices broadcasting their discoverability.
  3. Device Selection: Once the list populated, the user selected the desired device and tapped Next.
  4. PIN Prompt: Windows Mobile displayed a text box asking for a passcode.
    • For fixed-PIN peripherals (such as hands-free headsets or GPS receivers), the user typed the vendor's hardcoded default PIN (most commonly 0000 or 1234).
    • For peer-to-peer connections (such as connecting to another smartphone or a PC), the user created any arbitrary numeric passcode.
  5. Secondary Verification: Tapping Next prompted the secondary device to acknowledge the request and enter the identical PIN. If pairing with a fixed-code peripheral, the peripheral automatically matched the code transmitted in the authentication request.

Beneath the user interface, Windows Mobile 6.5 implemented the Bluetooth 2.0/2.1 Legacy Pairing specification. When the user entered the PIN, the operating system's Bluetooth stack handled authentication via the following cryptographic steps:

  • Initialization Key Generation: Windows Mobile combined the entered PIN, the Bluetooth Device Address (BD_ADDR) of the target device, and a random number (IN_RAND) using the E22 cryptographic algorithm to produce a temporary initialization key (\(K_{init}\)).
  • Link Key Derivation: Using \(K_{init}\), both devices exchanged random challenges to derive a shared 128-bit link key (\(K_{ab}\)) via the E21 algorithm.
  • Mutual Authentication: Both devices performed challenge-response verification using the E1 algorithm to confirm that each held the same link key without transmitting the key or the PIN across the air.
  • Storage in Registry: Once verified, Windows Mobile stored the 128-bit link key in the system registry under [HKEY_LOCAL_MACHINE\Comm\Security\Bluetooth\Keys]. This cached key allowed subsequent reconnections to occur automatically without prompting the user for the PIN again.

Service Configuration

Immediately following link key generation, Windows Mobile 6.5 scanned the remote device's Service Discovery Protocol (SDP) records. A final screen presented checkboxes for the available services supported by the paired device, such as Hands-Free, Wireless Stereo (A2DP), Serial Port (SPP), or ActiveSync over Bluetooth. Selecting the required services and tapping Done completed the pairing process, making the device ready for use.