BeaconTruth
Authenticated Bluetooth location beacons. Every advertisement is signed, counted, and verifiable — so a position report can be trusted, not just received.
The service
Provision
Each device is issued its own master key and takes it over an authenticated, write-once BLE channel. Keys never travel in the clear.
Authenticate
Every packet carries a rolling counter and an AES-256-GCM signature. Forgeries and replays are rejected at the edge of the platform.
Locate
Verified observations become trusted location data — with a rotating private address, so the beacon is identifiable only to those holding the key.
One standard packet
A single 31-byte legacy advertisement. The highlighted 18 bytes are the signed range — exactly what a scanner uplinks — authenticated by a truncated GMAC under a key derived per device and per purpose. Any scanner can read it; only BeaconTruth can verify it.
1eff da0730 4a1f9c0e7b2d5638a4c1 ab2301 c817000000 c6285246037f232d
Open by design
The packet format, key derivation, and provisioning protocol are specified in full — not reverse-engineered from a scanner. An example repository showing how to verify the signature and how to accept provisioning from the BeaconAuth service is on the way.