🛠 Canal sécurisé : OTAA, MIC et élément ATECC508

Objectives

There is no TLS on this board (no Wi-Fi, hence no WiFiSSLClient). The equivalent "secure channel" is LoRaWAN security: OTAA join with key derivation, MIC integrity (AES-128) on each frame, and key protection within the MKR ecosystem (embedded ATECC508 element). This tutorial covers key best practices and link verification.

Hardware

• 1 Arduino MKR WAN 1300 (embedded ATECC508 secure element)
• LoRaWAN server with a strong App Key (128 random bits, unique per device)
• >

Complete code

#include <MKRWAN.h>

LoRaModem modem;

// En production : NE JAMAIS laisser les cles en clair dans le depot.
// Les stocker hors du code (zone config, element securise) et les regenerer.
String appEui = "0080000000000001";
String appKey = "GENEREE_PAR_TON_SERVEUR_32_HEX";

void setup {
  Serial.begin(115200);
  if (!modem.begin(EU868)) while (1) {}
  // OTAA (mode 1) : derive NwkSKey/AppKey par session, prefere a ABP (mode 0)
  if (!modem.joinOTAA(appEui, appKey)) {
    Serial.println("Join refuse : verifier AppEUI/AppKey et couverture");
    while (1) {}
  }
  modem.minPollInterval(60);
  modem.linkAdaptiveDataRate(true);  // ADR : monte la DR quand le lien est bon
}

void loop {
  modem.beginPacket;
  modem.print("secure");
  // uplink confirmee = ACK signe MIC : preuve de reception integre
  bool ok = modem.endPacket(true) > 0;
  Serial.print(ok ? "MIC OK " : "MIC ECHEC ");
  Serial.print("rssi="); Serial.print(modem.readRSSI);
  Serial.print(" snr="); Serial.println(modem.readSNR);
  delay(120000);
}

Expected verification

The OTAA join creates a fresh session (session keys never travel in clear text); confirmed uplinks receive an ACK whose MIC validates integrity. On the server side, the session changes after each rejoin.

Common errors

• Using ABP instead of OTAA: static keys are replayable (known regression in joinABP between MKRWAN 1.0.14 and 1.0.15, issue #85).
• Weak App Key or shared between devices: each device must have its unique key.
• Assuming the ATECC508 is used automatically: without dedicated code, keys remain in clear text in the sketch.