Link Key / Long-Term Key (LTK)
Definition
The cryptographic secret negotiated during Bluetooth pairing that is stored on both devices and used to authenticate and encrypt subsequent connections. In classic Bluetooth this is called the link key; in BLE it is the Long-Term Key. Its presence in a pairing database confirms that a pairing occurred.
- Classic Bluetooth term
- Link key
- BLE term
- Long-Term Key (LTK)
- Function
- Authenticate and encrypt post-pairing connections
- Evidentiary value
- Presence confirms a pairing occurred
Common questions
Why does finding a link key or LTK on a device matter forensically?+
Its presence in a device's pairing database is strong evidence that a specific pairing event took place at some point, even if the two devices are not currently connected, helping establish a device to device association.
Can an examiner decrypt captured Bluetooth traffic without the link key or LTK?+
Generally no. Without the negotiated key, encrypted traffic between the paired devices cannot be read, which is why recovering the key from device storage is often central to a Bluetooth forensic examination.
Related terms
- BD_ADDR (Bluetooth Device Address)
- The 48-bit hardware address assigned to each classic Bluetooth device by its manufacturer. Analogous to a MAC address on Ethernet. Unlike BLE...
- GATT (Generic Attribute Profile)
- The protocol framework used by BLE for data exchange. A GATT server exposes data as Services and Characteristics; a GATT client reads...
- Resolvable Private Address (RPA)
- A BLE address type that rotates on a timer (typically every 15 minutes) but can be resolved back to the device's true...
- RFCOMM
- Radio Frequency Communication, the Bluetooth protocol that emulates a serial RS-232 connection over an L2CAP channel. Used by profiles including Serial Port...
- Ubertooth One
- An open-source USB Bluetooth sniffing platform developed by Michael Ossmann that can capture raw Bluetooth BR/EDR and BLE frames from the air....