Security and data encryption

DigiMesh security and data encryption overview

The encryption algorithm used in DigiMesh is AES (Advanced Encryption Standard) with a 128b key length (16 bytes). The AES algorithm is not only used to encrypt the information but to validate the data which is sent. This concept is called Data Integrity and it is achieved using a Message Integrity Code (MIC) also named as Message Authentication Code (MAC) which is appended to the message. This code ensures integrity of the MAC header and payload data attached.

It is created encrypting parts of the IEEE MAC frame using the Key of the network, so if we receive a message from a non trusted node we will see that the MAC generated for the sent message does not correspond to the one what would be generated using the message with the current secret Key, so we can discard this message. The MAC can have different sizes: 32, 64, 128 bits, however it is always created using the 128b AES algorithm. Its size is just the bits length which is attached to each frame. The more large the more secure (although less payload the message can take). Data Security is performed encrypting the data payload field with the 128b Key.

Figure : IEEE 802.15.4 frame

Security in API libraries

As explained previously, DigiMesh provides secure communications inside a network using 128-bit AES encryption. The API functions enable using security and data encryption.

Encryption enable

Enables the 128-bit AES encryption in the modules.

Example of use:

{
xbeeDM.setEncryptionMode(0); // Disable encryption mode
xbeeDM.setEncryptionMode(1); // Enable encryption mode
xbeeDM.getEncryptionMode(); // Get encryption mode
}

Related variables:

xbeeDM.encryptMode → stores if security is enabled or not

XBee configuration example: https://development.libelium.com/dm-01-configure-xbee/

The mode used to encrypt the information is AES-CTR. In this mode all the data is encrypted using the defined 128b key and the AES algorithm. The Frame Counter sets the unique message ID, and the Key Counter (Key Control subfield) is used by the application layer if the Frame Counter max value is reached.

Figure : AES-CTR encryption frame

Encryption Key

128-bit AES encryption key used to encrypt/decrypt data.

The entire payload of the packet is encrypted using the key and the CRC is computed across the ciphertext. When encryption is enabled, each packet carries an additional 16 Bytes to convey the random CBC Initialization Vector (IV) to the receivers.

A module with the wrong key (or no key) will receive encrypted data, but the data driven out the serial port will be meaningless. A module with a key and encryption enabled will receive data sent from a module without a key and the correct unencrypted data output will be sent out the serial port.

Example of use:

{
char* KEY="WaspmoteLinkKey!"
xbeeDM.setLinkKey(KEY); // Set Encryption Key
}

Related variables:

xbeeDM.linkKey // stores the key that has been set in the network

XBee configuration example: https://development.libelium.com/dm-01-configure-xbee/

Security in a network

When creating or joining a network, using security is highly recommended to prevent the network from attacks or intruder nodes.

It is necessary to enable security and set the same encryption key in all nodes in order to set security in a network. If not, it will not be possible to communicate between different XBee modules.