title: Implementing Bluetooth LE Security
body: <p>We are working on a project of developing the soft and hardware for a bluetooth LE device.</p>
  
  <p>We implemented GATT services and we are able to connect to the device.</p>
  
  <p>Now the next step: Implement security.</p>
  
  <p>We know that there are tree methods of security:</p>
  
  <p>Just Works</p>
  
  <p>Passkey Entry</p>
  
  <p>Out Of Band</p>
  
  <p>Since our device doesn't have a display (no_input, no_output), we are doomed to use Just Works since OOB is not supported by Android and iOS yet.</p>
  
  <p>So this means we have this bluetooth device with all it's services just hanging there in the open to connect by anybody.</p>
  
  <p>Is this really true in BLE? </p>
  
  <p>We were thinking about implementing our own security just by connecting, writing a key to a keyservice and when that key is correct, the services open themselves for writing/reading. But what would that do with certification?</p>
  
  <p>So you guys are our last resort since we are still hoping we are wrong in this one. Is there anybody who can acknowledge this fact? Or are we missing a big piece of the puzzle?</p>