8

I'm currently trying to decrypt the traffic in a IKEA Tradfri Network (some bulbs, a 5-button remote, a gateway). I use a CC2531 Sniffer with ZBOSS and Wireshark to sniff the traffic. This is working perfectly fine but I am having a hard time decrypting the packets.

I was expecting that I could sniff the process of adding a new bulb to the network where at some point the network_key encrypted with the pre-shared Trust Center link key (e.g. as mentioned here) will be exchanged between the remote and the bulb. I successfully tried this with a comparable Hue setup but struggle with Tradfri now.

I was able to capture the Network Join Router Requestand Network Join Router Response messages and was expecting the key transmission somewhere near that - but had no success.

Am I missing something? Is another pre-shared key used for Tradfri or their TouchLink implementation? Any feedback is highly appreciated.

Edit: I forgot to mention the keys I already tried:

  • The standard ZigBeeAlliance09 TC Link key
  • The supposed ZLL master key (e.g. as stated in the source I mentioned before)
  • This key which worked for my described Hue setup
Improve this question

1 Answer 1

Reset to default
5

It's unclear from your post which link key you are using. If it is the standard ZigBeeAlliance09 TC link key referenced in the post, then it will likely not work since Tradfri uses ZigBee Light Link. ZLL uses a different link key to the ZigBee Home Automation / ZigBee 3.0 well known shared key and The ZLL master key is not publicly available (although there are some links on the page you referenced that do provide it).

Improve this answer
4
  • Are you sure Tradfri are ZLL? I don’t have any bulbs, but all Tradfri devices I have are ZHA, not ZLL, at least in terms of clusters involved.
    – jcaron
    May 9, 2020 at 20:51
  • Clusters are exactly the same for ZLL and ZHA - there is only 1 ZigBee Cluster Library and different ZigBee profiles will use the same clusters. I've never looked at what the Ikea hub does, so I'm not 100% sure, but from what I've seen with my work they are likely to use ZLL. Once they are in the network they will work fine with ZHA devices, but here we are talking about how the Ikea hub joins devices to its network.
    – cdjackson
    May 10, 2020 at 8:23
  • @cdjackson Thanks a lot for your answer and sorry for the missing keys - I edited my question. I also think Tradfri are ZLL. So is there no way of decrypting the Tradfri traffic since the ZLL master key is not public or do you know of any other chance?
    – ItsMarvolo
    May 10, 2020 at 12:20
  • Unfortunately without the correct key, there is really no chance to decrypt the traffic, so if those keys do not work, then I'm afraid I don't have any new suggestion - sorry.
    – cdjackson
    May 10, 2020 at 16:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.