When users wish to establish wireless radio communication between/among their devices, the channel has to be bootstrapped first. The process of setting up a secure communication channel between two previously unassociated devices is referred to as "Secure Device Pairing". The focus of prior research on this topic has mostly been limited to "personal pairing" scenarios, whereby a single user controls both the devices. In this paper, we instead consider "social pairing" scenarios, whereby two different users establish pairing between their respective devices. We present a comprehensive study to identify methods suitable for social pairing, and comparatively evaluate the usability and security of these methods. Our results identify methods best-suited for users, in terms of efficiency, error-tolerance and of course, usability. Our work provides insights on the applicability and usability of methods for emerging social pairing scenarios, a topic largely ignored so far.

ldquoSecure Device Pairingrdquo is the process of bootstrapping a secure channel between two previously unassociated devices over a (usually wireless) human-imperceptible communication channel. Lack of prior security context and common trust infrastructure open the door for Man-in-the-Middle (also known as Evil Twin) attacks. Mitigation of these attacks requires user involvement in the device pairing process. Prior research yielded a number of interesting methods utilizing various auxiliary human-perceptible channels, e.g., visual, acoustic or tactile. These methods engage the user in authenticating information exchanged over human-imperceptible channels, thus mitigating MiTM attacks and forming the basis for secure pairing. We present the first comprehensive comparative evaluation of notable secure device pairing methods. Our results identify methods best-suited for a given combination of devices and human abilities. This work is both important and timely, since it sheds light on usability in one of the very few settings where a wide range of users (not just specialists) are confronted with security techniques.