Supporting Encryption on RF24Gateway with Arduino based nRF52x/nRF54x devices

 Supporting Encryption on RF24Gateway with Arduino based nRF52x/nRF54x devices

Security for your IoT networks 

 Since the nRF52x and nRF52840 devices support Authenticated CCM encryption, I decided to play around a bit and see if I could get it working with RF24Gateway. After a little while playing around with Claude, I was able to put together code that allows fully encrypted and authenticated radio networks using the newer nRF devices.  

 

The nRF24 radios only support 32-byte payloads, but RF24Network allows fragmentation & reassembly of those packets. Encryption overhead is 12-bytes, RF24Network overhead is 8-bytes, so that leaves us with only 12-bytes per packet of actual data on the Gateway. This is OK for sending very small packets, and it works well with RF24Ethernet, due to the capabilities of RF24Network (frag & reassembly).

Changes are being made to all the supporting libraries to include these features, including the RPi installer script. Even if encryption support is enabled, users can still run unauthenticated networks by not initializing encryption. To allow encryption, see the RF24Gateway installer, along with the Encryption examples included with nrf_to_nrf.

Changes On the Gateway:  

 A: Add the include

#include <RF24Network/RF24CCM.h> 

 B: Change the constructor and add a key

RF24CCM radio(22, 0);

ESBNetwork<RF24CCM> network(radio);

ESBMesh<ESBNetwork<RF24CCM>, RF24CCM> mesh(radio, network);

ESBGateway<ESBMesh<ESBNetwork<RF24CCM>, RF24CCM>, ESBNetwork<RF24CCM>, RF24CCM> gw(radio, network, mesh);

uint8_t encryptionKey[RF24CCM_KEY_SIZE] = {0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10}; 

C: Before begin, call

 radio.setKey(encryptionKey);
 radio.enableEncryption = true;

 

Changes to the nrf_to_nrf examples:

A: Add key 

 uint8_t myKey[RF24CCM_KEY_SIZE] = {0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10};

 B: Enable encryption before calling mesh.begin

   radio.setKey(myKey);

 radio.enableEncryption = true;

  Note: Don't call radio.enableDynamicPayloads(254); since we are using the default of 32-byte payloads.

 

Data is encrypted at the radio layer, so only raw radio addresses are exposed. As of this writing, these changes are not fully in yet, but will be pushed very soon. Users will be required to update most of the RF24 Comm stack, including RF24Network, RF24Mesh, RF24Gateway, and nrf_to_nrf libraries.