The NwkSKey and AppSKey are derived when joining the network.
OTAA Join procedure
During the OTAA Join the network forwards the join request message to the Application Server identified by the AppEUI. This Application Server is supposed to have been provisioned with the end-device's AppKey. Based on the AppKey and the content of the Join request message sent by the end-device, the Network:
- Generates a NwkSKey and AppSKey and sends the NwkSKey information to the KPN Core Network.
- Forms a Join response payload that will allow the end-device to compute a NwkSKey and AppSKey.
The advice for the frequency of periodically rejoining (and thus renewing the NwkSKey and the AppSKey) depends on the number of messages sent by the end-device and the level of security required.
A device should re-join:
- Every time it has lost the session context information.
- Every x days
- Every y messages