EnOcean EASYFIT EMDCB, Руководство пользователя

Страница: 67 / 67

USER MANUAL
EMDCB – BLUETOOTH LOW ENERGY MOTION AND ILLUMINATION SENSOR
© 2019 EnOcean | www.enocean.com EMDCB User Manual | v1.3 | August 2019 | Page 67/67
C.3 Address resolution example
We consider an EMDCB device with the following IRK:
BE759A027A4870FD242794F4C45220FB
We further consider a telegram having the following resolvable private address:
493970E51944
We will now test if this resolvable private address was generated using the IRK above.
Referring to the resolvable private address structure shown in Figure 15, we split the re-
solvable private address into
prand
and
hash
as follows:
prand = (RPA && 0xFFFFFF000000) >> 24
prand = 0x493970
hash = RPA && 0x000000FFFFFF
hash = 0xE51944
Next, we verify the address mode by looking at the two most significant bit of
prand
:
mode = (prand && 0xC00000) >> 22
mode = 0b01
Referring to chapter 4.4.2, the setting of
0b01
indicates resolvable private address mode.
To generate the hash, we add 104 bit of padding (all zeros) to
prand
:
0x00000000000000000000000000493970
We can now generate the hash as AES128 operation between the IRK and the thus padded
prand
:
hash = AES128(IRK; Padded prand)
hash = AES128(0xBE759A027A4870FD242794F4C45220FB;
0x00000000000000000000000000493970)
At the time of writing, a suitable online AES calculator could be found here:
http://testprotect.com/appendix/AEScalc
With this, we can calculate the result as:
hash = 0x286ACB1F9C8A80EE21B3F02225E51944
Using this result, we can verify that the lowest 24 bit of the calculated
hash
(
0xE51944
)
match the
hash
that was received as part of the resolvable private address. Therefore the
transmitter of this telegram used this specific IRK to generate this resolvable private ad-
dress.