USER MANUAL
STM 550B / EMSIB - EASYFIT MULTISENSOR FOR IOT APPLICATIONS (2.4 GHZ BLE)
© 2020 EnOcean | www.enocean.com
F-710-017, V1.0
STM 550B / EMSIB User Manual | v1.3 | June 2020 | Page 115 / 115
C.2
Address resolution example
We consider an STM 550B module with the following IRK:
BE759A027A4870FD242794F4C45220FB
We further consider a telegram having the following resolvable private address:
493970E51944
We will now test if this resolvable private address was generated using the IRK above.
Referring to the resolvable private address structure shown in Figure 25, we split the re-
solvable private address into
prand
and
hash
as follows:
prand = (RPA && 0xFFFFFF000000) >> 24
prand = 0x493970
hash = RPA && 0x000000FFFFFF
hash = 0xE51944
Next, we verify the address mode by looking at the two most significant bit of
prand
:
mode = (prand && 0xC00000) >> 22
mode = 0b01
Referring to chapter 5.4.6., the setting of
0b01
indicates resolvable private address mode.
To generate the hash, we add 104 bit of padding (all zeros) to
prand
:
padded prand = 0x00000000000000000000000000493970
We can now generate the hash as AES128 operation between IRK and
padded prand
:
hash = AES128(IRK; padded prand)
hash = AES128(0xBE759A027A4870FD242794F4C45220FB;0x00000000000000000000000000493970)
At the time of writing, a suitable online AES calculator could be found here:
http://testprotect.com/appendix/AEScalc
With this, we can calculate the result as:
hash = 0x286ACB1F9C8A80EE21B3F02225E51944
With that, we can verify that the lowest 24 bit of the calculated
hash
(
0xE51944
) match the
hash that was received as part of the resolvable private address. Therefore the transmitter
of this telegram used this specific IRK to generate this resolvable private address.
