Bluetooth SIG introduces new privacy feature in Bluetooth 6.1 core update

The Bluetooth Special Interest Group (SIG) has announced the new Bluetooth Core Specification 6.1, including a new way to protect user privacy.

A new feature in Bluetooth 6.1 that is promoted by Bluetooth SIG is called Resolvable Private Addresses, or RPA for short.

A Resolveable Private Address is a Bluetooth address that replaces a device’s fixed MAC address to protect user privacy. In a nutshell, it allows trusted devices to reconnect securely without ever revealing their true identity.

As of writing, Resolvable Private Addresses are updated at fixed intervals. This introduces a level of predictability, allowing threat actors to exploit this vulnerability to enable long-term tracking.

Instead of every 15 minutes, Bluetooth 6.1 randomizes RPA updates between 8 and 15 minutes, making it less predictable and harder for hackers to track a user’s location for long periods. At the same time, values can range from one second up to one hour.

“Randomizing the timing of address changes makes it much more difficult for third parties to track or correlate device activity over time,” the Bluetooth SIG’s statement reads.

More details about how the RPA feature works can be found in the Bluetooth Core 6.1 specification document.

Another feature that is highlighted by the Bluetooth SIG is better power efficiency. This is because the Bluetooth chip or Controller will choose the randomized timing intervals and generate and update the RPA internally without waking the host device, thus saving CPU cycles and memory operations.

Instead of releasing a new core update every year, the Bluetooth SIG has moved to a bi-annual release schedule. Alain Michaud, Chair of the Bluetooth SIG Board of Directors, calls it a “pivotal step forward for the entire Bluetooth technology ecosystem.”

“This new cadence will ensure that incremental improvements and features can reach developers and manufacturers faster, fueling innovation and helping them meet the evolving needs of the market with greater agility,” he states.

When the first devices equipped with Bluetooth 6.1 technology are expected remains unclear.