The transport is never trusted

Carriers are not credentials

Bluetooth pairing proves that two devices went through a pairing dance. NFC proximity proves that something was within a few centimetres of a reader. A QR code proves that a camera saw a pattern. None of that proves who is on the other side, and each of these carriers has been attacked in public: eavesdropping, downgraded key strength, relaying a tap across a city with two ordinary phones.

So we treat all three as hostile. Anyone may listen. Anyone may inject. Anyone may relay. Nothing the carrier claims is taken as proof of anything.

Pair once

Trust is established once, when you pair the desktop and the phone. The desktop shows a QR code and the phone scans it. Then both screens show a short code, and you compare them. If they match, the two devices have agreed on keys that no carrier ever saw, and each knows the other's identity from then on. If they do not match, something sat in the middle, and you stop.

That comparison is the only moment a human checks the channel, and it is the moment that matters. Everything after it inherits the trust you established with your own eyes.

The session

Once paired, every message between the desktop and the phone travels inside a session that the wallet owns. It is end-to-end encrypted, so a carrier that is being listened to leaks nothing but noise. It is mutually authenticated, so each side knows the message came from the device it paired with and not from something pretending to be it. It is bound to the carrier it runs on, so a message captured on one path cannot be replayed on another.

The session is built on a well-studied, modern handshake design, the kind used by widely deployed secure tunnels. We do not improvise cryptography.

What gets dropped

A message that was altered in transit fails authentication and is dropped. A message that is replayed arrives out of sequence and is dropped. A message that arrives out of order is dropped. A message from a device that is not the paired one never gets past the handshake. In each case the phone shows nothing to sign, because nothing valid arrived.

This is why the convenience of Bluetooth LE and NFC costs nothing in security. The carrier can be as weak as it likes. Whether the radio underneath is secure is a question we never need to answer.

Over any carrier, the same session

The session does not know whether it is riding on light, radio or a tap. You can pair over QR and then use Bluetooth LE for daily work and NFC at a terminal, all without pairing again. Switching carriers does not change what is trusted, because the carrier was never trusted in the first place.

Is it still an air gap?

Purists say an air gap means light only. We will not argue about the word. If you want the strict version, use QR codes and nothing else; it is always available. The property we care about is underneath the word: the device that holds the keys has no route to the internet, and the only things that ever cross are a request the phone decodes for itself and a signature it chose to produce. A session over Bluetooth LE preserves that property. What it adds is that you keep using it.