BeaconTruth
Authenticated Bluetooth location beacons. Every advertisement is signed, counted, and verifiable — so a position report can be trusted, not just received.
The service
Enroll
Beacons arrive keyed from the factory — each issued its own master key over an authenticated, write-once channel. Adding one to an account is a scan; keys never travel in the clear.
Authenticate
Every packet carries a rolling counter and an AES-256-GCM signature. Forgeries and replays are rejected at the edge of the platform.
Locate
Verified observations become trusted location data — with a rotating private address, so the beacon is identifiable only to those holding the key.
One standard packet
A single 31-byte legacy advertisement. The highlighted 18 bytes are the signed range — exactly what a scanner uplinks — authenticated by a truncated GMAC under a key derived per beacon and per purpose. Any scanner can read it; only BeaconTruth can verify it.
1eff da0730 4a1f9c0e7b2d5638a4c1 ab2301 c817000000 c6285246037f232d
Open by design
The packet format, key derivation, and provisioning protocol are specified in full — not reverse-engineered from a scanner. An example repository showing how to verify the signature and how to accept provisioning from the BeaconAuth service is on the way.