Issue link: https://read.uberflip.com/i/1428395
LoRaWAN ® L2 1.0.4 Specification © 2020 LoRa Alliance ® Page 44 of 90 The authors reserve the right to change specifications without notice. Note: For over-the-air-activation, end-devices are not personalized with 1392 any kind of network key. Instead, whenever an end-device joins a 1393 network, a network session key specific to that end-device is derived to 1394 encrypt and verify transmissions at the network level. This facilitates 1395 roaming of end-devices between networks of different providers. 1396 Furthermore, using both a network session key and an application 1397 session key allows federated Network Servers in which application data 1398 cannot be read by the network provider. 1399 6.2.1 End-device identifier (DevEUI) 1400 DevEUI is a global end-device ID in the IEEE EUI64 address space that uniquely identifies 1401 the end-device across roaming networks. 1402 All end-devices SHALL have an assigned DevEUI, regardless of which activation procedure 1403 is used (i.e., ABP or OTAA). 1404 For OTAA end-devices, DevEUI SHALL be stored in the end-device before the Join 1405 procedure is executed. For ABP end-devices, DevEUI SHOULD be stored in the end-device 1406 itself. 1407 Note: It is a recommended practice that DevEUI should also be 1408 available on an end-device label for the purpose of end-device 1409 administration. 1410 6.2.2 Join-Server identifier (JoinEUI) 1411 JoinEUI is a global application ID in the IEEE EUI64 address space that uniquely identifies 1412 the Join-Server that is able to assist in the processing of the Join procedure and the derivation 1413 of session keys. 1414 For OTAA end-devices, JoinEUI SHALL be stored in the end-device before the Join 1415 procedure is executed. JoinEUI is not required for ABP-only end-devices. 1416 6.2.3 Application key (AppKey) 1417 The AppKey is an AES-128 root key specific to the end-device. 8 Whenever an end-device 1418 joins a network via over-the-air activation, the AppKey is used to derive the session keys 1419 NwkSKey and AppSKey specific to that end-device to encrypt and verify network 1420 communication and application data. 1421 An AppKey SHALL be stored on an end-device intending to use the OTAA procedure. 1422 An Appkey is NOT REQUIRED for ABP-only end-devices. 1423 6.2.4 Join procedure 1424 From an end-device's point of view, the Join procedure consists of two MAC frames 1425 exchanged with the server, namely a Join-Request and a Join-Accept. 1426 8 As all end-devices end up with unrelated application keys specific to each end-device, extracting the AppKey from an end-device compromises only that one end-device.