OTAA and Lora Server encryption key security

ChirpStack Network Server
1

Hi @brocaar, i have some question regarding the security of the LoraServer.
If we have an IOT operator between the nodes and this server, the AppSKey is only visible to the server? or the IOT operator can see this information?
What is the protection/safe mechanism of share of AppSKey to the Lora server?
Many thanks

2

Only the devices and the LoRa App Server instance(s) know the root keys. Then LoRa App Server knows of course the AppSKey, the network-server (LoRa App Server) only knows the NwkSKey.

3

Thanks for the quick and helpful answer

4

Is there any option to view the AppsKey and NwkSKey in LoRa Server for OTAA communication?

5

As mentioned, LoRa Server does not know the AppSKey, only LoRa App Server knows and should know this key. This information can be viewed in the UI under:

image
image.png1242×756 38.9 KB

Or using the API GET /api/devices/{devEUI}/activation

From LoRa Server you can get the device-activation (only NwkSKey!) using this API method: https://github.com/brocaar/loraserver/blob/master/api/ns/ns.proto#L64