4.5 Key management
Each of the links is protected by an ECDH key exchange process. Initially key pairs and certificates are built and stored in the device and in the relevant link termination point during the manufacturing provisioning process. For more information, see section 4.4.1.1. For the application link, the Application Server initiates key exchange. For the Flex Layer link and the Network Layer link that terminate in the Network Server, the Network Server initiates key exchange.
4.5.1 Session Key exchange
The Network Server generates the ephemeral key pair and exchanges its public key with the Endpoint. The Endpoint generates the ephemeral key pair and exchanges its public key with the Network Server. the Network Server and the Endpoint generate the shared secret key using ECDH. The Network Server and the Endpoint use a predefined formula to generate the symmetric secret key from the shared secret. This symmetric secret key is the NETWORK_PRIMARY_KEY. The Network Server generates a temporary key from the NETWORK_PRIMARY_KEY. The Network Server uses the temporary key to encrypt a payload, then the payload is sent to the Endpoint for validation. The Endpoint decrypts the encrypted packet and verifies the content. If the Endpoint successfully decrypts and verifies the content, the Endpoint sends an uplink message to the Network Server with an encrypted packet indicating successful verification. If the Network Server receives the uplink packet, the Network Server decrypts the encrypted portion and validates it against the payload content sent on the downlink. If verification is successful, both the Network Server and the Endpoint save the NETWORK_PRIMARY_KEY to a database record.
4.5.2 Gateway Primary Key Negotiation
For SubG-FSK and SubG-CSS, the Gateway primary key is derived during Gateway registration. The Gateway primary key is used to encrypt the exchange between a Gateway and the Amazon Sidewalk Network Server. The Gateway primary key is used to encrypt the inner Flex Layer. The outer Flex Layer is not encrypted.
For BLE-enabled Gateways, a TLS session is used instead of the outer Flex Layer.
The following diagram describes the key exchange flow between a Gateway and the Amazon Sidewalk Network Server:
%20flow.png)
fig 4.10 Key exchange (KEX) flow