Bluetooth Encryption Key Location in Regedit

This article provides the exact Windows Registry locations used to configure system-wide Bluetooth device security and encryption levels. Administrators can manage Bluetooth security policies, enforce minimum encryption key sizes, and view security parameters directly within the Windows Registry Editor (regedit).

Primary Registry Path for Bluetooth Configuration

The primary system-wide Bluetooth driver settings and security configurations are located at:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters

Bluetooth Security and Encryption Registry Keys

Within the BTHPORT\Parameters key, several values govern encryption and security behavior:

• EncryptionMinKeySize:
  • Type: REG_DWORD
  • Function: Enforces the minimum acceptable encryption key size (in bytes) during Bluetooth pairing negotiations (often used to mitigate KNOB-style downgrade attacks).
  • Values: Typically set between 1 and 16 (decimal), with 16 representing maximum security (128-bit).
• RequireSecurity:
  • Type: REG_DWORD
  • Function: Enforces authentication and encryption for all incoming and outgoing connections.

Group Policy Enforcement Path

When Bluetooth encryption requirements are deployed via Group Policy or Mobile Device Management (MDM), the configuration values reside under the policy path:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Bluetooth

• SetEncryptionStrength: Configures system-wide enforcement levels, determining whether connections must strictly use E0 or AES-CCM encryption algorithms.

How to Navigate to and Modify These Keys

1. Press Windows Key + R, type regedit, and press Enter.
2. Navigate to the desired path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters
3. If the specific encryption value (such as EncryptionMinKeySize) does not exist:
   • Right-click the Parameters key.
   • Select New > DWORD (32-bit) Value.
   • Name the value EncryptionMinKeySize.
   • Double-click the new value, select Decimal, and set the value data (e.g., 16).
4. Restart the computer or restart the Bluetooth Support Service (bthserv) for changes to take effect.