How to enable OC_OSCORE in nrf_knx_iot sample?

RE: How to enable OC_OSCORE in nrf_knx_iot sample?

Charlie — Mon, 29 Jul 2024 06:48:12 GMT

Hi Barry,

Sorry for the late reply. Just let you know we are still working on this case, but we will need more time.

Thanks for your patience.

Best regards,

Charlie

RE: How to enable OC_OSCORE in nrf_knx_iot sample?

Llama12580 — Fri, 19 Jul 2024 01:33:04 GMT

RE: How to enable OC_OSCORE in nrf_knx_iot sample?

Llama12580 — Thu, 20 Jun 2024 02:58:40 GMT

OK, thank you so much!! I will try what you said, which branch should I use?

RE: How to enable OC_OSCORE in nrf_knx_iot sample?

Konrad Derda — Wed, 19 Jun 2024 20:09:42 GMT

Hello,
As Kenneth mentioned - currently, nRF KNX IoT Point API is in experimental phase. In the current state we did not test OSCORE functionality. The SDK is full of security features used by different protocols. At the moment, OSCORE is not enabled by default nd we cannot state that it's fully functional. However, if you would like to test it itself I can show you how to enable it in our samples:

1. Open CMakeLists.txt file of a sample you would like to use (or both), e.g.: knx/samples/light_switch_actuator/CMakeLists.txt

2. Ensure that include directories contain ${BASE_DIR}/security entry like at the end of the following snippet:

include_directories(app PUBLIC
${BASE_DIR}
${BASE_DIR}/deps
${BASE_DIR}/include 
${BASE_DIR}/port/ 
${BASE_DIR}/port/zephyr
${BASE_DIR}/security
)

3. Add OC_OSCORE to compile definitions:

add_compile_definitions(OC_CLIENT OC_SERVER OC_PUBLISHER_TABLE OC_BLOCK_WISE OC_OSCORE)

4. Add the following files to the list of sources:

${BASE_DIR}/security/oc_oscore_engine.c
${BASE_DIR}/security/oc_oscore_context.c
${BASE_DIR}/security/oc_oscore_crypto.c
${BASE_DIR}/messaging/coap/oscore.c

After these editions you should be able to build the firmware with OSCORE enabled. Also, regarding the security - KNX Point API uses CoAP messages which are transported with Thread Protocol which itself uses encryption. It means that you are unable to decode packets captured in the air without knowing the Thread network's key. OSCORE works on application layer and messages encrypted by it are later on encrypted by OpenThread during a transmission.

Let me know if you need any help or information regarding this matter.

RE: How to enable OC_OSCORE in nrf_knx_iot sample?

Llama12580 — Wed, 19 Jun 2024 07:04:43 GMT

OK. Actually what I am concerned about is the securitry of communication betweens the knx sensor and the knx actuator. So for now, the nrf-knx-iot demo does not contain any encryption algorithm?

RE: How to enable OC_OSCORE in nrf_knx_iot sample?

Kenneth — Tue, 18 Jun 2024 20:29:35 GMT

Hello,

It's still an experimental project. From my understanding this is something we are planning to eventually, but not looked into details yet, but I will check if someone can comment on what we believe is required to get started.

Kenneth