A standard nobody notices
Bluetooth LE sits in billions of devices. Headphones, smartwatches, industrial sensors, locks – everywhere. Hardly anyone thinks of it as a radio standard. Bluetooth LE is simply there, and only gets noticed when something goes wrong.
That is arguably the highest praise a communication protocol can earn. At the same time, it means real advances barely register in the market. And right now, a lot is happening. With the 6.x generation, Bluetooth LE has made a leap that has nothing to do with the usual promises of more range and more throughput. What it’s really about: precise positioning and fundamentally improved security.
What the 5.x generation delivered
Seven years, five versions, always the same approach: solve one concrete problem, leave the rest alone. That’s not a criticism – it’s usually the most sensible way to develop a standard.
5.0 (2016) was mostly about performance: double the data rate (2 Mbps), four times the range, up to 300 meters. For many industrial applications, this was the moment Bluetooth LE first became seriously interesting.
5.1 (2019) brought something conceptually new: direction finding. With Angle of Arrival (AoA) and Angle of Departure (AoD), devices could suddenly detect not just that a signal exists – but where it comes from. It sounds like a technical detail, but it laid the groundwork for everything that followed in positioning and security.
5.2 (2020) was the audio release. LE Audio with the more efficient LC3 codec, plus isochronous channels for synchronized data streams. On the security side: EATT (Enhanced Attribute Protocol) as a more resilient communication layer – less spectacular, but solid work.
5.3 (2021) was the release hardly anyone paid attention to, yet it matters enormously for wearables and IoT devices. Connection subrating saves battery by letting devices put a connection into an idle state without dropping it. And encryption key size control enforces minimum key lengths at connection setup, closing a common weakness few people had on their radar.
5.4 (2023) rounded off the 5.x generation. PAwR (Periodic Advertising with Responses) enables low-power communication with large device populations – think electronic shelf labels or large sensor networks. And for the first time, advertising data could be encrypted. Until then, beacon broadcasts were readable by anyone. A blind spot the industry had simply accepted for years.
Version 6.0 built directly on all of this – with a clear focus on what Bluetooth LE can now do for the first time: precise positioning and active protection against attacks.
Bluetooth 6.0 – the real leap
In September 2024, the Bluetooth SIG released version 6.0. The most important addition: Channel Sounding.
Channel Sounding: distance measurement at centimeter precision
Classic Bluetooth can estimate whether a device is nearby – via signal strength (RSSI). The problem: RSSI is coarse, prone to interference, and alarmingly easy to fool. Channel Sounding takes a fundamentally different approach.
It combines two measurement techniques: phase-based ranging measures the signal’s phase shift across multiple frequency channels, while round-trip timing captures the exact signal travel time. Together, the two methods achieve a positioning accuracy of roughly ten centimeters – over distances of theoretically up to 150 meters (more on that in a moment).
In practice, this means: smart locks that only open a door when the smartphone is actually in front of it – not somewhere in the hallway or in a bag ten meters away. Find-my systems that locate a lost device not just somewhere in the room, but under the sofa. Indoor navigation without depending on GPS.
Why this is above all a security question
Here is the point most coverage misses. Channel Sounding is not just a feature for better positioning – it is primarily a security mechanism.
The problem it solves is the relay attack. The principle is simple and has been known for years: one attacker stands next to the car, an accomplice sidles up to the owner in the supermarket queue. A small relay device intercepts the key fob’s signal and forwards it – the car believes the key is right beside it, and unlocks. Done. It takes seconds, and with classic RSSI-based Bluetooth there is no way to prevent it.
Channel Sounding makes this practically impossible. Why? Because light travels 30 centimeters per nanosecond and doesn’t get any faster, no matter how good the relay device is. Channel Sounding measures signal travel times at nanosecond resolution – every meter of detour through a relay device produces a measurable delay. You could get around this if you could transmit the signal faster than light. Unfortunately, that’s not possible.
Channel Sounding vs. UWB – a comparison worth making
Talk about precise radio positioning, and the question of UWB (ultra-wideband) inevitably comes up – the technology behind Apple AirTags and CarKey (Apple’s digital car key feature for iPhone and Apple Watch). On pure measurement accuracy, UWB wins: a few centimeters under ideal conditions, versus roughly ten centimeters for Channel Sounding.
But UWB always requires its own dedicated chip. That chip is expensive, takes up board space, and is missing from the vast majority of devices on the market. Channel Sounding, by contrast, is part of the Bluetooth 6.0 specification itself – build in a Bluetooth 6.0 chip with Channel Sounding support, and you get it with no extra hardware. No separate component, no extra cost, no board space.
Then there’s range: UWB works reliably up to about 50 meters, while Channel Sounding is specified for up to 150 meters – though, to be fair, solid real-world data is scarce; the first products have only been on the market since 2025.
UWB remains the better choice where absolute accuracy matters and dedicated hardware is not an issue. For everything else – by far the larger part of the IoT ecosystem – Channel Sounding is the more pragmatic solution.
Two more things 6.0 brought
Decision-based advertising filtering sounds unwieldy, but has a tangible effect: devices can filter advertising packets themselves instead of passing every hit up to the host processor. In dense IoT environments – warehouses, production floors, smart buildings – this cuts CPU load and power consumption considerably.
Monitoring advertisers allows passive observation of BLE devices without establishing a connection. Quite useful for presence detection in the smart home.
Bluetooth 6.1 – tracking protection gets serious
Version 6.1 appeared in May 2025, the first release in the Bluetooth SIG’s new six-month cycle. The central theme: protection against tracking.
The RPA problem
Bluetooth LE devices don’t broadcast a fixed MAC address. Instead, they use Resolvable Private Addresses (RPA) – addresses that look random and change regularly. Trusted devices can still recognize each other; strangers can’t track a device over time. That’s the theory.
The problem: up to 6.0, these addresses changed at fixed intervals, typically every 15 minutes. That is predictable enough to build correlation attacks on – observe long enough, and you can match the regular address changes against other signal characteristics and track a device anyway.
Bluetooth 6.1 solves this with randomized RPA timing: the address now changes at random intervals – by default somewhere between 8 and 15 minutes, configurable shorter or longer if needed (1 second to 1 hour). That makes correlation attacks considerably harder.
A side effect: since the Bluetooth controller computes the new address internally, the main processor no longer needs to wake up for it. Less tracking risk and better battery life in a single update – that doesn’t happen every day.
Bluetooth 6.2 – latency and hardening
November 2025. The second release in the six-month rhythm brought technical refinements with concrete consequences.
Shorter connection intervals
Bluetooth devices don’t exchange data continuously, but at regular intervals – the connection interval. The shortest possible interval dropped from 7.5 milliseconds to 375 microseconds. What does that mean in practice? Audio latency falls to a level that matters for gaming headsets and professional monitors. Haptic feedback in wearables becomes noticeably more synchronous. Industrial control systems can react faster.
Channel Sounding attack resilience
6.2 hardened the Channel Sounding introduced in 6.0 against a specific attack class: manipulated amplitude values. An attacker could try to undermine the distance measurement through targeted signal distortion. The new amplitude-based attack resilience detects such anomalies.
A standards body that actively addresses known attack vectors and folds fixes into the standard promptly – that is not something to take for granted. Here, it’s happening.
LE Audio over USB
HCI (Host Controller Interface) USB LE Isochronous Support sounds like specification prose, but has a tangible consequence: LE Audio with the LC3 codec now works over USB Bluetooth dongles. Anyone without an integrated Bluetooth 6.x controller in their PC can retrofit it.
Bluetooth 6.3 – fresh off the press
On May 6, 2026, version 6.3 appeared – the latest so far. Its focus is clear: fully deliver on the promise of Channel Sounding.
Inline PCT transfer
The most important new feature is Channel Sounding Inline PCT Transfer. PCT stands for Phase Correction Terms – the correction data for phase errors that inevitably occur during Channel Sounding. Until now, these corrections were post-processed digitally in the host, which meant latency and overhead.
With 6.3, the reflector applies the phase correction directly in hardware and never sends the costly Q components of the PCT data across the HCI at all. The result: lower processing latency, sharper distance measurements, less overhead. And perhaps more importantly: Channel Sounding implementations become more reliable on cheaper IoT chips too.
Radio efficiency
6.3 also aligns the RF limits between Classic Bluetooth and Bluetooth LE. For developers of dual-mode devices – headphones, headsets, wearables with both modes – this simplifies design noticeably. Fewer special cases in firmware, less certification effort.
“If 6.0 redefined what Bluetooth can do – 6.3 makes it production-ready.”
What has really changed on the security side
It’s worth looking at the whole picture.
Encryption has existed since version 4.2 – AES-128, ECDH key exchange. But for a long time only at the connection level. 5.4 added encrypted advertising data: beacon broadcasts can now be encrypted too, something the standard simply hadn’t provided for before.
Key management got stricter with 5.3: hosts can enforce minimum key lengths, closing a common weakness at connection setup.
Tracking protection with 6.1: unpredictable RPA timing makes long-term correlation attacks considerably harder.
Physical security – the real breakthrough in 6.0. Relay attacks on radio-based access systems were a known, largely unsolved problem for years. Channel Sounding counters them with physics: travel times can’t be faked. 6.2 additionally armored it against amplitude manipulation.
What comes next
The six-month release cycle means version 6.4 is due by the end of 2026. What’s on the agenda can be inferred from current trends – further refinements of Channel Sounding for cheaper chips, deeper integration of LE Audio into professional AV infrastructure, and possibly first steps toward quantum-resistant cryptography. The latter is a topic occupying the entire wireless industry, and Bluetooth will be no exception.
Bluetooth LE is no longer background noise. It still goes unnoticed – but with 6.x, applications have become possible that simply weren’t conceivable before. With security built in.
Sources:
· Bluetooth SIG: Just released – Bluetooth Core 6.3
· Bluetooth SIG: Just released – Bluetooth Core 6.2
· Bluetooth SIG: Bluetooth Core 6.2 feature overview
· Argenox: Bluetooth 6.0 Adopted
· Argenox: Bluetooth 6.3 Specification Adopted
· Lansitec: Bluetooth 6.0 and 6.1 – What the new core specs mean
· CNX Software: Bluetooth 6.2 gets more responsive, improves security
