NwkSKey

NwkSKey, short for Network Session Key, is a 128-bit symmetric key used in LoRaWAN to secure network-layer communications. It is one of the session keys established after a device joins the network, the other being the AppSKey (Application Session Key). In over-the-air activation (OTAA), NwkSKey and AppSKey are derived from a device root key during the join procedure and are provisioned to both the device and the network server; in activation-by-personalization (ABP), the keys are pre-shared and installed on the device and the network server.

The primary role of the NwkSKey is to provide integrity protection and confidentiality at the LoRaWAN MAC layer. It is used to generate and verify the Message Integrity Code (MIC) for uplink and downlink messages and to encrypt/decrypt the MAC payload and related downlink MAC commands. The AppSKey, in contrast, handles the encryption and decryption of the application payload, separate from the network-layer protections provided by the NwkSKey.

Security considerations include the sensitivity of NwkSKey to network integrity, since a compromise can allow tampering with messages or spoofing of network commands. In typical deployments, keys are kept confidential and may be rotated or refreshed during join procedures or via key management practices. The keys are designed to be 128 bits long to provide a high level of cryptographic strength.

See also: AppSKey, AppKey, LoRaWAN.