  In identity misbinding attacks against authenticated key-exchange protocols,
a legitimate but compromised participant manipulates the honest parties so that
the victim becomes unknowingly associated with a third party. These attacks are
well known, and resistance to misbinding is considered a critical requirement
for security protocols on the Internet. In the context of device pairing, on
the other hand, the attack has received little attention outside the
trusted-computing community. This paper points out that most device pairing
protocols are vulnerable to misbinding. Device pairing protocols are
characterized by lack of a-priory information, such as identifiers and
cryptographic roots of trust, about the other endpoint. Therefore, the devices
in pairing protocols need to be identified by the user's physical access to
them. As case studies for demonstrating the misbinding vulnerability, we use
Bluetooth and a protocol that registers new IoT devices to authentication
servers on wireless networks. We have implemented the attacks. We also show how
the attacks can be found in formal models of the protocols with carefully
formulated correspondence assertions. The formal analysis yields a new type of
double misbinding attack. While pairing protocols have been extensively
modelled and analyzed, misbinding seems to be an aspect that has not previously
received sufficient attention. Finally, we discuss potential ways to mitigate
the threat and its significance to security of pairing protocols.
