RF Wireless World

Browse articles, tutorials, tools, and vendors.

Bluetooth MAC Addresses: Public, Random & Identity Types

By RF Wireless Expert Team

In the Bluetooth ecosystem, every device must be identifiable. At the lowest level, this identity is represented by a 6-octet (48-bit) value. In Classic Bluetooth (BR/EDR), this is commonly known as the “BD_ADDR” (Bluetooth Device Address). However, with the introduction of Bluetooth Low Energy (LE), the concept of addressing became much more nuanced to support strict privacy requirements. The HCI specification of Bluetooth breaks down device addresses into several distinct types, primarily categorized into Public, Random, and Identity addresses.

1. Public Device Address

The Public Device Address is the standard, globally unique, hardware level address assigned to a Bluetooth Controller.

  • In Classic Bluetooth (BR/EDR): This is the permanent “BD_ADDR” programmed into the silicon by the manufacturer.
  • In Bluetooth Low Energy (LE): An LE device may also use a Public Device Address. The Host can retrieve its own physical address at any time using the “HCI_Read_BD_ADDR” command.
  • Absence of a Public Address: Interestingly, the specification notes that an LE-only Controller is not strictly required to have a factory assigned Public Device Address. If a Host requests the Public Address from an LE Controller that doesn’t have one, the Controller will simply return an address of all zeros (“0x000000000000”).

2. Random Device Address

Because broadcasting a permanent Public Address allows third parties to track a user’s location over time, Bluetooth LE introduced the Random Device Address.

Instead of using a hardcoded MAC address, the device generates a temporary 48-bit address. When the Controller sends an event to the Host (such as an “HCI_LE_Advertising_Report” when discovering nearby devices), it includes an “Address_Type” parameter.

  • If the Address_Type is 0x00, the reported address is a standard Public Address.
  • If the Address_Type is 0x01, the reported address is a Random Device Address.

3. Resolvable Private Addresses (RPA) and Identity Addresses

To make Random Addresses truly secure, Bluetooth uses cryptographic keys. This introduces the concept of the Resolvable Private Address (RPA) and its underlying Identity Address.

If a device constantly changes its Random Address to prevent tracking, how do paired devices (like a user’s smartphone and their smartwatch) recognize each other? They do this by utilizing an Identity Resolving Key (IRK).

When a device connects or broadcasts, it can use an RPA. To an outside observer, this looks like a random, meaningless address. However, when the receiving Bluetooth Controller intercepts this RPA, it checks its internal list of stored IRKs. If it finds a match, it “resolves” the private address back to the device’s true, underlying identity.

According to Bluetooth HCI specification, once the Controller successfully resolves an RPA, it reports the device to the Host using an Identity Address. The Bluetooth specification outlines two types of Identity Addresses:

  • Public Identity Address (Type 0x02): The Controller successfully used an IRK to resolve the incoming private address, and the device’s underlying, true identity is a standard Public Device Address.
  • Random (Static) Identity Address (Type 0x03): The Controller successfully resolved the private address, but the device’s underlying identity is a persistent, static Random Address (an address generated once per power cycle or lifetime, rather than a factory assigned one).

How the HCI Handles RPAs During Connections

The distinction between the temporary on-air address and the resolved identity is explicitly handled in connection events like “HCI_LE_Enhanced_Connection_Complete”.

When a secure, privacy enabled connection is formed, the Controller sends the Host detailed breakdown as follows.

  1. Peer_Address: The underlying Identity Address of the remote device.
  2. Peer_Resolvable_Private_Address: The actual, temporary RPA that the remote device broadcasted over the air.
  3. Local_Resolvable_Private_Address: The temporary RPA that your local Controller generated to hide its own identity during the connection process.

Note: If the Controller cannot resolve the private address, or if privacy features are not being used, these RPA fields are simply populated with all zeros.

Summary

  • Public Addresses are static, factory assigned identifiers.
  • Random Addresses are generated to hide the device’s identity.
  • Resolvable Private Addresses (RPAs) are cryptographically generated random addresses that change frequently.
  • Identity Addresses (which can be either Public or Random Static) are the true “resolved” identities that the Controller hands to the Host after it has successfully decrypted an RPA using an Identity Resolving Key (IRK).

References & Further Reading

  1. Bluetooth SIG : Bluetooth Core Specification Version 6.3, May 5, 2026.
  2. Bluetooth SIG : Bluetooth Core Specification change history
  3. Bluetooth SIG : Bluetooth Technology Overview

Continue Learning Bluetooth Basic Concepts

Continue Learning Bluetooth Technology

Compare Bluetooth With Other Technologies

Explore Deep Insight Bluetooth Technology

Keep Reading

Related Posts