Bluetooth 6: Channel Sounding and the End of Finding

01 How Bluetooth Decides Something Is "Nearby" Today

Bluetooth has always lived close: a short-range standard shuffling data between fixed and mobile devices in the 2.402-to-2.480 gigahertz ISM band, building personal area networks as an alternative to cables. In its most widely used mode, transmit power is capped at 2.5 milliwatts, giving a practical range of up to about 10 meters. Proximity is the whole premise — headphones, car stereos, file transfers, wearables, all assuming that if you can hear it, it is close to you.

But the standard has never actually measured "close." Received signal strength indication — RSSI — tells a device how loud the other radio sounds, and loudness is a terrible proxy for distance. A wall, a pocket, a hand over the antenna, a battery low enough to sag transmit power: all of them change the number without moving the device an inch. The ecosystem spent two decades inferring distance from a volume knob.

Bluetooth Low Energy made the problem worse by multiplying the use cases. The BLE variant — designed by the Bluetooth SIG for healthcare, fitness, beacons, security, and home entertainment, with considerably reduced power draw — gave us proximity keys, presence-triggered lighting, find-my tags, and smart locks. Every one of those trusts the loudness heuristic, and every one inherits its blind spots.

02 What Channel Sounding Measures

Bluetooth Core Specification 6.0, released in September 2024, replaced the guesswork. Channel sounding is a ranging procedure: two devices actively measure the distance between themselves, rather than inferring it. Two complementary methods do the work. Phase-based ranging sends a swept sequence of tones across many channels and measures how the phase rotates — a signal that repeats with a period tied directly to physical distance. Round-trip time, the second method, timestamps packets in both directions and computes distance from the round trip at the speed of light, with the radios' internal processing delays calibrated out.

Vendor implementations report accuracy in the ten-centimeter class — a striking figure next to meters-class RSSI guesses, though it belongs to the vendors' own measurements under favorable conditions rather than an independent benchmark. More important than the headline precision is the property both methods share: the measurement is of the radio channel itself, not of an advertisement packet's loudness, and it happens between two authenticated devices.

The two methods also cross-check each other. Phase-based ranging is precise indoors, where multipath reflections make timing methods sloppy, while round-trip time is harder to fool and degrades more gracefully. Implementations may use either or both, which is why the specification treats channel sounding as a framework rather than a single algorithm.

03 The Relay Attack That Broke Proximity

Here is the flaw that loudness-based proximity never could fix. A relay attack places one radio near your phone and another near your car, then dutifully forwards every packet between them. The phone believes it is next to the car, the car believes it is next to the phone, and the lock opens for a thief standing forty meters away holding the repeater. The signal is genuine, the cryptography checks out, and the only thing that lied was the assumption that signal strength equals distance.

Researchers demonstrated this against real keyless systems throughout the 2010s, and the pattern generalizes: any security decision based on "the signal is strong, so the device must be nearby" is a decision based on a guess. Relay attacks are not a bug in any particular implementation. They are what happens when proximity is inferred rather than measured, and no amount of firmware patching fixes an inference.

Distance bounding is the classical answer: prove an upper bound on distance, mathematically, from the physics of the round trip. Channel sounding is Bluetooth's industrial-scale deployment of exactly that idea — and it is the security story, not the convenience story, that made the SIG pull ranging into the core specification at all.

04 Why Ten-Centimeter Awareness Changes Keys

Digital car keys are the flagship application. The Car Connectivity Consortium's Digital Key program had already layered authentication on top of BLE, and the missing piece was a trustworthy distance measurement between phone and vehicle. Channel sounding supplies it: the car can demand that the unlocking phone be within a few meters — measured, not guessed — before it releases the door, and the phone can verify it is talking to the car it is actually touching.

The same logic upgrades the smart-lock ecosystem. Today's BLE locks commonly require pressing a button or carrying a fob because passive unlocking is too risky when proximity is a guess. With measured distance, a lock can safely open only when the authorized phone is within arm's reach — and refuse it through a door when it is on the other side of the wall, a scenario that loudness-based systems cannot reliably distinguish.

There is a governance detail worth noticing: the Bluetooth SIG owns the specification, but deployment keys come from ecosystem bodies — the Car Connectivity Consortium for vehicles, lock vendors for homes. Channel sounding landed in the core in 2024; the ecosystems that consume it move on their own, slower clocks.

05 The Power-Cost Question

Ranging is not free. Channel sounding needs two-way exchange — swept tones across dozens of channels, packet timestamps, cryptographic protection on each round — and every one of those is airtime, which is battery. BLE exists because it spends so little; a feature that turns the radio on more often must earn its keep.

The specification's design shows the worry. Channel sounding is a security procedure, not an always-on beacon: devices invoke it when a proximity decision matters, not continuously. Antenna-path counting, mode selection, and how many channels to sound are all implementation choices, which lets a digital car key ranging ten times a minute use far less energy than a find-my tag polling constantly.

Still, the honest answer for battery-constrained tags is that the cost is real and the early adopters will be phones and cars — devices with radios to spare — while coin-cell trackers will adopt ranging only where a vendor decides the security dividend justifies the drain. Expect uneven deployment, tuned per product category rather than uniform across the ecosystem.

06 The Slow Rollout Reality

Standards documents ship years before hardware does. Bluetooth 6.0 landed in September 2024, and the observable reality two years later is that channel sounding is still mostly a specification waiting for silicon and product decisions. Phone platforms were the first movers; accessory and lock makers follow the platform; and cars, with their long design cycles, will be last. A Core Specification version does not become a feature until two devices that both implement it are in the same room.

The rollout also has a two-sided dependency: the phone must sound the channel and the car, lock, or tag must support the same procedure — so early deployments will silently fall back to RSSI for years whenever one side is older hardware. Backward compatibility is a feature, but it means attackers can sometimes push a pairing back to the weaker path; security analysts will watch how implementations bind ranging results to the key protocol.

None of this is unusual. Direction finding arrived in 5.1 in 2019 and its mainstream uses are only now routine; 5.4's encrypted advertising is still climbing the adoption curve. Bluetooth features diffuse slowly, because the standard must serve the cheapest coin cell and the most expensive sedan with the same text.

07 What Distance Awareness Enables Next

Security is the headline, but measured distance is a general-purpose primitive. A phone that knows a tag is 0.4 meters away, not merely "nearby," can order the things around it: unlock the door as you reach it, transfer a file to the device you are actually facing, hand audio to the speaker you walked up to. The "find" in find-my stops being a proximity guess and becomes a geometry problem with real numbers attached.

Indoor positioning is the more speculative prize. Multiple channel-sounding anchors plus angle measurements give positions in space, not just ranges — the ingredient missing from asset tracking in warehouses, hospital equipment searches, and indoor navigation. Whether anyone builds the infrastructure for it is an open commercial question; the physics, at least, is now on the spec sheet.

The deeper shift is conceptual. For twenty-five years, Bluetooth devices negotiated a shared guess about how far apart they were, and the entire proximity economy — keys, locks, tags, triggers — ran on inference. Starting with Core Specification 6.0, they can measure. Security gets the relay-attack fix it needed for a decade, and everything else that leaned on loudness inherits a number it can finally trust. That is what a version bump buys this time — not speed, not range, but the end of guessing.