Commissioner/Joiner Example

[Campbell Wray]

I have looked at the CLI commands sheet but I have a few questions about how the commissioner/joiner method of setup differs from the standard CLI setup?

1. What is the commissioner and what is it used for? does it provide some sort of security or authentication?
2. What is the ot-psk - do you literally just type "ot-psk", or are you supposed to define a passphrase here
3. Is there anything stopping a device wanting to join from just entering the panid and joining using the standard CLI setup method thus bypassing the commissioner

These are possibly stupid questions but I can quite new to OpenThread and networking in general

[Jonathan Hui]

See responses below:

On Thu, Apr 13, 2017 at 4:29 PM, Campbell Wray <campbe...@gmail.com> wrote:

I have looked at the CLI commands sheet but I have a few questions about how the commissioner/joiner method of setup differs from the standard CLI setup?

Setting parameters like the channel, PAN ID, and master key directly is considered "out-of-band" commissioning, where you are manually passing network configuration parameters to the stack.  Thread defines a commissioning protocol that allows secure authentication of joining devices over an insecure channel (e.g. IEEE 802.15.4) and secure transfer of the network configuration parameters.  The Thread Commissioning protocol is the "Thread standard" way of providing network configuration parameters to a device you're trying to add to the network. 

1. What is the commissioner and what is it used for? does it provide some sort of security or authentication?

The commissioner is used to authenticate new devices onto a Thread Network.  In a typical use case, a commissioner will actually be an app on your mobile phone.  You scan a QR code on the device you wish to join to your network.

1. What is the ot-psk - do you literally just type "ot-psk", or are you supposed to define a passphrase here

Yes, that pre-shared key (PSK) is intended to be unique to the device and something difficult to guess so that someone cannot "hijack" your device.

1. Is there anything stopping a device wanting to join from just entering the panid and joining using the standard CLI setup method thus bypassing the commissioner

If you know the master key used to secure communication within a Thread network, then you have full access to the Thread network.

 

These are possibly stupid questions but I can quite new to OpenThread and networking in general

No worries. :)

Hope that helps.

--

Jonathan Hui

 

[jbumg...@google.com]

Hey Campbell, if you're new to OpenThread, I highly recommend also checking out the new Codelab we recently published... covers a lot of the basics, including a more detailed version of the Commissioning example.

https://codelabs.developers.google.com/codelabs/openthread-simulation/#0

[Campbell Wray]

Cheers Jonathan,

One thing I have noticed in my tests is that the joiner receives the master key after a successful authentication, how is this done, and is it possible for this to be intercepted by a third party using a wireless sniffer?

Campbell

[Campbell Wray]

Thanks jbumg, I have only just seen your reply now, but I will be sure to check it out

[Jonathan Hui]

The master key is communicated in a Joiner Entrust message that is encrypted using a pairwise shared secret derived as part of the DTLS handshake.

For more details, reference Chapter 8 in the Thread Specification.

--

Jonathan Hui

[jack....@gmail.com]

Security and joining a network works nice with simulation!
I've added command to wpantund to make NCP a commissioner of the network. 
Is the following use case OK?

1. NCP form a network "openthread"

2. NCP start commissioner 

3. A FTD tries to JOIN "openthread"

4. NCP add a JOINER with passphrase "openthread"

5. FTD receives network data (masterkey, panid, channel) and is allowed to enter the network

[jack....@gmail.com]

At step 2, NCP commissioner is locked in OT_COMMISSIONER_STATE_PETITION and never goes to OT_COMMISSIONER_STATE_ACTIVE

What could happen and what is the NCP waiting for to go on ACTIVE state? It is NCP FTD example, NCP form a network as router and becomes leader.

EDIT: 

Commissioner is not locked OT_COMMISSIONER_STATE_PETITION state, it goes from DISABLED to PETITION to DISABLED. So why NCP can't become Commissioner?

[jack....@gmail.com]

EDIT: I'll write a new post since it seems to be another error not related to NCP

[Kister Genesis Jimenez]

Hi Jonathan!

let me just confirm if I am right in this:

If I use the commissioner joiner is the what happen with the devices and the commissioner?
1. commissioner app scans QR code for passphrase on the device. Passphrase is added.
2. when devices boots, it will start to join using the passphrase
3. Since my commissioner has added the passphrase, it will allow device to join and send network details including masterkey.

What will happen if another commissioner(let say my neighbor) scans my device QR code (Assuming my commissioner is down)? Will my neighbor be able to join my device?

Also, does NCP supports commissioning now?

Right now I am trying to figure out how to do this securely my initial idea. I although I did not know about #3 until I read this email thread.

[Jonathan Hui]

Responses below:

On Sun, Jul 30, 2017 at 11:40 AM, Kister Genesis Jimenez <engka...@gmail.com> wrote:

Hi Jonathan!

let me just confirm if I am right in this:

If I use the commissioner joiner is the what happen with the devices and the commissioner?
1. commissioner app scans QR code for passphrase on the device. Passphrase is added.
2. when devices boots, it will start to join using the passphrase
3. Since my commissioner has added the passphrase, it will allow device to join and send network details including masterkey.

What will happen if another commissioner(let say my neighbor) scans my device QR code (Assuming my commissioner is down)? Will my neighbor be able to join my device?

Anyone who has knowledge of the device-specific passphrase can commission that device onto their network.  How that passphrase is delivered to the user (e.g. printed on the packaging) is a product-specific decision.

 

Also, does NCP supports commissioning now?

Yes, the NCP supports two models:

1) On-Mesh Commissioner, where the NCP directly implements the Commissioner and APIs are exposed via Spinel and wpantund (see relevant wpantund PR).

2) External Commissioner, where the NCP is attached to a Border Router that provides support to a mobile device with a Commissioning app (see border router project).

--

Jonathan Hui

Right now I am trying to figure out how to do this securely my initial idea. I although I did not know about #3 until I read this email thread.

--
You received this message because you are subscribed to the Google Groups "openthread-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openthread-users+unsubscribe@googlegroups.com.
To post to this group, send email to openthread-users@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/openthread-users/c4249e88-4365-4f88-aad6-c874d0a0d2dc%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.