The Join Procedure:
- The device sends an unencrypted LoRa join request with the AppEUI, DevEUI, and a random generated and unique DevNonce.
- If the network allows the device, then a join accept is sent to the device containing a random generated and unique AppNonce, a NetID, a DevAddr and some additional variables with network info ( used delays, frequencies & data rates). The join accept is encrypted with the AppKey.
- The device and the join server can now both calculate the NwkSkey & AppSKey using the AppKey, AppNonce, DevNonce and NetID
- The device and network communicate this session using the NwkSKey and AppSKey for encryption
DevEUI, AppEUI & AppKey can be implemented in the device without knowledge about any specific LoRa network, enabling automation. NwkSKey & AppSKey can be renewed by forcing a new join session. This should be done regularly to increase security.