# An Enhanced Passkey Entry Protocol for Secure Simple Pairing in Bluetooth
††thanks: * Research supported by NSERC RGPIN 2016-05610.

Sai Swaroop Madugula and Ruizhong Wei
Department of Computer Science
Lakehead University
Thunder Bay, Canada
<EMAIL_ADDRESS>
###### Abstract

Bluetooth devices are being used very extensively in today’s world. From
simple wireless headsets to maintaining an entire home network, the Bluetooth
technology is used everywhere. However, there are still vulnerabilities
present in the pairing process of Bluetooth which lead to serious security
issues resulting in data theft and manipulation. We scrutinized the passkey
entry protocol in Secure Simple Pairing (SSP) in the Bluetooth standard v5.2.
In this paper, we propose a simple enhancement for the passkey entry protocol
in the authentication stage 1 of Secure Simple Pairing using preexisting
cryptographic hash functions and random integer generation present in the
protocol. The new protocol is more secure and efficient than previous known
protocols. Our research mainly focuses on strengthening the passkey entry
protocol and protecting the devices against passive eavesdropping and active
Man-in-the-middle (MITM) attacks in both Bluetooth Basic Rate/Enhanced Data
Rate (BR/EDR) and Bluetooth Low Energy (Bluetooth LE). This method can be used
for any device which uses the passkey entry protocol.

###### Index Terms:

Bluetooth security, Secure Simple Pairing, MITM attacks, Passkey Entry Model

##  I Introduction

The Bluetooth is a simple wireless technology developed to exchange data over
short ranges of area. The Bluetooth technology usually employs a wireless
personal area network (PAN), also known as a piconet, in which data between
two devices are exchanged securely. With the introduction of Bluetooth v4.0,
namely Bluetooth Low Energy (Bluetooth LE), it became largely famous for its
low power consumption. Bluetooth LE largely has its applications in the
healthcare, fitness, security, and home network systems. This is because
Bluetooth LE offered very low energy consumption while maintaining a similar
communication range to that of Bluetooth Basic Rate/Enhanced Data Rate
(BR/EDR). As the Bluetooth LE is known for its low energy consumption, it is
most suited for the Internet of things (IoT) and is extensively used in it.
The Bluetooth LE is ideal to send small amounts of data between devices
continuously or periodically. Although different from each other, most
security protocols in Bluetooth LE work like the BR/EDR. This is to ensure
that both devices which support BR/EDR and Bluetooth LE are compatible to
connect with each other. The BR/EDR and Bluetooth LE has a secure way of
pairing and generating the link key which is essential for communication
between any two Bluetooth devices. This method is known as Secure Simple
Pairing (SSP). The two main goals of SSP protocol are to protect the devices
against passive eavesdropping and active attacks like MITM.

SSP employs four association models that are used for authentication between
two devices. One of the models is based on the input-output compatibility
(IOcap) of the two devices. In these models, the passkey entry protocol uses a
6-digit passkey which is shared on both sides by the user and is used as an
authentication token. The Bluetooth standard describes that the passkey entry
protocol provides protection against passive eavesdropping and active man-in-
the-middle (MITM) attacks. However, the security of the protocol is based on
the assumption that the passkey is one-time. There are vulnerabilities present
in the passkey entry model which allows an attacker or an adversary to guess
the passkey if it is reused and hijack the session which enables the attacker
to gain access to the Bluetooth devices and retrieve sensitive information.

The most recent countermeasure to the passkey reuse issue was proposed by Da-
zhi Sun and Mu [1] in their improved passkey entry protocol. Their improved
protocol successfully prevents an adversary from deducing the passkey using
passive eavesdropping. In this paper, we have deduced that their protocol is
still vulnerable to an attack algorithm, which is a variant of the normal
brute-force method. By using our attack, the attacker will be able to deduce
the correct passkey which will help them to conduct a successful MITM attack
allowing them to gain access to the Long Term key (LTK).

##  II Problem Definitions

To understand the vulnerability in the passkey entry protocol, we need to
consider a few points.

###  II-A Security of passkey entry protocol according to Bluetooth standard

The Bluetooth standard uses public key exchange to establish a common key
between two devices. However, since the public keys used in the protocol do
not have certificates (they cannot use internet to verify the certificates),
the key exchange is exposed to MITM attacks. According to the Bluetooth
standard v5.2 [2], the passkey entry protocol makes use of a 6-digit passkey
which is entered in both of the devices for authentication. This method is
used to test if there is an MITM attack in the key exchange. The 6-digit
passkey is entered by the user and is of 20-bit length. The passkey entry
protocol uses a method of gradual disclosure of each bit of the passkey based
on the commitment protocol. It describes that a simple brute-force guesser
succeeds guessing the passkey with a probability of 0.000001 thus making it
very difficult for an attacker to obtain the passkey. Then it uses the
Elliptic Curve Diffie Hellman (ECDH) under secure connections mode to protect
the devices against passive eavesdropping.

###  II-B Vulnerability in Passkey Entry Protocol

The passkey entry protocol normally protects the devices against passive and
active attacks. The Bluetooth standard requires that the user should never
reuse the passkey from the previous session. However, if the passkey is
reused, it creates a vulnerability which the attacker can exploit. This is
caused by the method of verifying the passkey. If an attacker can passively
capture the public key exchange packets and the passkey entry protocol
communication packets, they can easily deduce the passkey and conduct a MITM
attack during the user’s next SSP session.

###  II-C How does the vulnerability arise

As we described earlier, ideally it is said that the user should not reuse the
same passkey again. However, just like a user tends to use the same password
for every account, the user might find it simple or easy to reuse the same
passkey for every Bluetooth connection. The attacker can make use of this
vulnerability and exploit the devices. Alternatively, the protocol which is
generating the random passkey might reuse the same passkey to save space or
its computational power which makes the passkey a static key. Since the random
passkey generation protocol does not belong to the Bluetooth standard, it does
not necessarily adhere to its rules. Therefore, there is a chance that it will
use the same passkey for several connections.

###  II-D Assumptions on the capabilities for an adversary to exploit the
vulnerability

In this paper, we assume that an attacker has a set of capabilities that
enables them to perform passive eavesdropping and active MITM attacks. The
capabilities are defined below.

  * •

The attacker has the knowledge of the frequency hopping pattern which is
shared by the two legitimate Bluetooth devices.

  * •

The attacker has the ability to passively capture the transmission packets
exchanged by the two legitimate Bluetooth devices.

  * •

The attacker has the ability to modify packets that are transmitted in real-
time between the legitimate Bluetooth devices thus enabling them to perform a
MITM attack before the devices successfully establish the passkey.

###  II-E Goal of an attacker

The obtaining of the 6-digit passkey in the passkey entry protocol will enable
an attacker to obtain the Long Term Key (LTK) and the encryption key which is
derived after the secure simple pairing process is finished successfully. If
an attacker can successfully conduct a MITM attack using the derived 6-digit
passkey, then they can obtain the LTK and encryption key and will be
considered as a trusted device by the legitimate devices. By using these keys,
an attacker can simply make a request of sensitive data to the legitimate
user. The legitimate user accepts the request since the connection was
successful and sends sensitive data to the attacker thinking that it is an
authentic device. Alternatively, the attacker can intercept the data being
exchanged by legitimate devices and modify the data. Therefore, the
vulnerability of the passkey entry protocol can lead to serious data
manipulation and data theft.

###  II-F Research Goal

In this paper, we propose a new enhanced passkey entry protocol that provides
protection against passive eavesdropping and MITM attacks even in case the
user reuses the same passkey. Our method also tried significantly decreasing
the communication cost and the computation cost. The main idea of our protocol
is completely preventing an attacker from obtaining the correct passkey. By
using our protocol, a legitimate device can successfully prevent an attacker
from obtaining the LTK by MITM attacks.

##  III Association Models in SSP

The SSP is the most important protocol in secure BLE pairing. The main goal of
the SSP is to generate a shared Link key between two Bluetooth devices. A
shared link key must be linked with a strong encryption algorithm to give the
user protection against passive eavesdropping. Therefore, SSP uses Elliptic
Curve Diffie Hellman (ECDH) to generate the Link Key (LK) and is used to
maintain the pairing. However, The SSP process can still be subjected to man-
in-the-middle (MITM) attacks because of the lack of user authentications. In
order to provide authentication, the Bluetooth standard has introduced four
associated models which are implemented in the authentication stage 1 (phase
2) of the SSP. The models are as follows (see [2]):

$\bullet$ Just Works model:

This model is ideally used for scenarios where at least one device has no
output display or any input capability, e.g. wireless speaker. The just works
model does not provide any protection against MITM attacks.

$\bullet$ Numeric Comparison model:

This model is used when both devices have display capabilities as well as
input capability for the user to enter “yes” or “no”. This user confirmation
is required for the device to know that the other device is legitimate and
authentic and is, in fact, the same device the user is trying to connect to.
The numeric comparison model offers limited protection against MITM attacks
with the attacker having a success probability of around 0.000001 on each
iteration of the protocol.

$\bullet$ Out of Band model:

This model is used when both devices can support communication over additional
wireless channels e.g. near field communication (NFC). The out of band (OOB)
channel ideally is resistant to MITM attacks. If not, there is a possibility
that the data might be compromised during the authentication phase.

$\bullet$ Passkey Entry model:

This model is used in scenarios where one device has input capability but does
not have any output display capability. In this case, the user enters an
identical 6-digit passkey on both devices. Alternatively, the passkey might be
randomly generated by an algorithm in one device and displayed, which the user
then inputs into the other device.

##  IV Related Work on SSP

Da-Zhi Sun and Li Sun [3] designed a formal security model to evaluate SSP’s
association models and authenticated link key security. They discussed about
the security and the possible vulnerabilities present in the SSP’s association
models. This model simulates the networking of the Bluetooth devices and
detects attack vectors when an SSP session is run over an insecure public
channel. Eli Biham and Lior Neumann [5] discovered a new vulnerability in the
ECDH key exchange process. Their attack successfully allows an adversary to
recover the session encryption which is used for secure data transfer with a
success rate of 50% during the pairing attempts. They accomplished this by
modifying the y-coordinate of public keys of device and setting them to zero.
By doing this, the computed DHkey value will always be infinity. Therefore, an
adversary could calculate the encryption key this way. This attack is
performed during the public key exchange phase of SSP. Samta Gajbhiya [6]
proposed SSP with an enhanced security level which involves SSP with
authenticated public key exchange and delayed-encrypted capability exchange.
The main goal of their protocol is to prevent an attacker from forcing the
legitimate devices to adopt the association model as per the attacker’s
convenience. Giwon Kwon [4] introduced a method to increase the length of the
Temporary Key (TK) by repeating it. They defined a model in which the master
is required to select and transmit a security level through the security level
field in the PairingRequest packet. Da-Zhi Sun [1] proposed a novel method of
protecting the passkey entry model in secure simple pairing protocol against
MITM even if passkey is reused. After the passkey is injected into two
devices, they generated a random nonce on both devices A and B and exchange
it. Then, A computes a hash using the HMAC-SHA256 algorithm based on the
passkey entered and sets the value r$\boldsymbol{{}^{*}_{a}}$ by taking the
six most significant digits of r. The same process is also done at device B
and the rest of the protocol is kept the same. Due to the random nonces, the
r∗ values computed from the hash are different for each connection. Barnickel
[7] researched on the vulnerability on the passkey entry model of Bluetooth
v2.1+ when the user reuses the same passkey for another SSP session. They
implemented the MITM attack with a successful probability of 90% using the GNU
radio platform on Universal Software Radio Peripheral (USRP) and USRP2
devices. They proposed two countermeasures for the MITM attacks. The first is
to record all the previously entered passkeys by the user and reject them if
they are used again. However, this would mean there would be a very high
storage cost of the protocol since it has to store every passkey entered for
every SSP session. In addition to this, it is difficult for a user to enter a
new password every time they want to connect to a new device since even they
have to remember the previous passkeys used. The second countermeasure
involved using encrypting and decrypting the random nonces which would prevent
a passive attacker from eavesdropping. However, it greatly increases the
complexity and the performance cost of the protocol due to the encryption and
decryption functions.

##  V Architecture of Secure Simple Pairing

For any kind of data transfer between two or more Bluetooth devices, they
first need to establish a connection and pair. To make it secure, the devices
use protocols such as Secure Simple Pairing under different security modes.
The end goal of any pairing process between two Bluetooth devices is to
generate a shared long-term link key on both sides which is used to transfer
data. In classic Bluetooth and Bluetooth LE, there are a total of five phases
in the SSP protocol. SSP strives to provide security while maintaining minimal
user interaction. The primary focus of our research work is the passkey entry
protocol present in the authentication stage 1 phase.

The SSP is the most important pairing protocol in Bluetooth Pairing. Before
SSP, the Bluetooth technology used a 4-digit PIN code to pair with other
devices. This PIN code was also a part of the Link Key calculation process.
Due to the short length of the PIN code, several vulnerabilities were
revealed, and to mitigate them, SSP was used. The end goal of the SSP is to
generate a shared Link key between two Bluetooth devices. However, The SSP
process can still be subjected to man-in-the-middle (MITM) attacks. To prevent
MITM attacks, the Bluetooth standard has introduced association models that
are implemented in the authentication stage 1 (phase 2) of the SSP.

Figure 1: SSP Architecture

As shown in Fig. 1, the working of SSP is the same for any device, excluding
phase 2 which is protocol dependent. All phases of SSP must work in the same
way in every Bluetooth device. As for phase 2, when the IO capabilities are
exchanged before phase 1 of SSP, both devices show what protocols are
supported by them. Based on the compatibility and the requirements, a protocol
is selected and executed.

###  V-A How SSP provides Security

Usually, an attacker has two ways of obtaining data. The first technique is to
execute passive eavesdropping (usually performed with specially designed tools
like Ubertooth) and capture the transmission packets. By doing this, the
attacker can try to compute the LTK based on the captured data in phase 1 and
phase 2. If the attacker obtains the LTK in this way, then they can simply
calculate the encryption key which is originally derived from the LTK. Thus,
when two legitimate devices transfer data using this encryption key, the
attacker can again capture the data packets and simply decrypt them using the
deduced encryption. This way, they can gain access to sensitive data.

The second technique is to execute a MITM attack. This technique is more
dangerous because if successful, the attacker has a trusted connection with
the legitimate device and can request data or send malicious files to the
target device. In the case of passive eavesdropping, the attacker can only
access the data which is transferred between two legitimate devices. However,
when it comes to active attacks such as MITM, the attacker and the target
devices share the same LTK. Therefore, an attacker can enable data transfer
requests whenever they require provided that the target device has its
Bluetooth switched on.

SSP provides protection from these attacks in the authentication stage 1 and
authentication stage 2. In authentication stage 1, the SSP tries to prevent
any MITM attacks by using either the numeric comparison or the passkey entry
protocol based on the IOcap of devices. If an attacker was able to intercept
the communication in phase 1 of SSP, it prevents the attacker from obtaining
the LTK by performing authentication in phase 2. In authentication stage 2,
the DHkey which is computed in phase 1 is verified which protects the device
from passive eavesdropping.

###  V-B Outline of SSP

In phase 1 of SSP, the initiating device A and the advertising device B
establish a common key DHkey following the Elliptic Curve Diffie Hellman
protocol. Note that since both devices do not have authentications, this key
only can be used to prevent eavesdropping attacks in the following, but not
for the MITM attacks.

The SSP Phase 2 ( Authentication Stage 1) consists of 3 association models. In
Bluetooth LE, the just works model integrates with the numeric comparison
model. Aside from these two models, we have the out of band model and the
passkey entry model. This phase is dependent on the IO capabilities of both
devices. Based on the IOCap, the compatible association model is selected.
Since our focus is on the passkey entry model, we will not discuss the other
association models in detail.

Figure 2: SSP Phase 2: Passkey Entry Protocol

Figure 2 describes the passkey entry model. In this model, the host or the
user enters a 6-digit identical passkey on both devices A and B. The 6-digit
passkey which is of 20-bit length is then stored into ra and rb. After
injecting the passkey, the steps 3-8 are repeated for 20 times and each round
is denoted with the integer $i$ which has a range of $1<=i<=20$. For every
round, exactly one bit of passkey is sent to the other device. In each round,
a 128-bit random nonce Nai and Nbi is generated accordingly at both sides.
After that, the device A computes a commitment value Cai using
$f1$(PKax,PKbx,Nai,rai) and sends it to device B. B also generates the
commitment value Cbi using $f1$(PKbx,PKax,Nbi,rbi) and sends it to device A.
After exchanging the commitment values, the device A sends its Nai value to B.
Now, the device B, uses the Nai value sent by A to check if
C$\boldsymbol{{}_{ai}}=f1$(PKax,PKbx,Nai,r${}_{bi})$ and if the check passes,
the device B will also send its Nbi value. If the check does not pass, the
protocol is aborted and the SSP session will need to be run again. The same
procedure is followed at the device A also. According to the Bluetooth
standard, the gradual disclosure of the passkey in this way prevents leakage
of more than 1 bit of the passkey making it difficult for an MITM attacker to
crack it. At the end of this stage, the values of Na and Nb are set to
N$\boldsymbol{{}_{a}}20$ and N$\boldsymbol{{}_{b}}20$ which are later used in
the next stage, authentication stage 2. Here, $f1()$ is an HMAC-SHA256 secure
hash function used to calculate the commitment values of Cai and Cbi. In the
following $f2(),f3()$ are also HMAC-SHA256 based hash functions.

In SSP Phase 3 (Authentication Stage 2), the device A computes a new
confirmation value Ea using $f3(DHkey,N_{a},N_{b},r_{b},IOcapA,A,B)$ and B
computes a confirmation value Eb using $f3(DHkey,N_{b},N_{a},r_{a},\\\
IOcapB,B,A)$ simultaneously. After the computations, the device A sends the Ea
to device B where B checks the Ea with
$f3(DHKey,N_{a},N_{b},r_{b},IOcapA,A,B)$. If the check fails, the protocol
aborts. If the check passes, the value of Eb is sent to device A where A also
checks the Eb with $f3(DHKey,N_{b},N_{a},r_{a},IOcapB,B,A)$. If the check
fails, the protocol aborts. Here the value of ra and rb is the entire 20-bit
passkey.

In SSP Phase 4, a shared link key is generated by using
$f2(DHkey,N_{a},N_{b},btlk,BD\\_ADDR_{a},BD\\_ADDR_{b})$ at both sides. The
order of the parameters must be the same in order to calculate the same key.
The end goal of an attacker is to obtain this key.

Once the shared link key is established at both sides, the authentication
process and the encryption key generation process is completed based on the
link key. The steps followed in this phase are identical to the ones in the
legacy pairing. Since we are only focusing on the passkey entry model, we
omitted the details of phase 5 here.

##  VI Vulnerability in Passkey Entry Protocol

The Bluetooth standard uses ECDH public key exchange in phase 1 to prevent
passive eavesdropping. However, Since both devices do not have any
authentication during the key exchange, an attacker can easily perform MITM
attack which will result DHkeys shared with the attacker and the two devices.
To prevent such attacks, the standard uses the Phase 2 or authentication stage
1 phase. The main idea is that if there is a MITM attack in Phase 1, then the
Bluetooth standard will try to prevent the attacker from connecting by using
one of the association models in Phase 2. The Passkey Entry model of Bluetooth
uses the commitment protocol to make sure that both parties have the same
passkey. That method works well if the user will change the passkey each time
when the connection has a problem. Unfortunately, in practice very likely
users will use the same passkey for many times, which will cause serious
security problems.

For instance, a passive attacker can capture all the commitment values
$(C_{ai}$ and $C_{bi})$, random nonce $(N_{ai}$ and $N_{bi})$ and deduce each
bit of passkey r by computing their own commitment
$f1(Pk_{ax},PK_{bx},N_{ai},r^{\prime}_{ai})$ and comparing it with the
original value. Since the value of the rai is always either a 1 or 0, the
attacker can easily obtain the entire passkey. In this way, the attacker can
figure out the correct $r_{ai}$. Ideally, we should not reuse the same passkey
again, however, most users tend to reuse the old passkey again for simplicity
and ease. This enables the attacker to launch an MITM attack with the known
passkey successfully communicating with the two devices simultaneously. In
this way, after capturing all the packets and deducing the passkey, the
attacker will successfully break into the system.

In what follows, we always assume that there is a MITM attack in Phase 1, and
we what to check if the authentication process in Phase 2 can always find out
the attacks.

##  VII An Improved Passkey Entry Protocol by Sun and Mu

Sun and Mu in [1] proposed an improved passkey entry protocol as a
countermeasure to passkey reuse. We will refer to this protocol as the SM
protocol. They proposed an improved passkey entry protocol in which, before
sending each bit of passkey (steps 3-8) in Figure 2, they generate a new
random nonce on both sides and exchange them. Then, they compute
$r=f2(DHkey,N_{a0},N_{b0},r_{a})$ at device A and
$r=f2(DHkey,N_{a0},N_{b0},r_{b})$ at device B and set the six most significant
digits of r to r${}^{*}_{a}$. This protocol needs a generation of two
additional 128-bit random nonces as well as two additional cryptographic hash
function f2() which is originally used in the generation of link key in SSP
phase 4.

Figure 3: SM Improved Passkey Entry Model.

in Figure 3, after injecting the passkey r on both sides, the devices A and B
generate two random nonces Na0 and Nb0. The two nonces are sent to each other.
Then, on device A, a new hash value is computed as
$r=f2(DHkey,N_{a0},N_{b0},r_{a})$ and the six most significant digits of r is
set to r$\boldsymbol{{}^{*}_{a}}$. The device B computes the hash value
$r=f2(DHkey,N_{a0},N_{b0},r_{b})$ and sets the six most significant digits of
r to r$\boldsymbol{{}^{*}_{b}}$. The rest of the protocol, the steps 5-10, is
run the same as that of the original passkey entry model. In their protocol,
the random passkey r is used as a seed of the authentication passkey.

This way, even if the user uses the same passkey next time, the attacker
cannot easily attack since each time the values of r$\boldsymbol{{}^{*}_{a}}$
and r$\boldsymbol{{}^{*}_{b}}$ will be different.

###  VII-A An attack on SM protocol

Consider a scenario where an attacker is simultaneously trying to establish a
connection with both devices A and B. If we assume that the device A and
device B have a fault tolerance system where they allow three to four
consecutive SSP sessions with minimal delay in the event of failure, the
attacker can try to establish consecutive sessions to device A and device B
event in the event of failure of prediction of bits. When an attacker has
successfully completed the public key exchange, then they have two DHKey
values, one with device A and another with device B. If we assume that an
attacker was able to correctly predict around 8-bits of the r${}^{*}_{a}$ and
r${}^{*}_{b}$, then a simple brute-force would greatly increase the chances of
the attacker to predict the correct passkey. This is because aside from the
passkey r, the attacker knows the values of DHkey, Na0, and Nb0. So after the
SSP session fails due to the incorrect passkey bit, the attacker can simply
brute-force all the combinations of passkey and match the output with the
8-bits of r${}^{*}_{a}$. Out of the passkeys which match, there is going to be
the correct passkey. The attacker can now take the list of the matched
passkeys and perform a dictionary attack and try those combinations with the
first 8 bits of r${}^{*}_{b}$ of another SSP session.

The algorithm is displayed in Algorithm 1.

Algorithm 1 Brute-force algorithm

1:Initialise DHkey, Na0, Nb0, newlist[] and count = 0 obtained from first SSP
session.

2:for i in range of (0..1000000) do

3: if i$\leq$100000 then

4: prepend zeros to i to make it 6-digit.

5: end if

6: Generate rx = HMAC-SHA256(DHkey, Na0, Nb0, i)

7: Set n most significant of rx to r${}^{\prime}_{x}$ where n is the obtained
number of r${}^{*}_{a}$ bits by the attacker.

8: if r${}^{\prime}_{x}==$r${}^{*}_{a}$ then

9: newlist[count] = i (Adding i to the list of potential passkeys.)

10: count = count + 1

11: print(Match found. Potential Passkey = i)

12: end if

13:end for

14:procedure consecutivebrute(DHkey, Na0, Nb0, newlist, count)

15: Initialise DHkey, Na0, Nb0 obtained from next consecutive SSP session.

16: newcount = 0

17: for i in range of (0..count) do

18: if newlist[i]$\leq$100000 then

19: prepend zeros to newlist[i] to make it 6-digit.

20: end if

21: Generate rx = HMAC-SHA256(DHkey, Na0, Nb0, newlist[i])

22: Set n most significant of rx to r${}^{\prime}_{x}$ where n is obtained
number of r${}^{*}_{a}$ bits by the attacker.

23: if r${}^{\prime}_{x}==$r${}^{*}_{a}$ then

24: newlist[newcount] = i (Adding i to the list of potential passkeys.)

25: newcount = newcount + 1

26: print(Match found. Potential Passkey = newlist[i])

27: end if

28: end for

29:end procedure

30:Execute consecutivebrute(DHkey, Na0, Nb0, newlist, count) with a new list
of potential passkeys until the correct passkey is found.

By doing this, the attacker can eventually obtain the correct passkey within
2-3 SSP sessions. When the passkey is known, the attacker will simply execute
MITM attack in the new session, and this time, they will be successful because
of the correct passkey and will be able to obtain the LTK.

###  VII-B Simulation Results

We have done a simulation where we tested the resilience of the SM passkey
entry model against the brute-force attack. For this specific simulation of
the brute-force attack, we used a desktop computer with an Intel i7 2.20GHz
processor. We have performed the brute-force attack when 4, 5, 6 and 7 bits of
r* are known to the attacker. The brute-force attack was conducted 50 times
with each known r* value and the average SSP sessions required were calculated
for each r* value as shown in Figure 4.

Figure 4: SM protocol resistance against Brute-force attack.

##  VIII Enhanced Passkey Entry Protocol

To improve the security of the passkey protocol, we propose an alternate to
[1], our enhanced passkey entry protocol below. Our protocol does not differ
much from the original protocol in Bluetooth standard and in addition to that,
there are only 10 rounds in our protocol which significantly reduce the power
and communication costs of the devices. The main idea of our protocol is to
never reveal the original passkey until phase 3 of the SSP. We also make use
of the properties of the DHKey in the ECDH algorithm to generate a 256-bit
hash from passkey r. Therefore, we use a derivative hash of the original
passkey r and use that to run the entire passkey entry protocol. In our
protocol, there are 2 different bits exchanged and verified at each side for
each round resulting in 20-bits being exchanged altogether.

Figure 5: New Enhanced Passkey Entry Protocol.

Our protocol is displayed in Fig. 5. When the user enters the random passkey
on both devices, we make use of the f2() hash function of the original passkey
entry protocol to create a 256-bit hash value from the input passkey r. We use
the shared DHKey calculated in the public key exchange phase as the key for
the HMAC function and the input message, 20-bit passkey. The resultant hash is
denoted as r$\boldsymbol{{}^{\prime}_{a}}$ and r$\boldsymbol{{}^{\prime}_{b}}$
respectively. The computed hashes r$\boldsymbol{{}^{\prime}_{a}}$ and
r$\boldsymbol{{}^{\prime}_{b}}$ calculated in steps 3a and 3b have the same
value since the passkey is same at both devices. After generating these
values, the steps 4-12 are executed for 10 times. In steps 4a and 4b, an 8-bit
random integer n′ (where $1<=n\boldsymbol{{}^{\prime}}<=255$) is generated at
both sides i.e., n$\boldsymbol{{}^{\prime}_{a}}$ and
n$\boldsymbol{{}^{\prime}_{b}}$ for device A and device B respectively. This
random integer defines the position at which the passkey bit is to be taken
from r$\boldsymbol{{}^{\prime}_{a}}$ and r$\boldsymbol{{}^{\prime}_{b}}$.
After generating the random integers, both devices perform an XOR operation
with the 8-bit random integer n′ and the $\boldsymbol{i^{th}}$ set of 8-bits
of the r′. Both values are exchanged in steps 5 and 6. Next, at device A, we
compute the XOR as $(n\boldsymbol{{}^{\prime}_{b}}\oplus
r\boldsymbol{{}^{\prime}_{b}})\oplus r\boldsymbol{{}^{\prime}_{a}}$ and obtain
the n$\boldsymbol{{}^{\prime}_{b}}$ value. Then, we set the
n$\boldsymbol{{}^{\prime}_{b}}$th bit of 256-bit
r$\boldsymbol{{}^{\prime}_{a}}$ hash value to the r$\boldsymbol{{}^{*}_{ai}}$
bit. For instance, if the random number n$\boldsymbol{{}^{\prime}_{b}}$ is 20,
then we set the value of the 20th bit of r$\boldsymbol{{}^{\prime}_{a}}$ hash
as r$\boldsymbol{{}^{*}_{ai}}$. The same process is followed at the device B
where we calculate $(n\boldsymbol{{}^{\prime}_{a}}\oplus
r\boldsymbol{{}^{\prime}_{a}})\oplus r\boldsymbol{{}^{\prime}_{b}}$ to obtain
the n$\boldsymbol{{}^{\prime}_{a}}$. Since the values of the
r$\boldsymbol{{}^{\prime}_{a}}$ and r$\boldsymbol{{}^{\prime}_{b}}$ are equal,
the XOR operation will derive the correct values. After setting the
r$\boldsymbol{{}^{*}_{ai}}$ and r$\boldsymbol{{}^{*}_{bi}}$ values, both
devices generate a 128-bit random nonce. In steps 10a and 10b, the device A
computes a commitment value Cai$=f1$(PKax,PKbx,Nai,r${}^{*}_{ai}$) and device
B computes a commitment value Cbi$=f1$(PKbx,PKax,Nbi,r${}^{*}_{bi}$). Both
commitment values are exchanged between the two devices. Then, the device A
sends the 128-bit random nonce Nai. After receiving the random nonce Nai, the
device B sets the r$\boldsymbol{{}^{*}_{bi}}$ with the value at
n$\boldsymbol{{}^{\prime}_{b}}$th bit of r$\boldsymbol{{}^{\prime}_{b}}$ hash.
Next, the commitment value Cai is checked by verifying
Cai$=f1$(PKax,PKbx,Nai,r${}^{*}_{bi}(n^{\prime}_{b}position)$). If the two
values match, then the protocol is continued. The device B sends the random
nonce Nbi and random integer n$\boldsymbol{{}^{\prime}_{b}}$. The same process
is followed at device A and the commitment values are verified. This process
is repeated for 10 rounds where two bits of the 256-bit r′ hash are sent
randomly by two devices in each round.

The main idea of our proposed protocol is to use bits from the random position
of the hash value of the passkey to do the commitment instead of using the
bits of passkey. To keep the position information secure, we again use the
hash value as the one-time pad encryption key to encrypt the information of
positions. In our protocol, the passkey is never used to communicate between
two parties.Therefore no information will be revealed by the communication.
Since the random position is used, Algorithm 1 does not work for our protocol.

##  IX Security of Enhanced Passkey Entry Protocol under passive Eavesdropping
and MITM attacks

Compared to the original passkey entry protocol, our enhanced protocol
provides protection against passive and active attacks. Consider a scenario
where the attacker X captures all the commitment values and the random nonce
of the passkey entry protocol run using passive eavesdropping. Note that here,
we assume that the attacker already has the knowledge of the frequency hopping
pattern of the target devices. By doing this, the attacker effectively obtains
the public keys of device A and device B. Then in the passkey entry protocol
run, the commitment values and the random nonces are obtained. Now, the
attacker X can try to deduce the value of r∗ bits by comparing the commitment
values but X cannot find out the original passkey r from the r∗ bits.
Therefore, even though X knows r∗, they cannot deduce the original passkey
because the r∗ bits are generated from the hash function which uses the
original passkey r as the message and the DHkey as the key for the HMAC
operation. In a worst case, the attacker would have 10 bits of the
r$\boldsymbol{{}^{*}_{ai}}$ and r$\boldsymbol{{}^{*}_{bi}}$ values which are
exchanged in each round. However, these values are not enough to deduce the
entire hash. In addition to this, even if the DHkey is known the attacker
would still not know the position of the r∗ bits which are exchanged due to
XOR operations. In addition to this, the r′ value will be different for every
SSP session which leads to an entirely different and unique hash value r′ in
another SSP session even a same passkey is used. In this way we eliminate the
possibility of an attacker that uses passive eavesdropping to deduce the
original passkey. To summarise, it would be impossible for an attacker to
deduce the full hash value of the passkey even if they passively eavesdropped
the target device’s SSP sessions continuously several times because of the
following reasons.

  * •

Even if the passkey is reused, the hash value obtained in step 3 of Figure 5
will be different for every SSP session. Each time, the target device connects
to a different device, the DHKey value will change and as a result, the hash
value will also change.

  * •

The ECDH private-public key pair is generated randomly and is not static.

  * •

Since the n’ bits are hidden using the XOR operations, an adversary cannot
guess the correct passkey due to a one-time pad technique.

We have also compared the security of our protocol to the SM protocol. While
the SM protocol can be attacked using our brute-force attack mentioned in
algorithm 1, the enhanced passkey entry model completely prevents an adversary
from establishing the attack. This is because of the XOR operations done on
both sides to hide the correct value of the n$\boldsymbol{{}^{\prime}_{a}}$
and n$\boldsymbol{{}^{\prime}_{b}}$. From an attacker’s perspective, the
XOR’ed value which is sent during steps 5 and 6 is not useful to them. Unless
the attacker already knows the random integer n′ or the $i^{th}$ set of 8-bits
of the correct hash value, they can obtain neither the correct n′ or the
$i^{th}$ set of r′ value. In the XOR operation, the value of the n′ and the
set of 8-bit r′ used is different for each round and is not repeated anywhere.
Therefore, the XOR operation that is executed in steps 5 and 6 technically
uses the properties of the one-time pad technique making it very secure.

In case of a MITM attack, when the public key exchange phase is completed
between the attacker and the devices A and B. Now, the attacker will share one
DHkey with device A and one DHkey with device B. In our proposed protocol,
after the legitimate user enters the 6-digit passkey, we generate a hash using
the DHkey and the 6-digit passkey. Since the attacker does not know the
passkey, they have 1 million possibilities of the passkey. Even if one digit
of the passkey is guessed wrong, the hash value which is computed is changed
drastically. In addition to this, the hash value of device A and device B will
be different due to the different DHkey values. Due to this, when the XOR
operation is done with the 8-bit random integer and the 8-bit set of r′ and
the result is exchanged between the devices, the derived value will be
different leading to an incorrect n′ value. Therefore, even if an attacker
predicts a correct r∗ bit in one round, they would not know the correct value
of the position n′ which is needed to execute the brute-force attack described
in Algorithm 1.

Therefore, our protocol not only thwarts off passive eavesdropping but also
Man-in-the-middle attacks even when a passkey is reused.

##  X Performance Evaluation

###  X-A Performance Cost of Original Passkey Entry Model

In the original passkey entry protocol for each round, there are hash
operations of f1 at steps 4a, 4b, 7a, and 8a as shown in Figure 2. Therefore,
the computation cost between the two devices is 80 hash functions. Coming to
the commitment values, each value has a size of 128bits. And there are exactly
2 commitment values exchanged in each round for 20 rounds. Therefore, the
communication cost for the commitment values can be calculated as

$20(rounds)*2(commitmentvalues)*128(sizeof(commitment))=5120bits$

And in addition to that, the two devices exchange exactly two random nonce for
each round in $1\leq i\leq 20$ which leads to

$20(rounds)*2(RandomNonce)*128(sizeof(randnonce))=5120bits$

Altogether, we have a total of 10,240 bits being exchanged in the protocol
run. Finally, the storage cost of the protocol would be around 192 or 256 bits
depending on the length of the DHkey. Taking the size of the passkey into
account, we also need an additional 20-bits. Then, the total storage cost
would be 212 or 276 bits.

###  X-B Performance Cost of Enhanced Passkey Entry Model

Our enhanced protocol performs in the same way as the original. The main
difference of our protocol is that it significantly reduces the number of hash
computations required due to the 10 rounds. We also need two extra variables
to store the calculated 256-bit hash $\boldsymbol{r^{\prime}}$ and the 8-bit
random integer $\boldsymbol{n^{\prime}}$. In addition to this, there are 2
additional hash computations present before the execution of steps 4-14 in
Figure 5. These hash computations are done on both sides. We are not
considering the XOR operations done on both sides as the operation cost is
almost negligible. In our protocol, aside from two hash computations in step
3a and 3b, in each round, there are 4 hash computations which are used to
compute the commitment values and verify them at both sides. So, for 10 rounds
we have 4(Hash) x 10(rounds) = 40 Hash computations. Therefore, the
computation cost of our protocol adds up to a total of 42 Hash computations.
Regarding the communication cost, our protocol follows the same steps as that
of the original protocol aside from the fact that two 8-bit random integers
are exchanged in each round. The size of the commitment values and the random
nonces remain the same. Therefore, the communication cost can be calculated as

$10(rounds)*2(randint)*8(randintsize)+10(rounds)*2(commitmentvalues)*128(commitmentsize)+10(rounds)*2(randomnonces)*128(randomnoncesize)=5280bits$

The storage cost of our protocol is 468 or 532 bits (including the 20-bit
passkey) depending on the length of DHkey. Although the storage cost is higher
than the original protocol, it significantly increases the security of the
protocol by providing two layers of security and protecting devices against
passive attacks and active MITM attacks.

Our enhanced passkey entry significantly reduces the computation cost as well
as the communication cost in half. Due to the decrease in the computation
cost, the device will not take as much power as the original protocol. In
addition to this, the passkey entry protocol runs faster due to the decrease
in the communication cost as we only need to send half of the bits compared to
the original protocol.

##  XI Conclusion

In this paper, we have introduced a new enhanced passkey entry protocol that
successfully protects the Bluetooth devices against passive attacks and MITM
attacks while reducing the computation and communication costs by half. It
should be noted that we have designed our protocol without deviating too much
from the original protocol. This is done so that our enhanced protocol can be
simply integrated with the Bluetooth devices in the form of a patch. We have
made a theoretical approach to the passkey reuse issue and protection against
MITM in the passkey entry model. We will consider employing our proposed
protocol in different Bluetooth devices and test the protocol under different
scenarios as our future work.

## References

  * [1] Da-Zhi Sun, Yi Mu. “Man-in-the-middle attacks on Secure Simple Pairing in Bluetooth standard v5.0 and its countermeasure.” Personal and Ubiquitous Computing, February 2018. pp.55-67.
  * [2] Bluetooth Special Interest Group (SIG) Core Specification document v5.2 (2019) https://www.bluetooth.com/
  * [3] Da-Zhi Sun, Li sun. “On Secure Simple pairing in Bluetooth standard v5.0-Part I: Authenticated Link Key Security and Its Home Automation and Entertainment Applications.” Mar 2019.
  * [4] Giwon Kwon, Jeehyeong Kim. “Bluetooth Low Energy Security Vulnerability and Improvement Method.” IEEE ICCE Asia, 2016.
  * [5] Eli Biham, Lior Neumann. Breaking the Bluetooth Pairing - Fixed Coordinate Invalid Curve Attack. July 2018. Accessed January 2020.
  * [6] Samta Gajbhiye, Sanjeev Karmakar. “Bluetooth Secure Simple Pairing with enhanced security level.” Journal of information security and applications 44 (2019). pp.170-183.
  * [7] Barnickel J, Wang J, Meyer U. “Implementing an attack on Bluetooth 2.1+ secure simple pairing in passkey entry mode.” IEEE computer society (2012), pp.17-24.


recalling $c\equiv se^{\eta}.$ There are never any genuine saddle points of
(495) or (496).

To obtain the expressions (335) and (342) from (489) and (494) one must use
the identities

$\displaystyle a_{0}\pm i\sqrt{w^{2}-a_{0}^{2}}={1\over\sqrt{1+u^{2}}}(1\pm
iw\sqrt{u^{2}-u_{w}^{2}})$ (497)
$\displaystyle\sqrt{1-a_{0}^{2}}\pm\sqrt{w^{2}-a_{0}^{2}}={1\over\sqrt{1+u^{2}}}(|u|\pm
w\sqrt{u^{2}-u_{w}^{2}})$ (498) $\displaystyle 1\pm
iw\sqrt{u^{2}-u_{w}^{2}}={w^{2}(1+u^{2})\over 1\mp iw\sqrt{u^{2}-u_{w}^{2}}}$
(499) $\displaystyle|u|\pm
w\sqrt{u^{2}-u_{w}^{2}}={(1-w^{2})(1+u^{2})\over|u|\mp
w\sqrt{u^{2}-u_{w}^{2}}}\ .$ (500)

## References

  * (1) J. M. Maldacena, JHEP 04, 021 (2003) [arXiv:hep-th/0106112 [hep-th]].
  * (2) P. Kraus, H. Ooguri and S. Shenker, Phys. Rev. D 67, 124022 (2003) [arXiv:hep-th/0212277 [hep-th]].
  * (3) L. Fidkowski, V. Hubeny, M. Kleban and S. Shenker, JHEP 02, 014 (2004) [arXiv:hep-th/0306170 [hep-th]].
  * (4) G. Festuccia and H. Liu, JHEP 04, 044 (2006) [arXiv:hep-th/0506202 [hep-th]].
  * (5) T. Hartman and J. Maldacena, JHEP 05, 014 (2013) [arXiv:1303.1080 [hep-th]].
  * (6) H. Liu and S. J. Suh, Phys. Rev. Lett. 112, 011601 (2014) [arXiv:1305.7244 [hep-th]].
  * (7) H. Liu and S. J. Suh, Phys. Rev. D 89, no.6, 066012 (2014) [arXiv:1311.1200 [hep-th]].
  * (8) L. Susskind, Fortsch. Phys. 64, 24-43 (2016) [arXiv:1403.5695 [hep-th]].
  * (9) M. Grinberg and J. Maldacena, JHEP 03, 131 (2021) [arXiv:2011.01004 [hep-th]].
  * (10) Y. Zhao, JHEP 21, 144 (2020) [arXiv:2011.06016 [hep-th]].
  * (11) F. M. Haehl and Y. Zhao, JHEP 06, 056 (2021) [arXiv:2102.05697 [hep-th]].
  * (12) F. M. Haehl and Y. Zhao, Phys. Rev. D 104, no.2, L021901 (2021) doi:10.1103/PhysRevD.104.L021901 [arXiv:2104.02736 [hep-th]].
  * (13) F. M. Haehl, A. Streicher and Y. Zhao, JHEP 08, 134 (2021) doi:10.1007/JHEP08(2021)134 [arXiv:2105.12755 [hep-th]].
  * (14) J. Maldacena and X. L. Qi, [arXiv:1804.00491 [hep-th]].
  * (15) H. W. Lin, J. Maldacena and Y. Zhao, JHEP 08, 049 (2019) [arXiv:1904.12820 [hep-th]].
  * (16) M. Van Raamsdonk, Gen. Rel. Grav. 42, 2323-2329 (2010) [arXiv:1005.3035 [hep-th]].
  * (17) J. Maldacena and L. Susskind, Fortsch. Phys. 61, 781-811 (2013) [arXiv:1306.0533 [hep-th]].
  * (18) A. Hamilton, D. N. Kabat, G. Lifschytz and D. A. Lowe, Phys. Rev. D 73, 086003 (2006) [arXiv:hep-th/0506118 [hep-th]].
  * (19) A. Hamilton, D. N. Kabat, G. Lifschytz and D. A. Lowe, Phys. Rev. D 75, 106001 (2007) [erratum: Phys. Rev. D 75, 129902 (2007)] [arXiv:hep-th/0612053 [hep-th]].
  * (20) K. Papadodimas and S. Raju, JHEP 10, 212 (2013) [arXiv:1211.6767 [hep-th]].
  * (21) K. Papadodimas and S. Raju, Phys. Rev. D 89, no.8, 086010 (2014) doi:10.1103/PhysRevD.89.086010 [arXiv:1310.6335 [hep-th]].
  * (22) K. Papadodimas and S. Raju, Phys. Rev. Lett. 115, no.21, 211601 (2015) doi:10.1103/PhysRevLett.115.211601 [arXiv:1502.06692 [hep-th]].
  * (23) D. L. Jafferis and L. Lamprou, [arXiv:2009.04476 [hep-th]].
  * (24) P. Gao and L. Lamprou, [arXiv:2111.14010 [hep-th]].
  * (25) Y. Nomura, Phys. Rev. D 99, no.8, 086004 (2019) [arXiv:1810.09453 [hep-th]].
  * (26) Y. Nomura, Phys. Rev. D 101, no.6, 066024 (2020) [arXiv:1908.05728 [hep-th]].
  * (27) Y. Nomura, Phys. Rev. D 102, no.2, 026001 (2020) doi:10.1103/PhysRevD.102.026001 [arXiv:1911.13120 [hep-th]].
  * (28) K. Langhoff and Y. Nomura, Phys. Rev. D 102, no.8, 086021 (2020) doi:10.1103/PhysRevD.102.086021 [arXiv:2008.04202 [hep-th]].
  * (29) Y. Nomura, Phys. Rev. D 103, no.6, 066011 (2021) doi:10.1103/PhysRevD.103.066011 [arXiv:2010.15827 [hep-th]].
  * (30) S. Leutheusser and H. Liu, [arXiv:2110.05497 [hep-th]].
  * (31) R. Haag, Local quantum physics: Fields, particles, algebras, Springer, Berlin (1992)
  * (32) E. Witten, Rev. Mod. Phys. 90, no.4, 045003 (2018) [arXiv:1803.04993 [hep-th]].
  * (33) S. D. Mathur, [arXiv:1402.6378 [hep-th]].
  * (34) E. Witten, [arXiv:2112.12828 [hep-th]].
  * (35) H. Araki, Prog. Theoret. Phys. 32, 956 (1964)
  * (36) R. Longo, Commun. Math. Phys. 38, 551 (1982)
  * (37) K. Fredenhagen, Commun. Math. Phys. 97, 79 (1985) doi:10.1007/BF01206179
  * (38) E. Witten, [arXiv:2112.11614 [hep-th]].
  * (39) J. M. Magán and J. Simón, JHEP 05, 071 (2020) [arXiv:2002.03865 [hep-th]].
  * (40) M. Banados, C. Teitelboim and J. Zanelli, Phys. Rev. Lett. 69, 1849-1851 (1992) [arXiv:hep-th/9204099 [hep-th]].
  * (41) A. Connes, Ann. Sci. Ecole Norm. Sup. 6, 133 (1973)
  * (42) A. Connes, Ann. Inst. Fourier, Grenoble 24(4), 121 (1974)
  * (43) G. Festuccia and H. Liu, JHEP 12, 027 (2007) [arXiv:hep-th/0611098 [hep-th]].
  * (44) N. Iizuka, T. Okuda and J. Polchinski, JHEP 02, 073 (2010) [arXiv:0808.0530 [hep-th]].
  * (45) N. Iizuka and J. Polchinski, JHEP 10, 028 (2008) [arXiv:0801.3657 [hep-th]].
  * (46) S. A. Hartnoll and S. P. Kumar, JHEP 12, 036 (2005) [arXiv:hep-th/0508092 [hep-th]].
  * (47) A. Hamilton, D. N. Kabat, G. Lifschytz and D. A. Lowe, Phys. Rev. D 74, 066009 (2006) [arXiv:hep-th/0606141 [hep-th]].
  * (48) B. Czech, J. L. Karczmarek, F. Nogueira and M. Van Raamsdonk, Class. Quant. Grav. 29, 235025 (2012) [arXiv:1206.1323 [hep-th]].
  * (49) I. A. Morrison, JHEP 05, 053 (2014) [arXiv:1403.3426 [hep-th]].
  * (50) D. L. Jafferis, A. Lewkowycz, J. Maldacena and S. J. Suh, JHEP 06, 004 (2016) [arXiv:1512.06431 [hep-th]].
  * (51) T. Faulkner and A. Lewkowycz, JHEP 07, 151 (2017) [arXiv:1704.05464 [hep-th]].
  * (52) S. Ryu and T. Takayanagi, Phys. Rev. Lett. 96, 181602 (2006) [arXiv:hep-th/0603001 [hep-th]].
  * (53) H. Casini, M. Huerta and J. A. Rosabal, Phys. Rev. D 89, no.8, 085012 (2014) [arXiv:1312.1183 [hep-th]].
  * (54) W. Donnelly and A. C. Wall, Phys. Rev. D 94, no.10, 104053 (2016) [arXiv:1506.05792 [hep-th]].
  * (55) W. Donnelly and A. C. Wall, Phys. Rev. Lett. 114, no.11, 111603 (2015) [arXiv:1412.1895 [hep-th]].
  * (56) D. Harlow, JHEP 01, 122 (2016) [arXiv:1510.07911 [hep-th]].
  * (57) D. Nickel and D. T. Son, New J. Phys. 13, 075010 (2011) [arXiv:1009.3094 [hep-th]].
  * (58) P. Glorioso, M. Crossley and H. Liu, [arXiv:1812.08785 [hep-th]].
  * (59) J. de Boer, M. P. Heller and N. Pinzani-Fokeeva, JHEP 05, 188 (2019) [arXiv:1812.06093 [hep-th]].
  * (60) T. Faulkner, A. Lewkowycz and J. Maldacena, JHEP 11, 074 (2013) [arXiv:1307.2892 [hep-th]].
  * (61) D. Buchholz, Commun. Math. Phys. 36 (1974) 287.
  * (62) D. Buchholz and E. H. Wichmann, Commun. Math. Phys. 106 (1986) 321.
  * (63) C. J. Fewster, arXiv:1601.06936.
  * (64) S. Dutta and T. Faulkner, JHEP 03, 178 (2021) doi:10.1007/JHEP03(2021)178 [arXiv:1905.00577 [hep-th]].
  * (65) D. Harlow, Commun. Math. Phys. 354, no.3, 865-912 (2017) doi:10.1007/s00220-017-2904-z [arXiv:1607.03901 [hep-th]].
  * (66) T. Faulkner, [arXiv:2008.04810 [hep-th]].
  * (67) H. Casini, M. Huerta, J. M. Magán and D. Pontello, JHEP 02, 014 (2020) doi:10.1007/JHEP02(2020)014 [arXiv:1905.10487 [hep-th]].
  * (68) N. Goheer, M. Kleban and L. Susskind, Phys. Rev. Lett. 92, 191601 (2004) [arXiv:hep-th/0310120 [hep-th]].
  * (69) D. Harlow and J. q. Wu, [arXiv:2108.04841 [hep-th]].
  * (70) J. De Boer and L. Lamprou, JHEP 06, 024 (2020) doi:10.1007/JHEP06(2020)024 [arXiv:1912.02810 [hep-th]].
  * (71) H. J. Borchers, Commun. Math. Phys. 143, 315-332 (1992)
  * (72) H. W. Wiesbrock, Commun. Math. Phys. 157, 83-92 (1993) [erratum: Commun. Math. Phys. 184, 683-685 (1997)]
  * (73) H. J. Borchers, Commun. Math. Phys. 179, 703-723 (1996)
  * (74) H. Casini, E. Teste and G. Torroba, J. Phys. A 50, no.36, 364001 (2017) doi:10.1088/1751-8121/aa7eaa [arXiv:1703.10656 [hep-th]].
  * (75) S. Balakrishnan, T. Faulkner, Z. U. Khandker and H. Wang, JHEP 09, 020 (2019) doi:10.1007/JHEP09(2019)020 [arXiv:1706.09432 [hep-th]].
  * (76) R. Jefferson, SciPost Phys. 6, no.4, 042 (2019) doi:10.21468/SciPostPhys.6.4.042 [arXiv:1811.08900 [hep-th]].
  * (77) H. J. Borchers and J. Yngvason, J. Math. Phys. 40, 601-624 (1999) [arXiv:math-ph/9805013 [math-ph]].
  * (78) H. J. Borchers, Letters in Mathematical Physics 44, 4 (1998)
  * (79) H. J. Borchers, Letters in Mathematical Physics 27, 4 (1993)
  * (80) R. Bousso, B. Freivogel, S. Leichenauer, V. Rosenhaus and C. Zukowski, Phys. Rev. D 88, 064057 (2013) doi:10.1103/PhysRevD.88.064057 [arXiv:1209.4641 [hep-th]].
  * (81) S. Farid Khwaja and A. B. Olde Daalhuis, Analysis and Applications 12, 6 (2014)
  * (82) G. N. Watson, Theory of Bessel Functions, Cambridge University Press, Cambridge (1952)
  * (83) A. P. Prudnikov, I. A. Brychkov and O. I. Marichev, Integrals and series: more special function (Vol. 3), CRC Press (1986)
  * (84) M. J. Schlosser, Multiple hypergeometric series: Appell series and beyond, Springer, Vienna (2013)


# Modeling long-term photometric data of trans-Neptunian objects and Centaurs

Estela Fernández-Valenzuela 1,∗

###### Abstract

Trans-Neptunian objects and Centaurs are small solar system bodies that reside
in the outer parts of the solar system. These objects present photometric
behaviours that are influenced due to a change in their aspect angle. Using
absolute photometric measurements and rotational light-curves at different
location on their orbits allow to model their photometric behaviour and obtain
physical properties such as pole orientation, shape, density, and even
detecting different peculiarities as departure from hydrostatic equilibrium or
rings. In this work, I present how these models are performed in order to
extract different physical properties. A review of the objects for which their
long-term photometric behaviour has been modeled is also given.

## 1

##  2 Keywords:

TNOs, Centaurs, imaging, long-term variability

##  3 Introduction

Trans-Neptunian Objects (TNOs) are small solar system bodies that orbit the
Sun with orbital semi-major axes larger than that of Neptune but smaller than
where the Oort Cloud begins (Oort, 1950; Gladman et al., 2008). They were
formed outside of the frost line, namely, far enough from the Sun so that
chemical compounds with low sublimation points (i.e., ices such as N2, CO,
CH4) were able to survive and condensate to form these objects. TNOs are
therefore composed of a mixture of ices and silicates incorporated as grains
during accretion from the solar nebula. Due to their large distances that
separate them from the Sun, TNOs have undergone few thermo-chemical processes
when compared to other small bodies in the solar system. Hence, in some sense,
these objects are time-capsules containing almost pristine material from when
the solar system was formed. Thus, the study of TNOs provides important
information about the primitive solar nebula.

When studying TNOs, it is also common to include the so-called Centaurs
because these objects originally formed and have spent most of their life-time
in the trans-Neptunian region (Horner et al., 2004), but have been injected
into inner parts of the solar system due to planetary encounters, mostly with
Neptune (Fernandez, 1980). Therefore, Centaurs present an excellent
opportunity to study smaller trans-Neptunian objects much closer to the Earth,
providing a better characterization of their physical properties.

###  3.1 Synopsis on TNOs formation

Current theoretical models suggest that the formation of planetesimals in the
trans-Neptunian region was driven through the streaming instability, achieving
up to $\sim 100$ km in size (Johansen et al., 2015; Simon et al., 2016). These
planetesimals would initially have a phase of collisional coagulation, with
the largest objects acquiring a size of 300 – 400 km in radius (Lambrechts and
Morbidelli, 2016), and then those bodies would accrete individual pebbles
(Lambrechts and Johansen, 2014; Lambrechts and Morbidelli, 2016). These
physical processes are able to reproduce the primordial size distribution in
the trans-Neptunian disk (Morbidelli and Nesvorný, 2020). Then, the massive
disk phase took place, during which collisional activity was very intense
(Morbidelli and Rickman, 2015), and TNOs suffered strong impacts that, without
complete disruption, would convert them into gravitational aggregates. This
implies that TNOs $>100$ km can be treated as a fluid in a first
approximation.

###  3.2 Equilibrium shapes for homogeneous bodies

A fluid, under the assumption of hydrostatic equilibrium with null angular
momentum, $L$, would adopt a spherical shape with semi-axes $a$, $b$, and $c$
(where $a=b=c$, see left panel in figure 1). If the fluid rotates, i.e.,
$L\neq 0$, the fluid would adopt a MacLaurin spheroid shape (with $a=b>c$).
This happens until $L=0.302\times(GM^{3}\overline{a})^{1/2}$, where $G$ is the
gravitational constant, $M$ is the mass of the fluid and $\overline{a}$ is the
radius of a sphere of the same mass as the spheroid or ellipsoid that is given
by $(a^{2}c)^{1/3}$, or $(abc)^{1/3}$, respectively. Beyond this point, the
fluid can adopt a Jacobi ellipsoid shape (with $a>b>c$), as described with the
mathematical formalism of Chandrasekhar (1969).

Figure 1: Equilibrium shapes for homogeneous bodies.

##  4 Short-term variability of TNOs and Centaurs

In order to understand the long-term photometric evolution of TNOs and
Centaurs, first, we need to understand short-term variability and the reasons
behind the different behaviors. The short-term variability of TNOs and
Centaurs (and small bodies in general) is generally produced by the body’s
rotational modulation, and it is commonly recognized as its rotational light-
curve. It is also possible that the short-term variability might be caused by
a binary system when one of the components is being occulted by the other,
however, this would not be a rotational light-curve, because the variability
would not be due to the rotational modulation of the object. Note that these
light curves have specific shapes that differ from those explained below and
should be carefully analyzed as explained in Harris and Warner (2020). The
rotational light-curve of a small body is generally due to albedo variability
on the surface, a non-spherical body shape, or a combination of both.
Specifically, for TNOs and Centaurs, due to their large sizes, tumbling
effects are not expected.

For MacLaurin spheroids, the rotational light-curve is expected to be
featureless or flat, i.e., with no variability, unless the object presents an
albedo spot (or several) that produces a variation in the amount of reflected
light by the surface. This is the case of the dwarf planet Pluto, with a
MacLaurin spheroid shape that presents a single-peaked rotational light-curve
induced by the large N2 albedo spot on its surface, although this case is
somewhat atypical since the variability produced by the albedo spot is of 0.26
mag in V-band (Buratti et al., 2003). We do not expect a variability larger
than 0.2 mag to be due to an albedo spot in asteroids (Degewij et al., 1979;
Magnusson, 1991). This value is even smaller for TNOs, which usually do not
produce variabilities larger than 0.1 mag due to albedo spots (Thirouin et
al., 2010). However, this is for objects much smaller than Pluto that are not
able to retain volatile material during large periods of time (i.e., over the
age of the solar system). Therefore, when the rotational light-curve presents
a large peak-to-valley amplitude (above 0.2 mag), it is common to think that
the variability is due to the body shape, with the rotational light-curve
presenting a double-peaked shape.

An inspection of the rotational light-curve is important to determine whether
the shape is double-peaked or single-peaked. For instance, a double-peaked
rotational light-curve presenting different depths among the minima and maxima
might indicate that a tri-axial shape is more likely than an oblate spheroid
with an albedo spot. This is the case of (20000) Varuna (e.g., Jewitt et al.,
2001; Fernández-Valenzuela et al., 2019), (84922) 2003 VS2 (Vara-Lubiano et
al., 2020), and (470599) 2008 OG19 (Fernández-Valenzuela et al., 2019), among
others. Note that detecting the difference between the brightness minima
and/or the brightness maxima of the rotational light-curve requires high
quality data, as is the case in the mentioned examples. In an opposite
scenario, we found Pluto. If we plot Pluto’s rotational light-curve doubling
its rotation period, the resulting rotational light-curve will present a
double-peaked shape with two identical minima and maxima. It is very unlikely
that a solar system object with a tri-axial shape would be identical along
with its rotational modulation, being this an indication of an object with a
single-peaked rotational light-curve due to an albedo spot.

For objects whose rotational light-curve is due to an albedo spot, i.e., a
single-peaked rotational light-curve, the amplitude will indicate the
difference in brightness produced by the different materials on their
surfaces. On the other hand, for objects whose rotational light-curve is due
to body shape, i.e., the amplitude of their rotational light-curve depends on
the axial ratios and the aspect angle of the body111The aspect angle of a
solar system body is defined as the angle between the line of sight and its
rotational axis as follows:

$\Delta
m=-2.5\log\left[\frac{b}{a}\left(\frac{a^{2}\cos^{2}(\delta)+c^{2}\sin^{2}(\delta)}{b^{2}\cos^{2}(\delta)+c^{2}\sin^{2}(\delta)}\right)^{1/2}\right]$
(1)

(e.g., Surdej and Surdej, 1978; Pospieszalska-Surdej and Surdej, 1985) where
$\Delta m$ is the peak-to-valley amplitude of the rotational light-curve,
$\delta$ is the aspect angle, and $a$, $b$ and $c$ are the semi-axes of the
tri-axial body (see figure 1). If we consider that the object has an aspect
angle of $90^{\circ}$, the equation will be simplified as:

$\Delta m=-2.5\log\left(\frac{b}{a}\right).$ (2)

However, a solar system object might present any aspect angle from 0 to
$180^{\circ}$, and therefore, from a single rotational light-curve it is only
possible to obtain an upper limit of the axes ratio $b/a$.

##  5 Long-term variability of TNOs and Centaurs

The long-term variability of a TNO or Centaur is generally due to a change in
the aspect angle of the body, $\delta$, which is given by the equation:

$\delta=\frac{\pi}{2}-\sin\left[\sin(\beta_{\rm e})\sin(\beta_{\rm
p})+\cos(\beta_{\rm e})\cos(\beta_{\rm p})\cos(\lambda_{\rm e}-\lambda_{\rm
p})\right],$ (3)

where $\beta_{\rm e}$ and $\lambda_{\rm e}$ are the ecliptic latitude and
longitude of the object reference frame and $\beta_{\rm p}$ and $\lambda_{\rm
p}$ are the ecliptic latitude and longitude of the pole orientation of the
body, i.e., the coordinates indicating the orientation (not
direction222Because TNOs and Centaurs are far from the Earth, it is only
possible to observe them at small phase angles (with a maximum of around
$2^{\circ}$ and $5^{\circ}$ for TNOs and Centaurs, respectively), and
therefore, the techniques used to obtain the direction of the rotational axis
in asteroids can not be carried out for objects beyond Jupiter.) of the
rotational axis. Therefore, observing rotational light-curves at different
orbit’s locations will result in different values of $\Delta m$, allowing the
obtainment of the pole orientation of the body, by fitting equations (1) and
(3) to the observational data. This method has been extensively use for
asteroids (Magnusson et al., 1989). However, for outer solar system objects,
this method was applied for the first time by Tegler et al. (2005) to the
Centaur (5145) Pholus. They used observations of Pholus in three different
epochs that produced three different values of Pholus’ rotational light-curve
amplitude (0.15, 0.39, and 0.60 mag published in Buie and Bus, 1992; Farnham,
2001; Tegler et al., 2005, respectively), obtaining two different pole
orientations (with their supplementary direction also possible) and the axial
ratios of Pholus tri-axial shape.

The change in the aspect angle does not only affect $\Delta m$, but also the
absolute magnitude, $H$333The absolute magnitude of a solar system body is the
apparent magnitude of the object when located at 1 au from the Sun, 1 au from
the Earth and 0∘ aspect angle., since the amount of area that is reflecting
light from the Sun of a tri-axial body varies with $\delta$. For a given epoch
(i.e., a specific $\delta$), the area of the body will be the average value
from the rotational modulation of the object, i.e.,

$A(\delta)=\frac{{\rm Area_{max}(\delta)}+{\rm Area_{min}(\delta)}}{2},$ (4)

where the maximum and minimum area exposed are given by the following
equations:

${\rm Area_{max}}=\pi\,a[b^{2}\cos^{2}(\delta)+c^{2}\sin^{2}(\delta)]^{1/2},$
(5)

and

${\rm Area_{min}}=\pi\,b[a^{2}\cos^{2}(\delta)+c^{2}\sin^{2}(\delta)]^{1/2}.$
(6)

Thus, the absolute magnitude is given by the equation:

$H=-M_{\odot}+2.5\log\left(\frac{\pi C^{2}}{pA(\delta)}\right),$ (7)

where $M_{\odot}$ is the absolute magnitude of the Sun, $C=1330\pm 18$ km is a
constant (Masiero et al., 2021), and $p$ is the geometric albedo of the
object.

The long-term variability of the absolute magnitude, in which a change of the
aspect angle is considered444We should not confuse this long-term variability,
that is driven by the change in the aspect angle, with changes of brightness
due to outburst or sudden cometary activity. Although some things can be done
in this regard, as we describe for the case of Chiron, this kind of activity
involves increase and decrease of brightness that behave completely different
from the ones we are describing here., was first modeled for the centaur
(10199) Chariklo in Duffard et al. (2014), where a compilation of $H$ values
from the literature was done. Duffard et al. (2014) found variability of 0.6
mag in a time span of 10 years. One might think that this $H$ magnitude
variability could be due to the rotational modulation of the object, if those
measurements were not corrected from it; however, this variability is much
larger than any of Chariklo’s rotational light-curve amplitudes found in the
literature (e.g., Peixinho et al., 2001; Fornasier et al., 2014). Therefore,
this change in magnitude could not be due to rotational variability but due to
a change in the aspect angle. From the stellar occultation produced by this
object in 2013, Braga-Ribas et al. (2014) obtained the tri-axial shape of the
object (i.e., values for $a$, $b$ and $c$) and two possible solutions for the
pole orientation (with their supplementary directions also possible). Using
those results, Duffard et al. (2014) found that only one of the solutions of
the pole orientation is compatible with the observational data. The case of
Chariklo is somewhat special since it possesses a ring system, which
contributes enormously to this variation in absolute magnitude. This is
because the variation of the exposed area of a ring is much larger than for a
tri-axial body (see panel c in figure 2 and section 6). In this case, equation
7 needs to be modified as follows:

$H=-M_{\odot}+2.5\log\left(\frac{\pi C^{2}}{pA(\delta)+p_{\rm R}A_{\rm
R}(\delta)}\right),$ (8)

where $p_{\rm R}$ is the ring’s albedo and $A_{\rm R}=\pi R^{2}|\cos(\delta)|$
is the area of the ring as a function of the aspect angle. Currently, there
are four Centaurs and one TNO for which their long-term photometric behavior
has been modeled: Pholus (Tegler et al., 2005), Chariklo (Duffard et al.,
2014), (2060) Chiron (Ortiz et al., 2015), (54598) Bienor (Fernández-
Valenzuela et al., 2017), and Varuna (Fernández-Valenzuela et al., 2019). For
those objects, shape, pole orientation and, more importantly, density have
been obtained, with the exception of Chiron, for which its past comae behavior
prevented from obtaining a good constrain of its shape, and, therefore, only
allowing an estimation of the density).

Density is one of the most important properties to understand the interiors of
the small bodies in the solar system, and obtaining statistically meaningful
results is pivotal for comprehending the solar system formation and evolution.
However, measuring density in small objects on the outer system is
challenging. Density is usually obtained by studying binary systems or objects
hosting satellites, but at the distances at which TNOs are found, the
separation is generally too small to resolve the system and obtain its orbital
properties. The Hubble Space Telescope (HST) was very successful when the High
Resolution Camera was available. Currently, the Wide Field Camera on board HST
can resolve objects separated over 0.04”, which is very limited for distances
over 30 au. The James Webb Space Telescope (JWST) might provide a better
resolution with NIRCam thanks to the exquisite Point Spread Function, but this
needs still to be evaluated once the JWST is working. In any case, this
technique is biased towards finding satellites or binary systems separated by
at least the resolution of the instrument from which they are observed.

For single objects, studying the shape and rotation state is the only way to
measure their density from ground-based observations. Good estimations can be
obtained through the study of rotational light-curves (see, for instances,
Tancredi and Favre, 2008; Rambaux et al., 2017). However, the combination of
multi-chord stellar occultations with rotational light-curves would provide
the most accurate results. Rotational light-curves are needed not only to
measure the rotation period but also to obtain the rotational phase at which
the stellar occultation occurs, thus providing the three-dimensional shape of
the object. However, the statistic suggests that in order to observe a multi-
chord stellar occultation, it is required to have at least 15 different
observing sites distributed along the shadow path, which is not always
possible (Ortiz et al., 2020).

An alternative technique would be the study of the long-term photometric
behavior, fitting observational data and obtaining not only the pole
orientation but also the shape (i.e., axial ratios). Due to the distances at
which TNOs and Centaurs orbit the Sun, this technique has the inconvenience of
requiring measurements taken with a time span in the order of decades. This
is, the arc of the orbit traveled by the object needs to be large enough to
produce a significant change in its aspect angle. Currently, it has been
almost 30 years since the first TNO, 1992 QB1 (without considering Pluto), was
discovered (Jewitt and Luu, 1993) and the community has accumulated enough
data of some objects that this might be a solution to obtain statistically
meaningful results for the outer solar system. This technique would also
require us to assume hydrostatic equilibrium in order to obtain the density of
these objects, however, as we discuss in section 3.1, this seems to be a
reasonable solution.

##  6 Extracting peculiarities from long-term variability

The long-term photometric data can serve as indications of different
peculiarities, such as rings, in small bodies. Rings are located in the
equator of the body, presenting very similar pole orientations (i.e., errors
related to assuming the same pole orientation for the host body and the rings
are negligible for our purpose). Both absolute magnitude and amplitude of the
rotational light-curve will be affected if the body presents a ring (or
rings). In the case of the absolute magnitude, when the system is found in an
edge-on orientation, i.e., the aspect angle is close to $90^{\circ}$, the area
reflecting light from the ring is negligible, with almost all the light being
reflected by the host body. As the aspect angle changes to smaller values, the
ring’s area that is reflecting light increases, and starts to play an
important role. When the system is found in a pole-on orientation, i.e., the
aspect angle is close to $0^{\circ}$, the rings’ area is maximized
contributing to a large percentage of the total brightness. Figure 2 (a) shows
a comparison between the expected evolution of Chariklo’s absolute magnitude
when no ring system is included (in red) and with the ring system (in blue).
It can be seen how, where the system is close to $90^{\circ}$ or an edge-on
orientation, both models agree in the expected absolute magnitude (around the
years 1980 and 2008, see panel c for the evolution of the aspect angle); while
for the rest of the epochs, the rings are increasing enormously the brightness
of the system. In the case of $\Delta m$ (figure 2 b), the rings produce a
shield effect when measuring $\Delta m$, resulting in a slightly smaller
amplitude of what it is expected for a Jacobi ellipsoid shape.

Chiron presents a similar long-term photometric behavior as Chariklo but with
a more complex scenario due to its cometary activity back in the 70s (e.g.,
Kowal, 1979; Tholen et al., 1988; Meech and Belton, 1990). Chiron’s absolute
magnitude was affected not only by the rings but also by the reflected light
from the comae at that time. This was modeled in Ortiz et al. (2015) that
included an exponential brightness decay for the comae behavior (see figure 7
in Ortiz et al., 2015). The later work analyzed several stellar occultations
produced by Chiron in different years and once again the long-term photometric
models helped to distinguish between the two pole orientations offered by the
analysis of the stellar occultations. Later, Cikota et al. (2018) obtained new
data for both $H$ and $\Delta m$ compatible with the prediction of the models
in Ortiz et al. (2015).

Figure 2: Comparison of Chariklo’s models for the absolute magnitude (a) and
the amplitude (b), with and without the ring system. Dark blue circles and
arrows (upper limits) represent observational data from the literature, see
Duffard et al. (2014), and references therein for panel (a); and Davies et al.
(1998); Peixinho et al. (2001); Galiazzo et al. (2016); Fornasier et al.
(2014); Leiva et al. (2017) for panel (b). Panel (c) provides the aspect angle
of Chariklo over one orbital period.

In the cases of Chiron and Chariklo, rings and cometary active were found
prior to the fit of the long-term models, but it is clear that the absolute
magnitude is highly affected by different characteristics that the body can
host and long-term photometric data can show deviations from a simple
hydrostatic equilibrium. This is the case for the centaur Bienor, for which
its photometric behavior clearly deviates from that of a simple Jacobi
ellipsoid shape (Fernández-Valenzuela et al., 2017). Different scenarios were
studied by Fernández-Valenzuela et al. (2017), including rings, albedo
variability, and shapes out the hydrostatic equilibrium. Although the
different models can not be statistically ruled out (tables in Fernández-
Valenzuela et al., 2017), it is clear that Bienor possesses some peculiarity
yet to be discovered.

To date, only three small Solar System bodies have been discovered to posses
rings: Chariklo (Braga-Ribas et al., 2014), Chiron (Ortiz et al., 2015;
Ruprecht et al., 2015), and Haumea (Ortiz et al., 2017). The discovery of
rings has opened a new brand of research in planetary science. Although some
theories have been proposed for their formation, being collisions and
rotational disruptions the most plausible scenarios (see Braga-Ribas et al.,
2014; Ortiz et al., 2015; Melita et al., 2017; Sicardy et al., 2019, and
references therein), it is still not clear how they form and survive,
specially for Centaurs that have suffered “recent” planetary encounters, or
how common these features are in the outer solar region. Detecting more ring
systems is mandatory to answer these open questions, however their detection
is extremely difficult, with the only known ground-based method to date being
stellar occultations (which would require instrumental deployment in anywhere
on the Earth, depending on where the shadow of the object is produced). A
careful study of existing databases and analysis of long-term photometric data
can point out what targets might be the most interesting in order to put our
effort in specific campaigns for stellar occultation events, to have a
selection of targets to be observed with the future James Webb Space
Telescope, or even visited by future spacecraft missions.

##  7 Conclusions

Long-term photometric measurements can be used to obtain different physical
properties of TNOs and Centaurs, when the variability is driven by the change
of the aspect angle of the object. Currently, this modellization has only been
performed for four Centaurs and one TNO for which pole orientation, shape and
density have been obtained (with the exception of Chiron for which density was
only estimated due to its comae behaviour). Density is one of the most
important properties about solar system objects, yet is one of the most
difficult. To date, no more than 20 objects have density values with relative
small uncertainties (e.g., Kiss et al., 2019). A larger number of objects with
accurate density values is crucial to understand the evolution of the trans-
Neptunian region and the material from the primitive solar nebula that was
incorporated into TNOs at the time of their formation, and would help
interpreting the collisional history in the outer solar system (Barr and
Schwamb, 2016; Bierson and Nimmo, 2019).

Other peculiarities, such as shape out of the hydrostatic equilibrium, rings
or satellites can be inferred by analyzing the long-term variability of TNOs
and Centaurs. Specially, rings extremely influence the absolute magnitude of
the system, and therefore, exploring existing data of different objects
whether in databases (as the Small Body Node within the Planetary Data
System), or current and future surveys (e.g., the Vera Rubing Survey
Telescope) might result in a source of targets in which to hunt these
features; for instance, for dedicated campaigns to predict stellar
occultations or even spacecraft visits. Specific campaigns to find more rings
around small bodies are pivotal to statistically analyse how common these
features are, and therefore, to understand their formation and survival around
small bodies.

## Acknowledgments

E. F.-V. acknowledges financial support from the Florida Space Institute and
the Space Research Initiative. E. F.-V. acknowledges Dr. Alvaro Alvarez-Candal
and Dr. Yan Fernandez for their useful comments that help to improve this
manuscript.

## References

  * Barr and Schwamb (2016) Barr, A. C. and Schwamb, M. E. (2016).  Interpreting the densities of the Kuiper belt’s dwarf planets.  _MNRAS_ 460, 1542–1548.  10.1093/mnras/stw1052
  * Bierson and Nimmo (2019) Bierson, C. J. and Nimmo, F. (2019).  Using the density of Kuiper Belt Objects to constrain their composition and formation history.  _Icarus_ 326, 10–17.  10.1016/j.icarus.2019.01.027
  * Braga-Ribas et al. (2014) Braga-Ribas, F., Sicardy, B., Ortiz, J. L., Snodgrass, C., Roques, F., Vieira-Martins, R., et al. (2014).  A ring system detected around the Centaur (10199) Chariklo.  _Nature_ 508, 72–75.  10.1038/nature13155
  * Buie and Bus (1992) Buie, M. W. and Bus, S. J. (1992).  Physical observations of (5145) Pholus.  _Icarus_ 100, 288–294.  10.1016/0019-1035(92)90101-C
  * Buratti et al. (2003) Buratti, B. J., Hillier, J. K., Heinze, A., Hicks, M. D., Tryka, K. A., Mosher, J. A., et al. (2003).  Photometry of pluto in the last decade and before: evidence for volatile transport?  _Icarus_ 162, 171–182.  10.1016/S0019-1035(02)00068-4
  * Chandrasekhar (1969) Chandrasekhar, S. (1969).  _Ellipsoidal figures of equilibrium_ (Yale University Press)
  * Cikota et al. (2018) Cikota, S., Fernández-Valenzuela, E., Ortiz, J. L., Morales, N., Duffard, R., Aceituno, J., et al. (2018).  Activity of (2060) Chiron possibly caused by impacts?  _MNRAS_ 475, 2512–2518.  10.1093/mnras/stx3352
  * Davies et al. (1998) Davies, J. K., McBride, N., Ellison, S. L., Green, S. F., and Ballantyne, D. R. (1998).  Visible and Infrared Photometry of Six Centaurs.  _Icarus_ 134, 213–227.  10.1006/icar.1998.5931
  * Degewij et al. (1979) Degewij, J., Tedesco, E. F., and Zellner, B. (1979).  Albedo and color contrasts on asteroid surfaces.  _Icarus_ 40, 364–374.  10.1016/0019-1035(79)90029-0
  * Duffard et al. (2014) Duffard, R., Pinilla-Alonso, N., Ortiz, J. L., Alvarez-Candal, A., Sicardy, B., Santos-Sanz, P., et al. (2014).  Photometric and spectroscopic evidence for a dense ring system around Centaur Chariklo.  _A &A_ 568, A79.  10.1051/0004-6361/201424208
  * Farnham (2001) Farnham, T. L. (2001).  The Rotation Axis of the Centaur 5145 Pholus.  _Icarus_ 152, 238–245.  10.1006/icar.2001.6656
  * Fernandez (1980) Fernandez, J. A. (1980).  On the existence of a comet belt beyond Neptune.  _MNRAS_ 192, 481–491.  10.1093/mnras/192.3.481
  * Fernández-Valenzuela et al. (2017) Fernández-Valenzuela, E., Ortiz, J. L., Duffard, R., Morales, N., and Santos-Sanz, P. (2017).  Physical properties of centaur (54598) Bienor from photometry.  _MNRAS_ 466, 4147–4158.  10.1093/mnras/stw3264
  * Fernández-Valenzuela et al. (2019) Fernández-Valenzuela, E., Ortiz, J. L., Morales, N., Santos-Sanz, P., Duffard, R., Aznar, A., et al. (2019).  The Changing Rotational Light-curve Amplitude of Varuna and Evidence for a Close-in Satellite.  _ApJ_ 883, L21.  10.3847/2041-8213/ab40c2
  * Fornasier et al. (2014) Fornasier, S., Lazzaro, D., Alvarez-Candal, A., Snodgrass, C., Tozzi, G. P., Carvano, J. M., et al. (2014).  The Centaur 10199 Chariklo: investigation into rotational period, absolute magnitude, and cometary activity.  _A &A_ 568, L11.  10.1051/0004-6361/201424439
  * Galiazzo et al. (2016) Galiazzo, M., de la Fuente Marcos, C., de la Fuente Marcos, R., Carraro, G., Maris, M., and Montalto, M. (2016).  Photometry of Centaurs and trans-Neptunian objects: 2060 Chiron (1977 UB), 10199 Chariklo (1997 CU26), 38628 Huya (2000 EB173), 28978 Ixion (2001 KX76), and 90482 Orcus (2004 DW).  _Ap &SS_ 361, 212.  10.1007/s10509-016-2801-5
  * Gladman et al. (2008) Gladman, B., Marsden, B. G., and Vanlaerhoven, C. (2008).  _Nomenclature in the Outer Solar System_.  43
  * Harris and Warner (2020) Harris, A. and Warner, B. D. (2020).  Asteroid lightcurves: Can’t tell a contact binary from a brick.  _Icarus_ 339, 113602.  10.1016/j.icarus.2019.113602
  * Horner et al. (2004) Horner, J., Evans, N. W., and Bailey, M. E. (2004).  Simulations of the population of Centaurs - I. The bulk statistics.  _MNRAS_ 354, 798–810.  10.1111/j.1365-2966.2004.08240.x
  * Jewitt et al. (2001) Jewitt, D., Aussel, H., and Evans, A. (2001).  The size and albedo of the Kuiper-belt object (20000) Varuna.  _Nature_ 411, 446–447
  * Jewitt and Luu (1993) Jewitt, D. and Luu, J. (1993).  Discovery of the candidate Kuiper belt object 1992 QB1.  _Nature_ 362, 730–732.  10.1038/362730a0
  * Johansen et al. (2015) Johansen, A., Mac Low, M.-M., Lacerda, P., and Bizzarro, M. (2015).  Growth of asteroids, planetary embryos, and Kuiper belt objects by chondrule accretion.  _Science Advances_ 1, 1500109.  10.1126/sciadv.1500109
  * Kiss et al. (2019) Kiss, C., Marton, G., Parker, A. H., Grundy, W. M., Farkas-Takács, A., Stansberry, J., et al. (2019).  The mass and density of the dwarf planet (225088) 2007 OR10.  _Icarus_ 334, 3–10.  10.1016/j.icarus.2019.03.013
  * Kowal (1979) Kowal, C. T. (1979).  _Chiron._ (Gehrels, Tom and Matthews, Mildred Shapley).  436–439
  * Lambrechts and Johansen (2014) Lambrechts, M. and Johansen, A. (2014).  Forming the cores of giant planets from the radial pebble flux in protoplanetary discs.  _A &A_ 572, A107.  10.1051/0004-6361/201424343
  * Lambrechts and Morbidelli (2016) Lambrechts, M. and Morbidelli, A. (2016).  Reconstructing the size distribution of the small body population in the Solar System.  In _AAS/Division for Planetary Sciences Meeting Abstracts #48_. vol. 48 of _AAS/Division for Planetary Sciences Meeting Abstracts_ , 105.08
  * Leiva et al. (2017) Leiva, R., Sicardy, B., Camargo, J. I. B., Ortiz, J. L., Desmars, J., Bérard, D., et al. (2017).  Size and Shape of Chariklo from Multi-epoch Stellar Occultations.  _AJ_ 154, 159.  10.3847/1538-3881/aa8956
  * Magnusson (1991) Magnusson, P. (1991).  Analysis of asteroid lightcurves. III. Albedo variegation.  _A &A_ 243, 512–520
  * Magnusson et al. (1989) Magnusson, P., Barucci, M. A., Drummond, J. D., Lumme, K., Ostro, S. J., Surdej, J., et al. (1989).  Determination of pole orientations and shapes of asteroids.  In _Asteroids II_ , eds. R. P. Binzel, T. Gehrels, and M. S. Matthews. 66–97
  * Masiero et al. (2021) Masiero, J. R., Wright, E. L., and Mainzer, A. K. (2021).  Uncertainties on Asteroid Albedos Determined by Thermal Modeling.  _PSJ_ 2, 32.  10.3847/PSJ/abda4d
  * Meech and Belton (1990) Meech, K. J. and Belton, M. J. S. (1990).  The Atmosphere of 2060 Chiron.  _AJ_ 100, 1323.  10.1086/115600
  * Melita et al. (2017) Melita, M. D., Duffard, R., Ortiz, J. L., and Campo-Bagatin, A. (2017).  Assessment of different formation scenarios for the ring system of (10199) Chariklo.  _A &A_ 602, A27.  10.1051/0004-6361/201629858
  * Morbidelli and Nesvorný (2020) Morbidelli, A. and Nesvorný, D. (2020).  _Kuiper belt: formation and evolution_ (Prialnik, Dina and Barucci, Maria Antoinetta and Young, Leslie).  25–59.  10.1016/B978-0-12-816490-7.00002-3
  * Morbidelli and Rickman (2015) Morbidelli, A. and Rickman, H. (2015).  Comets as collisional fragments of a primordial planetesimal disk.  _A &A_ 583, A43.  10.1051/0004-6361/201526116
  * Oort (1950) Oort, J. H. (1950).  The structure of the cloud of comets surrounding the Solar System and a hypothesis concerning its origin.  _Bain_ 11, 91–110
  * Ortiz et al. (2015) Ortiz, J. L., Duffard, R., Pinilla-Alonso, N., Alvarez-Candal, A., Santos-Sanz, P., Morales, N., et al. (2015).  Possible ring material around centaur (2060) Chiron.  _A &A_ 576, A18.  10.1051/0004-6361/201424461
  * Ortiz et al. (2017) Ortiz, J. L., Santos-Sanz, P., Sicardy, B., Benedetti-Rossi, G., Bérard, D., Morales, N., et al. (2017).  The size, shape, density and ring of the dwarf planet Haumea from a stellar occultation.  _Nature_ 550, 219–223.  10.1038/nature24051
  * Ortiz et al. (2020) Ortiz, J. L., Sicardy, B., Camargo, J. I. B., Santos-Sanz, P., and Braga-Ribas, F. (2020).  _Stellar occultation by TNOs: from predictions to observations_.  413–437.  10.1016/B978-0-12-816490-7.00019-9
  * Peixinho et al. (2001) Peixinho, N., Lacerda, P., Ortiz, J. L., Doressoundiram, A., Roos-Serote, M., and Gutiérrez, P. J. (2001).  Photometric study of Centaurs 10199 Chariklo (1997 CU26) and 1999 UG5.  _A &A_ 371, 753–759.  10.1051/0004-6361:20010382
  * Pospieszalska-Surdej and Surdej (1985) Pospieszalska-Surdej, A. and Surdej, J. (1985).  Determination of the pole orientation of an asteroid - The amplitude-aspect relation revisited.  _A &A_ 149, 186–194
  * Rambaux et al. (2017) Rambaux, N., Baguet, D., Chambat, F., and Castillo-Rogez, J. C. (2017).  Equilibrium Shapes of Large Trans-Neptunian Objects.  _ApJ_ 850, L9.  10.3847/2041-8213/aa95bd
  * Ruprecht et al. (2015) Ruprecht, J. D., Bosh, A. S., Person, M. J., Bianco, F. B., Fulton, B. J., Gulbis, A. A. S., et al. (2015).  29 November 2011 stellar occultation by 2060 Chiron: Symmetric jet-like features.  _Icarus_ 252, 271–276.  10.1016/j.icarus.2015.01.015
  * Sicardy et al. (2019) Sicardy, B., Leiva, R., Renner, S., Roques, F., El Moutamid, M., Santos-Sanz, P., et al. (2019).  Ring dynamics around non-axisymmetric bodies with application to Chariklo and Haumea.  _Nature Astronomy_ 3, 146–153.  10.1038/s41550-018-0616-8
  * Simon et al. (2016) Simon, J. B., Armitage, P. J., Li, R., and Youdin, A. N. (2016).  The Mass and Size Distribution of Planetesimals Formed by the Streaming Instability. I. The Role of Self-gravity.  _ApJ_ 822, 55.  10.3847/0004-637X/822/1/55
  * Surdej and Surdej (1978) Surdej, A. and Surdej, J. (1978).  Asteroid lightcurves simulated by the rotation of a three-axes ellipsoid model.  _A &A_ 66, 31–36
  * Tancredi and Favre (2008) Tancredi, G. and Favre, S. (2008).  Which are the dwarfs in the Solar System?  _Icarus_ 195, 851–862.  10.1016/j.icarus.2007.12.020
  * Tegler et al. (2005) Tegler, S. C., Romanishin, W., Consolmagno, G. J., Rall, J., Worhatch, R., Nelson, M., et al. (2005).  The period of rotation, shape, density, and homogeneous surface color of the Centaur 5145 Pholus.  _Icarus_ 175, 390–396.  10.1016/j.icarus.2004.12.011
  * Thirouin et al. (2010) Thirouin, A., Ortiz, J. L., Duffard, R., Santos-Sanz, P., Aceituno, F. J., and Morales, N. (2010).  Short-term variability of a sample of 29 trans-Neptunian objects and Centaurs.  _A &A_ 522, A93.  10.1051/0004-6361/200912340
  * Tholen et al. (1988) Tholen, D. J., Hartmann, W. K., Cruikshank, D. P., Lilly, S., Bowell, E., and Hewitt, A. (1988).  (2060) Chiron.  _IAU Circ._ 4554, 2
  * Vara-Lubiano et al. (2020) Vara-Lubiano, M., Benedetti-Rossi, G., Santos-Sanz, P., Ortiz, J. L., Sicardy, B., Popescu, M., et al. (2020).  The 2019 October 22nd multi-chord stellar occultation by (84922) 2003 VS2.  In _European Planetary Science Congress_. EPSC2020–1041