USER MANUAL
PTM 215B – BLUETOOTH
®
PUSHBUTTON TRANSMITTER MODULE
© 2019 EnOcean | www.enocean.com
F-710-017, V1.0
PTM 215B User Manual | v1.9 | June 2019 | Page 73/85
B.1.2
Address resolution example
We consider a PTM 215B device with the following IRK (options for determining the IRK /
security key of a PTM 215B are described in chapter C.1.3.):
BE759A027A4870FD242794F4C45220FB
We further consider a telegram having the following resolvable private address:
493970E51944
We will now test if this resolvable private address was generated using the IRK above.
Referring to the resolvable private address structure shown in Figure 12, we split the re-
solvable private address into
prand
and
hash
as follows:
prand = (RPA && 0xFFFFFF000000) >> 24
prand = 0x493970
hash = RPA && 0x000000FFFFFF
hash = 0xE51944
Next, we verify the address mode by looking at the two most significant bit of
prand
:
mode = (prand && 0xC00000) >> 22
mode = 0b01
Referring to chapter 4.4.2, the setting of
0b01
indicates resolvable private address mode.
To generate the hash, we add 104 bit of padding (all zeros) to
prand
:
0x00000000000000000000000000493970
We can now generate the hash as AES128 operation between the IRK and the thus padded
prand
:
hash = AES128(IRK; Padded prand)
hash = AES128(0xBE759A027A4870FD242794F4C45220FB;
0x00000000000000000000000000493970)
At the time of writing, a suitable online AES calculator could be found here:
http://testprotect.com/appendix/AEScalc
With this, we can calculate the result as:
hash = 0x286ACB1F9C8A80EE21B3F02225E51944
With that, we can verify that the lowest 24 bit of the calculated
hash
(
0xE51944
) match the
hash
that was received as part of the resolvable private address. Therefore the transmitter
of this telegram used this specific IRK to generate this resolvable private address.
