[doomrobo]

There are middle boxes between the two peers, yes? Routers and such. They observe the encrypted messages. They can brute force the password, even after the session is over.

Even if you assume the PIN is uniformly random (you should not assume this), it is only log2((10+26)^6) ~ 31 bits of entropy. This does not satisfy standard notions of secure channel establishment.

[nenaoki]

The pin would just be for coordination, not encryption.

[doomrobo]

Ah ok. How is the encryption key, if there is one, established then?

[avovsya]

You're right, thank you for answering!