Resolvable Private Address (RPA)
Definition
A BLE address type that rotates on a timer (typically every 15 minutes) but can be resolved back to the device's true Identity Address by any device holding the matching Identity Resolving Key (IRK). An examiner who has the IRK from a paired device can link multiple observed RPAs to one physical device.
- Layer
- Bluetooth Low Energy link layer
- Rotation interval
- Typically every 15 minutes
- Resolved with
- Identity Resolving Key (IRK)
- Purpose
- Prevents passive tracking of a BLE device
Common questions
Where does an examiner obtain the IRK needed to resolve an RPA?+
The IRK is exchanged during BLE pairing and stored on both bonded devices, typically in a keystore or Bluetooth stack database on the phone or wearable. Extracting it usually requires a full filesystem or physical acquisition of one of the paired devices.
Can an RPA be linked to a device without the IRK?+
Not reliably. Without the IRK the address looks random and unrelated to prior sightings, so an examiner can only note that some nearby BLE device was active, not which one. Correlating RPAs without the key relies on timing and signal patterns, which is far weaker than cryptographic resolution.
Does every BLE device use resolvable private addresses?+
No, some devices use non-resolvable private addresses or fixed static addresses instead, depending on manufacturer implementation and privacy settings, so an examiner must check the address type before assuming resolution is possible.
Related terms
- BD_ADDR (Bluetooth Device Address)
- The 48-bit hardware address assigned to each classic Bluetooth device by its manufacturer. Analogous to a MAC address on Ethernet. Unlike BLE...
- GATT (Generic Attribute Profile)
- The protocol framework used by BLE for data exchange. A GATT server exposes data as Services and Characteristics; a GATT client reads...
- Link Key / Long-Term Key (LTK)
- The cryptographic secret negotiated during Bluetooth pairing that is stored on both devices and used to authenticate and encrypt subsequent connections. In...
- RFCOMM
- Radio Frequency Communication, the Bluetooth protocol that emulates a serial RS-232 connection over an L2CAP channel. Used by profiles including Serial Port...
- Ubertooth One
- An open-source USB Bluetooth sniffing platform developed by Michael Ossmann that can capture raw Bluetooth BR/EDR and BLE frames from the air....