Modules#
sl_zb_sec_man_network_key_info_t
sl_zb_sec_man_aps_key_metadata_t
Zigbee Security Manager APIs#
This file describes functionality for Zigbee security features. This includes storing and fetching various keys, as well as invoking crypto operations.
See zigbee_security_manager.h for source code.
Enumerations#
The list of supported key types used by Zigbee Security Manager.
Derived keys are calculated when performing Zigbee crypto operations. The stack makes use of these derivations.
Security Manager context flags.
Functions#
This routine will initialize a Security Manager context correctly for use in subsequent function calls.
Import a key into storage. Certain keys are indexed, while others are not, as described here. If context->core_key_type is.. ..SL_ZB_SEC_MAN_KEY_TYPE_NETWORK, then context->key_index dictates whether to import the current (active) network key (index 0) or the alternate network key (index 1). ..SL_ZB_SEC_MAN_KEY_TYPE_TC_LINK_WITH_TIMEOUT, then context->eui64 must be set. context->key_index is unused. ..SL_ZB_SEC_MAN_KEY_TYPE_APP_LINK, then context->key_index determines which index in the persisted key table that the entry should be stored to. context->eui64 must also be set.
Import a link key, or SL_ZB_SEC_MAN_KEY_TYPE_APP_LINK key, into storage.
Export an APS link key by index.
Search through the Key table to find an entry that has the same EUI address as the passed value. If NULL is passed in for the address then it finds the first unused entry and sets the index in the context.
Return true if a link key is available for securing messages sent to the remote device.
Search for a transient, or temporary, key entry from key storage by EUI.
Search for a transient, or temporary, key entry from key storage by key index.
Export a key from storage. Certain keys are indexed, while others are not, as described here. If context->core_key_type is.. ..SL_ZB_SEC_MAN_KEY_TYPE_NETWORK, then context->key_index dictates whether to export the current (active) network key (index 0) or the alternate network key (index 1). ..SL_ZB_SEC_MAN_KEY_TYPE_TC_LINK, then context->eui64 is checked if context->flags is set to ZB_SEC_MAN_FLAG_EUI_IS_VALID. If the EUI supplied does not match the TC EUI stored on the local device (if it is known), then an error is thrown. ..SL_ZB_SEC_MAN_KEY_TYPE_TC_LINK_WITH_TIMEOUT, then keys may be searched by context->eui64 or context->key_index. context->flags determines how to search (see sl_zigbee_sec_man_flags_t). ..SL_ZB_SEC_MAN_KEY_TYPE_APP_LINK, then keys may be searched by context->eui64 or context->key_index. context->flags determines how to search (see sl_zigbee_sec_man_flags_t). ..SL_ZB_SEC_MAN_KEY_TYPE_GREEN_POWER_PROXY_TABLE_KEY or SL_ZB_SEC_MAN_KEY_TYPE_GREEN_POWER_SINK_TABLE_KEY, then context->key_index dictates which key entry to export. These Green Power keys are indexed keys, and there are EMBER_GP_PROXY_TABLE_SIZE/EMBER_GP_SINK_TABLE_SIZE many of them. For all other key types, both context->key_index and context->eui64 are not used.
Search for a transient, or temporary, key and deletes it from key storage. Keys can be searched by EUI or key_index based on context->flags (see ZB_SEC_MAN_FLAG_EUI_IS_VALID and ZB_SEC_MAN_FLAG_KEY_INDEX_IS_VALID).
Delete the key table entry, or a key of type SL_ZB_SEC_MAN_KEY_TYPE_APP_LINK, from storage. Keys can be searched by EUI or key_index based on context->flags (see ZB_SEC_MAN_FLAG_EUI_IS_VALID and ZB_SEC_MAN_FLAG_KEY_INDEX_IS_VALID).
Check that the passed key exists and can be successfully loaded. This function does not actually load the context, but only checks that it can be loaded.
Retrieve information about the network key and alternate network key. It will not retrieve the actual network key contents.
Retrieve metadata about an APS key. It does not retrieve the actual key contents.
Delete a key from storage. Certain keys are indexed, while others are not, as described here. If context->core_key_type is.. ..SL_ZB_SEC_MAN_KEY_TYPE_NETWORK, then context->key_index dictates whether to delete the current (active) network key (index 0) or the alternate network key (index 1). ..SL_ZB_SEC_MAN_KEY_TYPE_TC_LINK_WITH_TIMEOUT, then keys may be searched by context->eui64 or context->key_index. context->flags determines how to search (see sl_zigbee_sec_man_flags_t). ..SL_ZB_SEC_MAN_KEY_TYPE_APP_LINK, then keys may be searched by context->eui64 or context->key_index. context->flags determines how to search (see sl_zigbee_sec_man_flags_t).
Load the specified key into the Security Manager's internal context. Any subsequent crypto operations will be done with that loaded context.
Using a previously set key context, the Security Manager will perform an HMAC (keyed hash) using AES-MMO as the hashing algorithm, and AES-128 for the underlying block encryption.
Encrypt the specified data using AES-CCM with AES-128 and a 32-bit MIC.
Macros#
Add a transient or temporary key entry to key storage. A key entry added with this API is timed out after EMBER_TRANSIENT_KEY_TIMEOUT_S seconds, unless the key entry was added using the Network Creator Security component, in which case the key will time out after the longer between ::EMBER_AF_PLUGIN_NETWORK_CREATOR_SECURITY_NETWORK_OPEN_TIME_S seconds and EMBER_TRANSIENT_KEY_TIMEOUT_S seconds.
Enumeration Documentation#
@13#
@13
The list of supported key types used by Zigbee Security Manager.
| Enumerator | |
|---|---|
| SL_ZB_SEC_MAN_KEY_TYPE_NONE | |
| SL_ZB_SEC_MAN_KEY_TYPE_NETWORK | This is the network key, used for encrypting and decrypting network payloads. There is only one of these keys in storage. |
| SL_ZB_SEC_MAN_KEY_TYPE_TC_LINK | This is the Trust Center Link Key. On the joining device, this is the APS key used to communicate with the trust center. On the trust center, this key can be used as a root key for APS encryption and decryption when communicating with joining devices (if the security policy has the EMBER_TRUST_CENTER_USES_HASHED_LINK_KEY bit set). There is only one of these keys in storage. |
| SL_ZB_SEC_MAN_KEY_TYPE_TC_LINK_WITH_TIMEOUT | This is a Trust Center Link Key, but it times out after either EMBER_TRANSIENT_KEY_TIMEOUT_S or ::EMBER_AF_PLUGIN_NETWORK_CREATOR_SECURITY_NETWORK_OPEN_TIME_S (if defined), whichever is longer. This type of key is set on trust centers who wish to open joining with a temporary, or transient, APS key for devices to join with. Joiners who wish to try several keys when joining a network may set several of these types of keys before attempting to join. This is an indexed key, and local storage can fit as many keys as available RAM allows. |
| SL_ZB_SEC_MAN_KEY_TYPE_APP_LINK | This is an Application link key. On both joining devices and the trust center, this key is used in APS encryption and decryption when communicating to a joining device. This is an indexed key table of size EMBER_KEY_TABLE_SIZE, so long as there is sufficient nonvolatile memory to store keys. |
| SL_ZB_SEC_MAN_KEY_TYPE_SECURE_EZSP_KEY | Key type used to store Secure EZSP keys. |
| SL_ZB_SEC_MAN_KEY_TYPE_ZLL_ENCRYPTION_KEY | This is the ZLL encryption key for use by algorithms that require it. |
| SL_ZB_SEC_MAN_KEY_TYPE_ZLL_PRECONFIGURED_KEY | For ZLL, this is the pre-configured link key used during classical ZigBee commissioning. |
| SL_ZB_SEC_MAN_KEY_TYPE_GREEN_POWER_PROXY_TABLE_KEY | This is a Green Power Device (GPD) key used on a Proxy device. |
| SL_ZB_SEC_MAN_KEY_TYPE_GREEN_POWER_SINK_TABLE_KEY | This is a Green Power Device (GPD) key used on a Sink device. |
| SL_ZB_SEC_MAN_KEY_TYPE_INTERNAL | This is a generic key type intended to be loaded for one-time hashing or crypto operations. This key is not persisted. |
38 of file stack/include/zigbee-security-manager.h@14#
@14
Derived keys are calculated when performing Zigbee crypto operations. The stack makes use of these derivations.
| Enumerator | |
|---|---|
| SL_ZB_SEC_MAN_DERIVED_KEY_TYPE_NONE | Perform no derivation; use the key as is. |
| SL_ZB_SEC_MAN_DERIVED_KEY_TYPE_KEY_TRANSPORT_KEY | Perform the Key-Transport-Key hash. |
| SL_ZB_SEC_MAN_DERIVED_KEY_TYPE_KEY_LOAD_KEY | Perform the Key-Load-Key hash. |
| SL_ZB_SEC_MAN_DERIVED_KEY_TYPE_VERIFY_KEY | Perform the Verify Key hash. |
| SL_ZB_SEC_MAN_DERIVED_KEY_TYPE_TC_SWAP_OUT_KEY | Perform a simple AES hash of the key for TC backup. |
| SL_ZB_SEC_MAN_DERIVED_KEY_TYPE_TC_HASHED_LINK_KEY | For a TC using hashed link keys, hashed the root key against the supplied EUI in context. |
85 of file stack/include/zigbee-security-manager.hsl_zigbee_sec_man_flags_t#
sl_zigbee_sec_man_flags_t
Security Manager context flags.
| Enumerator | |
|---|---|
| ZB_SEC_MAN_FLAG_NONE | |
| ZB_SEC_MAN_FLAG_KEY_INDEX_IS_VALID | For export APIs, this flag indicates the key_index parameter is valid in the sl_zb_sec_man_context_t structure. This bit is set by the caller when intending to search for a key by key_index. This flag has no significance for import APIs. |
| ZB_SEC_MAN_FLAG_EUI_IS_VALID | For export APIs, this flag indicates the eui64 parameter is valid in the sl_zb_sec_man_context_t structure. This bit is set by the caller when intending to search for a key by eui64. It is also set when searching by key_index and an entry is found. This flag has no significance for import APIs. |
| ZB_SEC_MAN_FLAG_UNCONFIRMED_TRANSIENT_KEY | Internal use only. This indicates that the transient key being added is an unconfirmed, updated key. This bit is set when we add a transient key and the EmberTcLinkKeyRequestPolicy policy is EMBER_ALLOW_TC_LINK_KEY_REQUEST_AND_GENERATE_NEW_KEY, whose behavior dictates that we generate a new, unconfirmed key, send it to the requester, and await for a Verify Key Confirm message. |
110 of file stack/include/zigbee-security-manager.hTypedef Documentation#
sl_zb_sec_man_key_type_t#
typedef uint8_t sl_zb_sec_man_key_type_t
81 of file stack/include/zigbee-security-manager.hsl_zb_sec_man_derived_key_type_t#
typedef uint8_t sl_zb_sec_man_derived_key_type_t
99 of file stack/include/zigbee-security-manager.hFunction Documentation#
sl_zb_sec_man_init_context#
void sl_zb_sec_man_init_context (sl_zb_sec_man_context_t * context)
This routine will initialize a Security Manager context correctly for use in subsequent function calls.
| N/A | context |
179 of file stack/include/zigbee-security-manager.hsl_zb_sec_man_import_key#
sl_status_t sl_zb_sec_man_import_key (sl_zb_sec_man_context_t * context, sl_zb_sec_man_key_t * plaintext_key)
Import a key into storage. Certain keys are indexed, while others are not, as described here. If context->core_key_type is.. ..SL_ZB_SEC_MAN_KEY_TYPE_NETWORK, then context->key_index dictates whether to import the current (active) network key (index 0) or the alternate network key (index 1). ..SL_ZB_SEC_MAN_KEY_TYPE_TC_LINK_WITH_TIMEOUT, then context->eui64 must be set. context->key_index is unused. ..SL_ZB_SEC_MAN_KEY_TYPE_APP_LINK, then context->key_index determines which index in the persisted key table that the entry should be stored to. context->eui64 must also be set.
| N/A | context | [IN] The context to set. The context dictates which key type to save, key_index (if applicable) into the relevant key storage, eui64 (if applicable), etc. |
| N/A | plaintext_key | [IN] The key to import. |
..SL_ZB_SEC_MAN_KEY_TYPE_GREEN_POWER_PROXY_TABLE_KEY or SL_ZB_SEC_MAN_KEY_TYPE_GREEN_POWER_SINK_TABLE_KEY, then context->key_index dictates which key entry to import. These Green Power keys are indexed keys, and there are EMBER_GP_PROXY_TABLE_SIZE/EMBER_GP_SINK_TABLE_SIZE many of them. For all other key types, both context->key_index and context->eui64 are not used.Note
The context->derived_type must be SL_ZB_SEC_MAN_DERIVED_KEY_TYPE_NONE, else, an error will be thrown. Key derivations, which are used in crypto operations, are performed using the sl_zb_sec_man_load_key_context routine.
Returns
SL_STATUS_OK upon success, a valid error code otherwise.
211 of file stack/include/zigbee-security-manager.hsl_zb_sec_man_import_link_key#
sl_status_t sl_zb_sec_man_import_link_key (uint8_t index, EmberEUI64 address, sl_zb_sec_man_key_t * plaintext_key)
Import a link key, or SL_ZB_SEC_MAN_KEY_TYPE_APP_LINK key, into storage.
| N/A | index | [IN] The index to set or overwrite in the key table for keys of type SL_ZB_SEC_MAN_KEY_TYPE_APP_LINK. |
| N/A | address | [IN] The EUI belonging to the key. |
| N/A | plaintext_key | [IN] A pointer to the key to import. |
Returns
SL_STATUS_OK upon success, a valid error code otherwise.
225 of file stack/include/zigbee-security-manager.hsl_zb_sec_man_export_link_key_by_index#
sl_status_t sl_zb_sec_man_export_link_key_by_index (uint8_t index, sl_zb_sec_man_context_t * context, sl_zb_sec_man_key_t * plaintext_key, sl_zb_sec_man_aps_key_metadata_t * key_data)
Export an APS link key by index.
| N/A | index | |
| N/A | context | |
| N/A | plaintext_key | |
| N/A | key_data |
232 of file stack/include/zigbee-security-manager.hsl_zb_sec_man_export_link_key_by_eui#
sl_status_t sl_zb_sec_man_export_link_key_by_eui (EmberEUI64 eui, sl_zb_sec_man_context_t * context, sl_zb_sec_man_key_t * plaintext_key, sl_zb_sec_man_aps_key_metadata_t * key_data)
Search through the Key table to find an entry that has the same EUI address as the passed value. If NULL is passed in for the address then it finds the first unused entry and sets the index in the context.
| N/A | eui | |
| N/A | context | |
| N/A | plaintext_key | |
| N/A | key_data |
242 of file stack/include/zigbee-security-manager.hsl_zb_sec_man_have_link_key#
sl_status_t sl_zb_sec_man_have_link_key (EmberEUI64 eui)
Return true if a link key is available for securing messages sent to the remote device.
| N/A | eui | The long address of a some other device in the network. |
Returns
bool Returns true if a link key is available.
253 of file stack/include/zigbee-security-manager.hsl_zb_sec_man_export_transient_key_by_eui#
sl_status_t sl_zb_sec_man_export_transient_key_by_eui (EmberEUI64 eui64, sl_zb_sec_man_context_t * context, sl_zb_sec_man_key_t * plaintext_key, sl_zb_sec_man_aps_key_metadata_t * key_data)
Search for a transient, or temporary, key entry from key storage by EUI.
| N/A | eui64 | [IN] The EUI to search for. |
| N/A | context | [OUT] The context about the key, filled in upon success. |
| N/A | plaintext_key | [OUT] If the security configuration allows for it, filled in with the key contents upon success. |
| N/A | key_data | [OUT] Filled in with metadata about the key upon success. |
Returns
sl_status_t SL_STATUS_OK upon success, SL_STATUS_NOT_FOUND otherwise.
283 of file stack/include/zigbee-security-manager.hsl_zb_sec_man_export_transient_key_by_index#
sl_status_t sl_zb_sec_man_export_transient_key_by_index (uint8_t index, sl_zb_sec_man_context_t * context, sl_zb_sec_man_key_t * plaintext_key, sl_zb_sec_man_aps_key_metadata_t * key_data)
Search for a transient, or temporary, key entry from key storage by key index.
| N/A | index | [IN] The key_index to fetch. |
| N/A | context | [OUT] The context about the key, filled in upon success. |
| N/A | plaintext_key | [OUT] If the security configuration allows for it, filled in with the key contents upon success. |
| N/A | key_data | [OUT] Filled in with metadata about the key upon success. |
Returns
sl_status_t SL_STATUS_OK upon success, SL_STATUS_NOT_FOUND otherwise.
300 of file stack/include/zigbee-security-manager.hsl_zb_sec_man_export_key#
sl_status_t sl_zb_sec_man_export_key (sl_zb_sec_man_context_t * context, sl_zb_sec_man_key_t * plaintext_key)
Export a key from storage. Certain keys are indexed, while others are not, as described here. If context->core_key_type is.. ..SL_ZB_SEC_MAN_KEY_TYPE_NETWORK, then context->key_index dictates whether to export the current (active) network key (index 0) or the alternate network key (index 1). ..SL_ZB_SEC_MAN_KEY_TYPE_TC_LINK, then context->eui64 is checked if context->flags is set to ZB_SEC_MAN_FLAG_EUI_IS_VALID. If the EUI supplied does not match the TC EUI stored on the local device (if it is known), then an error is thrown. ..SL_ZB_SEC_MAN_KEY_TYPE_TC_LINK_WITH_TIMEOUT, then keys may be searched by context->eui64 or context->key_index. context->flags determines how to search (see sl_zigbee_sec_man_flags_t). ..SL_ZB_SEC_MAN_KEY_TYPE_APP_LINK, then keys may be searched by context->eui64 or context->key_index. context->flags determines how to search (see sl_zigbee_sec_man_flags_t). ..SL_ZB_SEC_MAN_KEY_TYPE_GREEN_POWER_PROXY_TABLE_KEY or SL_ZB_SEC_MAN_KEY_TYPE_GREEN_POWER_SINK_TABLE_KEY, then context->key_index dictates which key entry to export. These Green Power keys are indexed keys, and there are EMBER_GP_PROXY_TABLE_SIZE/EMBER_GP_SINK_TABLE_SIZE many of them. For all other key types, both context->key_index and context->eui64 are not used.
| N/A | context | [IN/OUT] The context to set. The context dictates which key type to export, which key_index (if applicable) into the relevant key storage, which eui64 (if applicable), etc. |
| N/A | plaintext_key | [OUT] The key to export. |
Note
The context->derived_type must be SL_ZB_SEC_MAN_DERIVED_KEY_TYPE_NONE. Other values are ignored.
Returns
SL_STATUS_OK upon success, a valid error code otherwise.
339 of file stack/include/zigbee-security-manager.hsl_zb_sec_man_delete_transient_key#
sl_status_t sl_zb_sec_man_delete_transient_key (sl_zb_sec_man_context_t * context)
Search for a transient, or temporary, key and deletes it from key storage. Keys can be searched by EUI or key_index based on context->flags (see ZB_SEC_MAN_FLAG_EUI_IS_VALID and ZB_SEC_MAN_FLAG_KEY_INDEX_IS_VALID).
| N/A | context | [IN] The context to use to look up a key entry. If the ZB_SEC_MAN_FLAG_EUI_IS_VALID flag is set in context->flags, then the context->eui field is used to search for and delete the key. If the ZB_SEC_MAN_FLAG_KEY_INDEX_IS_VALID flag is set in context->flags, then the context->key_index field is used to search for and delete the key. |
Returns
sl_status_t SL_STATUS_OK upon success, an error code otherwise.
356 of file stack/include/zigbee-security-manager.hsl_zb_sec_man_delete_key_table_key#
sl_status_t sl_zb_sec_man_delete_key_table_key (sl_zb_sec_man_context_t * context)
Delete the key table entry, or a key of type SL_ZB_SEC_MAN_KEY_TYPE_APP_LINK, from storage. Keys can be searched by EUI or key_index based on context->flags (see ZB_SEC_MAN_FLAG_EUI_IS_VALID and ZB_SEC_MAN_FLAG_KEY_INDEX_IS_VALID).
| N/A | context | [IN] The context to use to look up a key entry. If the ZB_SEC_MAN_FLAG_EUI_IS_VALID flag is set in context->flags, then the context->eui field is used to search for and delete the key. If the ZB_SEC_MAN_FLAG_KEY_INDEX_IS_VALID flag is set in context->flags, then the context->key_index field is used to search for and delete the key. |
Returns
sl_status_t SL_STATUS_OK upon success, an error code otherwise.
372 of file stack/include/zigbee-security-manager.hsl_zb_sec_man_check_key_context#
sl_status_t sl_zb_sec_man_check_key_context (sl_zb_sec_man_context_t * context)
Check that the passed key exists and can be successfully loaded. This function does not actually load the context, but only checks that it can be loaded.
| N/A | context | [IN] The context to check for validity. The fields that must be set depend on the key type set in the context, as enough information is needed to identify the key. |
Returns
sl_status_t SL_STATUS_OK upon success, SL_STATUS_NOT_FOUND otherwise.
383 of file stack/include/zigbee-security-manager.hsl_zb_sec_man_get_network_key_info#
sl_status_t sl_zb_sec_man_get_network_key_info (sl_zb_sec_man_network_key_info_t * network_key_info)
Retrieve information about the network key and alternate network key. It will not retrieve the actual network key contents.
| N/A | network_key_info | [OUT] The network key info struct used to store network key metadata, containing information about whether the current and next network keys are set, and the sequence numbers associated with each key. |
Returns
sl_status_t SL_STATUS_OK
396 of file stack/include/zigbee-security-manager.hsl_zb_sec_man_get_aps_key_info#
sl_status_t sl_zb_sec_man_get_aps_key_info (sl_zb_sec_man_context_t * context, sl_zb_sec_man_aps_key_metadata_t * key_data)
Retrieve metadata about an APS key. It does not retrieve the actual key contents.
| N/A | context | [IN/OUT] The context to use to look up a key entry. If the user calls this function with the ZB_SEC_MAN_FLAG_KEY_INDEX_IS_VALID bit set in the context->flag field, then the key_index field in the context argument dictates which entry to retrieve. For keys with timeout and application link keys, the key_index retrieves the indexed entry into the respective table. Upon success, the eui64 field in the context is updated. If the user calls this function with the ZB_SEC_MAN_FLAG_EUI_IS_VALID bit set in the context->flag field, then the eui64 field in the context argument dictates which entry to retrieve. If the context->core_key_type argument is set to SL_ZB_SEC_MAN_KEY_TYPE_NETWORK, an error is returned as network keys are not tied to any specific EUI. If neither the ZB_SEC_MAN_FLAG_KEY_INDEX_IS_VALID bit nor the ZB_SEC_MAN_FLAG_EUI_IS_VALID bit is set in context->flags, then an error will be returned by this function. Upon success in fetching a key, the other fields in this argument are updated (e.g. a successful search by key_index will update the euii64 field). |
| N/A | key_data | [OUT] Metadata to fill in. |
Returns
SL_STATUS_OK if successful, SL_STATUS_NOT_FOUND if the key_index or eui64 does not result in a found entry, SL_STATUS_INVALID_TYPE if the core key type is not an APS layer key (e.g. SL_ZB_SEC_MAN_KEY_TYPE_NETWORK), or SL_STATUS_INVALID_MODE if core_key_type is SL_ZB_SEC_MAN_KEY_TYPE_TC_LINK and the initial security state does not indicate the a preconfigured key has been set (that is, both EMBER_HAVE_PRECONFIGURED_KEY and EMBER_GET_PRECONFIGURED_KEY_FROM_INSTALL_CODE have not been set in the initial security state).
432 of file stack/include/zigbee-security-manager.hsl_zb_sec_man_delete_key#
sl_status_t sl_zb_sec_man_delete_key (sl_zb_sec_man_context_t * context)
Delete a key from storage. Certain keys are indexed, while others are not, as described here. If context->core_key_type is.. ..SL_ZB_SEC_MAN_KEY_TYPE_NETWORK, then context->key_index dictates whether to delete the current (active) network key (index 0) or the alternate network key (index 1). ..SL_ZB_SEC_MAN_KEY_TYPE_TC_LINK_WITH_TIMEOUT, then keys may be searched by context->eui64 or context->key_index. context->flags determines how to search (see sl_zigbee_sec_man_flags_t). ..SL_ZB_SEC_MAN_KEY_TYPE_APP_LINK, then keys may be searched by context->eui64 or context->key_index. context->flags determines how to search (see sl_zigbee_sec_man_flags_t).
| N/A | context | [IN] The context to use to look up a key. |
..SL_ZB_SEC_MAN_KEY_TYPE_GREEN_POWER_PROXY_TABLE_KEY or SL_ZB_SEC_MAN_KEY_TYPE_GREEN_POWER_SINK_TABLE_KEY, then context->key_index dictates which key entry to delete. These Green Power keys are indexed keys, and there are EMBER_GP_PROXY_TABLE_SIZE/EMBER_GP_SINK_TABLE_SIZE many of them. For all other key types, both context->key_index and context->eui64 are not used.Returns
sl_status_t SL_STATUS_OK upon success, an error code otherwise.
459 of file stack/include/zigbee-security-manager.hsl_zb_sec_man_load_key_context#
sl_status_t sl_zb_sec_man_load_key_context (sl_zb_sec_man_context_t * context)
Load the specified key into the Security Manager's internal context. Any subsequent crypto operations will be done with that loaded context.
| N/A | context | [IN] The context to use to look up which key to load. If the derived key type is not SL_ZB_SEC_MAN_DERIVED_KEY_TYPE_NONE, then an appropriate key derivation scheme is applied to the key fetched according to the context supplied. |
Note
Enough information must be passed into context to properly identify the requested key, which is dependent on the key type requested. See sl_zb_sec_man_export_key for the requirements of the context argument based on core_key_type.
Returns
SL_STATUS_OK upon success, an error code otherwise.
478 of file stack/include/zigbee-security-manager.hsl_zb_sec_man_hmac_aes_mmo#
sl_status_t sl_zb_sec_man_hmac_aes_mmo (const uint8_t * input, const uint8_t data_length, uint8_t * output)
Using a previously set key context, the Security Manager will perform an HMAC (keyed hash) using AES-MMO as the hashing algorithm, and AES-128 for the underlying block encryption.
| N/A | input | [IN] Data to be hashed. The keyed part of the keyed hash comes from the previously loaded context, so only data is input here. |
| N/A | data_length | [IN] Length of the data to be hashed. |
| N/A | output | [OUT] Hashed data. |
Returns
sl_status_t SL_STATUS_OK.
495 of file stack/include/zigbee-security-manager.hsl_zb_sec_man_aes_ccm#
sl_status_t sl_zb_sec_man_aes_ccm (uint8_t * nonce, bool encrypt, const uint8_t * input, uint8_t encryption_start_index, uint8_t length, uint8_t * output)
Encrypt the specified data using AES-CCM with AES-128 and a 32-bit MIC.
| N/A | nonce | [IN] Nonce value used as part of CCM* encryption. |
| N/A | encrypt | [IN] Encryption/decryption mode. True if encrypting, false for authenticated decryption. True when using this function for unauthenticated decryption (decrypt bytes in input and do not verify the end of input as a MIC). |
| N/A | input | [IN] Input to the CCM* encryption operation. The function assumes this is in packet format, where authenticated data begins at the location pointed to by input, and is followed by authenticated data. For authenticated decryption, the MIC is assumed to be located following the encrypted data. |
| N/A | encryption_start_index | [IN] Length of the authenticated data, equivalent to the index in input where data to be encrypted/decrypted begins. |
| N/A | length | [IN] Total length of authenticated + encrypted data. |
| N/A | output | [OUT] Output to the CCM* operation. When encrypt is true, this must have space for the input length plus a 4-byte MIC. For authenticated decryption, it must have size at least as large as the input length. |
523 of file stack/include/zigbee-security-manager.hMacro Definition Documentation#
sl_zb_sec_man_import_transient_key#
#define sl_zb_sec_man_import_transient_keyValue:
(eui64, key)
Add a transient or temporary key entry to key storage. A key entry added with this API is timed out after EMBER_TRANSIENT_KEY_TIMEOUT_S seconds, unless the key entry was added using the Network Creator Security component, in which case the key will time out after the longer between ::EMBER_AF_PLUGIN_NETWORK_CREATOR_SECURITY_NETWORK_OPEN_TIME_S seconds and EMBER_TRANSIENT_KEY_TIMEOUT_S seconds.
Returns
See ::zb_sec_man_import_transient_key for return information.
269 of file stack/include/zigbee-security-manager.h