Bluetooth Mesh key generetion and handling?

Question

The Bluetooth Mesh Light Switch example shows how to work with keys for a Mesh Network.
But I have some questions about who generate the keys and what they are used for. 
 The example provisioner uses these keys: 
 dsm_handle_t m_netkey_handle;
dsm_handle_t m_appkey_handle;
dsm_handle_t m_devkey_handles[...];
dsm_handle_t m_server_handles[...];
dsm_handle_t m_group_handle;
 
 Network Key: 
I think I understand the network key, but i am a bit confused about the function it is used in, dsm_subnet_add() .
The name of the function indicates that it is used for adding subnetwork, but is it also used for adding the overall Mesh network to the Device State Manager? 
 And just to be sure, the network key is generated by the provisioner and distributed to all the nodes, right? 
 Application Key: 
I am not sure what the application key is used for and who initially knows it.
Is it distributed by the provisioner to the nodes of the network or does every node participating in the application on the network know this before being provisioned? 
 Device Keys: 
It seems like the device key is distributed to the node from the provisioner, is this correct? 
 Server Handles: 
These keys is for each of the elements holding a Light Switch server on the nodes in the network right? 
 Group Handle: 
To my understanding, this key functions like the Server Handle, it is just possible to address more than one node with this address.
But in the example it is used in dsm_address_publish_add() together with NETWORK_GROUP_ADDRESS .
Does this mean that every node in the network should also be added to a group for the whole network? 
 Edit 1: 
... 
 Edit 2: 
I have moved my additional question from Edit 1 to its own question here on the forum. 
 I am still interested in clearing my confusion on the different keys if anybody can provide an explanation.

Bjørn Kvaale · Accepted Answer

Hi SørenHN, 
 Network Key Question: the dsm_subnet_add() function is used for "adding a subnetwork & associated network key indexes to device state storage" ( see link ). So I don't think it adds the overall mesh network to the device state manager, but instead adds the subnetwork to device state manager. 
 And yes, the network key is generated by the provisioner & distributed to the provisionee that is being provisioned to the mesh network ( see link & this link, section: Adding A New Device To The Network ). 
 Application Key Question: The application key is used to generate & store application security material used for the mesh Rx & Tx. It secures communication at the access layer & is shared with every node in the mesh application network. It is up to the provisioner to generate & distribute the application keys ( see link ). 
 Device Keys Question: The device itself generates a device key, which is then shared only with the provisioner ( see link, search for device key ). 
 Edit: I previously said that the provisioner generates the device key, but this is incorrect. 
 Server Handle Question: Each element is a handle ID of the address of the server in the dsm address database. The server handles are added using dsm_address_publish_add() inside the provisioner_prov_complete_cb() function. 
 Group Handle Question: The group handle is the handle id of the group address (OXCAFE) , which is the address which states that you send a packet when you press button 4 to turn on all of the light switch servers. You said correctly that it is acquired using dsm_address_publish_add() inside the access_setup() function.

Bluetooth Mesh key generetion and handling?

Top Replies