EUIs+key assignment for developer

[tibhel]

Hi!

I am developing a device with OTAA LoRaWAN 1.0.X based on MSP430+RFM95W and I’m trying to understand the simplest way to get, assign (in mass scale) and distribute out the DevEUI, AppEUI and AppKey.

The MCU of the devices have assigned serial numbers (6 bytes) that are unique between all my devices, which is also shown on the product sticker. I want to avoid inserting even more id/keys for each device in production.

1. I have understood that I need to buy a MA-S block of EUI from IEEE. Is that used for DevEUI or AppEUI, or both?
2. How can I use my “unique” serial number in combination of above (1) to generate the EUIs?
3. Can AppEUI be the same for all devices? If so, how should I select that AppEUI?
4. What is simplest way of generating and distributing the AppKey to costumers?
5. The OUI, how can I get that? Is it included with the MA-S purchase, or is a separate id?

Thanks in advance

[descartes (Nick McCloud)]

@tibhel

I have understood that I need to buy a MA-S block of EUI from IEEE. Is that used for DevEUI or AppEUI, or both?

Both, and anything else that you want to assign a unique identifier to, it’s entirely up to you, it’s your block.

@tibhel

How can I use my “unique” serial number in combination of above (1) to generate the EUIs?

You have your assignment, how you use the other 28 bits is up to you. It would rather depend on how the serial numbers are assigned & their range and if you can get a contiguous range which would depend on how many you buy & where from. Failing all that you could come up with a hashing algorithm to reduce the 48 bits to 28 or less.

@tibhel

Can AppEUI be the same for all devices? If so, how should I select that AppEUI?

It can, but that exposes a security risk to your customers. Preferably you provision batches for a customer who needs some for an application. Or if customer buy singles, just use a different part of your EUI so that each one is unique, and/or provide a way for customers to set an AppEUI.

@tibhel

What is simplest way of generating and distributing the AppKey to costumers?

Rather like the above, that depends on how many they buy each time. It could be a sticky label or it could be a spreadsheet. The cutting edge developer of a device would be looking at using the new provisioning system with the QR code - perhaps something to explore - you’ll find details on the LoRa Alliance website.

@tibhel

The OUI, how can I get that? Is it included with the MA-S purchase, or is a separate id?

It is my understanding from the documentation on the IEEE website that they set your OUI-36 to the MA-S prefix they give you.

@tibhel

I want to avoid inserting even more id/keys for each device in production.

You may be able to derive EUI’s from the serial number, but will you customers be able to do the same or should you explicitly print them.

You also need to consider how you get the serial number out, the AppKey back in and what the you do with the App/JoinEUI.

Which all depends on how many devices you are making, if it has a serial port and if you can store settings in NVM.

[descartes (Nick McCloud)]

@tibhel

I will be making thousands

Is that a first batch or will it be tens to possibly a hundred. The step up from the bench to bulk manufacture gets real ugly real fast.

@tibhel

Ok but how should I generate the AppKey.

Here’s how I do it: Random EUI or Key generator

@tibhel

My thought was to let costumers request the EUIs/keys by providing the serial number of device. However most of the time the users will not have to request it as we will do the claiming/activation automatically, and users will then just add a device on our app using the serial number of the sticker.

This implies you have generated all these EUI’s & Keys in advance which means you have already captured all the serial numbers in advance. The app will have to bounce the serial number on to either add a device on the stack or move an already registered device over to the customers application. Which implies the customer has an application, which implies the app via your server has created an application - is that on your account or is it in the customers account - and do they use the console - or do you shield them via your website and if you do, do you partition the customers by application, ie, each of them get their own app?

Which then begs the question, with that level of integration, are you using a paid for instance, because with a setup like that, your customers aren’t going to understand what’s going on behind the scenes and will be mostly unimpressed & reaching for their lawyers if they find out you are using a free non-SLA service.

I’m not trying to rain on your parade, I hoping you’ll think about the scaling of provisioning from ten to a hundred to a thousand. Making lots of the same thing is relatively straightforward - either via a contract manufacturer or just burning the midnight oil. It’s getting them ready to ship that hurts.

[descartes (Nick McCloud)]

@tibhel

But I want to update the firmware with LoRaWAN comm.

On each device? After the fact? Python and a serial port of the win …

@tibhel

Thanks, however I need to keep track of the key between the device and backend which will be difficult if it is random. Can I hash it based on the S/N?

You could hold them in a database but sure, you can create a hash.

You would be well advised to simulate / walk through the whole process - both of updating the device before shipment and what would need to happen when a customer enters a serial number.