User's Manual

USER MANUAL PREVIEW

PTM 535BZ – BLUETOOTH AND ZIGBEE GREEN POWER PUSHBUTTON TRANSMITTER

E. Address resolution for resolvable private addresses (RPA)

PTM 535BZ provides the option to obfuscate its identity by means of using resolvable private

addresses (RPA that are generated using an Identity Resolution Key as described in Chapter

3.3.5.2. This appendix provides an example how to generate and resolve such address.

E.1 Address resolution example

We consider a PTM 535BZ module with the following 128 bit IRK:

IRK = BE759A027A4870FD242794F4C45220FB

We further consider a telegram with the following 48 bit resolvable private address:

RPA = 493970E51944

We will now test if this resolvable private address was generated using the IRK above.

Referring to the resolvable private address structure shown in Figure 12, we split the re-

solvable private address into prand and hash as follows:

prand = (RPA & 0xFFFFFF000000) >> 24

prand = 0x493970

hash = RPA & 0x000000FFFFFF

hash = 0xE51944

Next, we verify the address mode by checking the two most significant bit of prand:

mode = (prand & 0xC00000) >> 22

mode = 0b01

Referring to Chapter 3.3.5.2, the setting of 0b01 indicates resolvable private address mode.

To generate the hash, we add 104 bit of padding (all zeros) to prand:

padded prand = 0x00000000000000000000000000493970

We can now generate the hash as AES128 operation between IRK and padded prand:

hash = AES128(IRK; padded prand)

hash = AES128(0xBE759A027A4870FD242794F4C45220FB;0x00000000000000000000000000493970)

At the time of writing, a suitable online AES calculator could be found in [8]. With this, we

can calculate the result as:

hash = 0x286ACB1F9C8A80EE21B3F02225E51944

With that, we can verify that the lowest 24 bit of the calculated hash (0xE51944) match the

hash that was received as part of the resolvable private address. Therefore, the transmitter

of this telegram used this specific IRK to generate this resolvable private address.