AppSKey

AppSKey, short for Application Session Key, is a 128-bit key used in LoRaWAN to encrypt and decrypt the payloads of application data. It provides end-to-end confidentiality for the application payload between the end device and the application server, separate from the network security functions that protect the LoRaWAN frame.

The AppSKey is distinct from the NwkSKey, which handles network-layer security and message integrity. While the AppSKey encrypts the application payload, the NwkSKey is involved in securing the network portion of messages and in calculating the message integrity code (MIC). Together, these keys support different layers of LoRaWAN security.

Derivation and provisioning of AppSKey depend on the activation method. In over-the-air activation (OTAA), the AppSKey is derived during the join process from the device’s AppKey and join information and is subsequently provided to the device and the application server. In activation-by-personalization (ABP), the AppSKey is provisioned to the device and the backend manually. The AppSKey remains the same for the device session unless rotated or re-provisioned.

Typical characteristics include a 16-byte (128-bit) key size and its storage on the device and in the application server, with appropriate protection to prevent disclosure. Key management and rotation are important security considerations, as compromising the AppSKey reveals the confidentiality of application payloads.

Notes: The AppSKey is part of LoRaWAN’s approach to separating application-level security from network-level security, a distinction retained across core versions of the specification.