Wireless Attacksblebluetoothencryptioncrackingltktkstk

crackle

crackle cracks and decrypts Bluetooth Low Energy (BLE) encryption by exploiting a flaw in the pairing process to guess or brute force the Temporary Key (TK). It recovers the Short Term Key (STK) and Long Term Key (LTK) to decrypt communications between BLE master and slave devices.

Description

crackle is a tool for cracking BLE encryption, also known as Bluetooth Smart. It targets a vulnerability in the BLE pairing process, allowing attackers to guess or rapidly brute-force the TK. Using the TK and pairing data, it derives the STK and LTK, enabling full decryption of encrypted traffic.

Use cases include analyzing BLE communications for security research, reverse engineering IoT devices, or auditing BLE implementations. The tool processes PCAP captures containing pairing conversations or encryption handshakes.

It supports two major modes: cracking the TK from complete pairing data, or decrypting traffic using a known LTK. LTK exchanges in captures are dumped to stdout during cracking.

How It Works

crackle exploits a BLE pairing flaw to guess or brute-force the TK from complete pairing conversations in PCAP files. With the TK and pairing data, it computes the STK and LTK. For LTK mode, it uses a provided LTK (hex string, MSB to LSB) with LL_ENC_REQ and LL_ENC_RSP packets containing SKD and IV to decrypt traffic. It processes packets sequentially, skipping unencrypted or invalid ones, and outputs decrypted PCAP if specified.

Installation

bash
sudo apt install crackle

Flags

-i <input.pcap>Input PCAP file containing pairing conversation or encryption packets
-o <output.pcap>Write decrypted output PCAP to disk
-l <ltk>Decrypt with provided LTK (hex string, no separator, MSB to LSB, e.g. 81b06facd90fe7a6e9bbd9cee59736a7)
-vBe verbose
-tRun tests against crypto engine
-hShow usage help

Examples

Read input PCAP, decrypt using discovered LTK, write output to ltk-decrypted.pcap; processes 712 packets, decrypts 3
crackle -i ltk_exchange.pcap -o ltk-decrypted.pcap
Crack TK from complete pairing conversation in PCAP and decrypt to output file
crackle -i pairing.pcap -o decrypted.pcap
Crack TK from pairing PCAP; dumps LTK to stdout if exchange present
crackle -i capture.pcap
Decrypt PCAP using specified LTK, requires LL_ENC_REQ/RSP
crackle -i encrypted.pcap -l 7f62c053f104a5bbe68b1d896a2ed49c -o output.pcap
Crack or decrypt with verbose output
crackle -i test.pcap -v
Run tests against crypto engine
crackle -t
Display usage information and modes
crackle -h
Updated 2026-04-16kali.org ↗