KNX IP Secure Setup: AES-128 Encryption, Certificates and ETS6 Security Configuration
KNX IP Secure extends AES-128 encryption and cryptographic authentication to KNXnet/IP routing and tunnelling connections — protecting the IP backbone of a KNX installation from eavesdropping and unauthorised control without requiring changes to the KNX TP bus wiring or devices.
KNX IP Secure overview
KNX IP Secure is defined in ISO 22510 and the KNX IP Secure specification. It applies cryptographic protection to KNXnet/IP communication — the IP-based protocol used for KNX routing between lines and for tunnelling connections used by ETS6 programming and visualisation servers. KNX IP Secure does not encrypt telegrams on the KNX TP bus itself — that is the separate KNX Data Secure standard.
| Security mechanism | Algorithm | Purpose |
|---|---|---|
| Encryption | AES-128-CBC | Protect telegram content from eavesdropping on IP network |
| Authentication | HMAC-SHA256 | Verify telegram origin — detect tampering or injection |
| Replay protection | Sequence number (6 bytes) | Reject replayed captured packets |
| Key exchange | X.509 device certificates + ETS6 backbone key | Secure initial key distribution |
Scope of KNX IP Secure: KNX IP Secure protects KNXnet/IP routing (multicast between IP routers, UDP port 3671) and KNXnet/IP tunnelling (ETS6 programming sessions, HomeServer connections). It does NOT protect KNX TP bus telegrams — physical access to the TP bus still allows telegram interception. Use KNX Data Secure additionally for sensitive TP bus circuits.
Supported devices
KNX IP Secure requires hardware cryptography support in the IP router or tunnelling interface. Legacy devices without hardware crypto modules cannot be upgraded to support KNX IP Secure — they must be replaced with Secure-capable hardware. Certified devices carry the KNX Secure DiiA mark on the product and its datasheet.
KNX IP Secure capable devices (examples)
- MDT SCN-IP100.02 — KNX IP router with IP Secure
- Gira X1 (firmware ≥ 3.x) — IP interface with IP Secure tunnelling
- ABB IPS/S 2.1 — IP/TP coupler with Secure
- Weinzierl KNX IP Interface 740 — tunnelling interface with Secure
- Siemens N146/01 — KNX IP router with Secure (building automation)
Non-upgradeable legacy devices
Older KNX IP routers (e.g. MDT SCN-IP100.01, ABB IPS/S 2.1 pre-2018 firmware) do not have the hardware security module required for AES-128 encryption. Firmware updates cannot add IP Secure to these devices. In mixed environments: all IP routers must support IP Secure for consistent protection — a single non-Secure router on the backbone creates a security gap.
ETS6 project security setup
KNX IP Secure is configured entirely within ETS6. The security configuration generates cryptographic keys, reads device certificates, and distributes keys to devices during the standard ETS6 download process — no separate security configuration tool is required.
ETS6 IP Secure activation steps
Step 1: Open ETS6 project Project > Properties > Security tab Enable: "KNX IP Secure" checkbox → ON ETS6 generates backbone key (256-bit random) Backbone key is stored in ETS6 project file Step 2: Add IP Secure devices to project Scan topology → ETS6 finds IP routers and interfaces ETS6 reads X.509 certificate from each device Verify: manufacturer name and device serial on certificate matches label on physical device (anti-substitution check) Step 3: Generate toolkeys for tunnelling connections Each ETS6 tunnelling connection requires a toolkey ETS6 > Settings > Security > Toolkeys > Generate One toolkey per IP router tunnelling slot used by ETS6 Toolkey enables ETS6 to establish encrypted programming session Step 4: Download security configuration Full Device Configuration download sends: - KNX application (as usual) - Encrypted backbone key (encrypted with device public key) - Toolkey assignment Keys are never transmitted in plaintext — encrypted with the device's public key extracted from X.509 certificate
Device certificate management
Each KNX IP Secure device ships from the factory with an X.509 certificate signed by the manufacturer’s certificate authority. ETS6 validates the entire certificate chain. Certificate validity period is critical for long-lived building installations — certificates that expire during the building’s service life require device replacement.
Certificate validation in ETS6
ETS6 reads the X.509 certificate during device scan and validates: certificate chain to manufacturer CA, serial number matches device label, certificate not expired, certificate not revoked (if CRL available).
If ETS6 reports “Certificate invalid”: do not proceed with download. Replace the device — field renewal of factory certificates is not possible. Contact the manufacturer for RMA if certificate was invalid at delivery.
Long-lived project certificate strategy
For projects with 15–20 year expected service life: specify KNX IP Secure devices with certificate validity of 20 years or longer at procurement. Ask manufacturer for certificate expiry date at product selection stage.
Document certificate expiry dates in the building technical manual and operations plan. Schedule device replacement budget before expiry. Alternatively: plan for re-provisioning with new keys at certificate renewal — requires full ETS6 download.
Key assignment and download
ETS6 manages all cryptographic key material for KNX IP Secure. The key distribution mechanism ensures that session keys are never exposed in plaintext during the programming process — the security of the entire installation depends on the integrity of the ETS6 download process.
Key distribution mechanism
Key hierarchy:
Backbone key: Generated by ETS6, one per project
Used for KNXnet/IP routing between all IP routers
Toolkey: Generated by ETS6, one per tunnelling connection
Used for ETS6 programming sessions (tunnelling)
Session key: Temporary, generated fresh per communication session
Derived from backbone/toolkey using key derivation
Key distribution (during Full Device Config download):
ETS6 reads device X.509 certificate → gets device public key
ETS6 encrypts backbone key with device public key (RSA/ECDH)
Encrypted backbone key sent to device over KNXnet/IP
Device decrypts using its private key (stored in hardware)
Device stores backbone key in secure storage (hardware protected)
Private key NEVER leaves the device
Backbone key NEVER transmitted in plaintext
Verification that download succeeded:
ETS6 shows "Security: Configured" on each IP router icon
Green padlock indicator in ETS6 topology view
Device responds to ETS6 scan with secured acknowledgmentKeyring export (.knxkeys)
The .knxkeys file is a password-protected archive containing all session keys needed for third-party systems (HomeServer, ARISTO, OpenHAB) to communicate with KNX IP Secure routers. Without the keyring file, third-party systems cannot decrypt or send KNXnet/IP telegrams on a Secure backbone.
Keyring export and security procedure
Export procedure in ETS6: Project > Security > Export Keyring → .knxkeys file Set strong password (minimum 20 characters, mixed case + symbols) Record password in password manager (1Password, Bitwarden) Never store password in same location as .knxkeys file .knxkeys file contents: Backbone key for each IP router in the project Toolkeys for each tunnelling connection Device individual addresses and individual keys (if Data Secure) Delivery to third-party systems: Gira X1 HomeServer: upload .knxkeys in X1 web interface OpenHAB KNX binding: import .knxkeys via OH3 console KNX IoT gateway: import via gateway admin interface Transfer: encrypted channel only (HTTPS admin interface, not email) Backup and loss recovery: Store .knxkeys in encrypted network share (not USB only) Offsite backup: encrypted cloud storage or remote NAS Test restore: verify backup .knxkeys opens in ETS6 before handover If .knxkeys lost AND ETS6 project backup lost: → Must factory reset every IP Secure device and reprogram → All KNX application and security config cleared → Full ETS6 download required on all devices → Estimate 1–2 days per large installation to recover
Toolkey management
The toolkey is the cryptographic credential that allows ETS6 to establish an encrypted tunnelling connection to a KNX IP Secure router for programming. Without the correct toolkey, ETS6 cannot program or monitor secured devices — even with physical access to the LAN.
Toolkey migration between ETS6 installs
If the ETS6 installation changes (new PC, reinstall): export toolkeys from the old ETS6 installation before decommissioning it.
ETS6 Settings > Security > Toolkeys > Export. Import to new ETS6 installation using the same menu. Without toolkey migration: ETS6 on the new PC cannot connect to secured IP routers for programming.
Factory reset recovery
If toolkey is lost and no backup: factory reset the IP router using its physical reset button (hold 10 seconds). This clears all security keys AND the KNX application.
After factory reset: re-add device to ETS6 project, generate new toolkey, perform Full Device Configuration download. Plan: always maintain toolkey backup in the encrypted project backup before any on-site programming work.
Commissioning verification
After completing the KNX IP Secure setup, commissioning verification confirms that encryption is active and that unauthorised access attempts are rejected. Verification should be performed before handover and documented in the commissioning record.
Verification tests for KNX IP Secure
Test 1 — Wireshark capture verification: Connect laptop to KNX VLAN switch (mirror port or TAP) Capture on KNXnet/IP port 3671 Filter: udp.port == 3671 Expected: KNXnet/IP packets contain Security wrapper cEMI payload should be opaque (encrypted) If plaintext cEMI visible: IP Secure not active → investigate Test 2 — ETS6 Group Monitor verification: Open ETS6 Group Monitor while Wireshark captures Actuate a KNX scene → observe Group Monitor telegrams ETS6 should display decoded telegram (decrypts locally) Wireshark should show same packet as encrypted cEMI → Confirms end-to-end encryption with ETS6 decryption Test 3 — Unauthorised access rejection: Attempt to connect with ETS6 using WRONG toolkey (use different ETS6 install without toolkey imported) Expected: ETS6 reports "Authentication failed" or timeout Device must refuse connection without correct toolkey Test 4 — Replay attack rejection: Replay a captured packet using Wireshark + packet injector Expected: router rejects packet (sequence number already used) ETS6 Group Monitor: no spurious telegram visible
Fallback and recovery
KNX IP Secure devices have defined fallback behaviour when security configuration is incomplete or corrupt. Understanding the fallback states prevents a misconfigured security setup from rendering a building’s KNX system inoperable.
Fallback scenarios and recovery
Scenario 1: Power loss during key programming download Device may have partial key configuration Symptom: ETS6 cannot connect, device shows as unsecured Recovery: re-initiate Full Device Configuration download from ETS6 with correct toolkey — overwrites partial config Scenario 2: Toolkey lost, ETS6 project available Recovery: factory reset IP router (physical button, hold 10s) Factory reset: clears keys AND KNX application Re-download from ETS6 with regenerated toolkey Duration: 15–30 minutes per device including reprogram Scenario 3: ETS6 project lost, keyring backup available .knxkeys file allows third-party systems to continue operating (HomeServer, ARISTO) during ETS6 project recovery Restore ETS6 project from backup → verify toolkeys match If toolkeys differ: factory reset devices and reprogram Scenario 4: Both ETS6 project and keyring lost (worst case) Full factory reset of every IP Secure device required Rebuild ETS6 project from documentation and group address tables Duration: 2–5 days for large commercial installation Mitigation: daily ETS6 project backup to two independent locations
Need KNX IP Secure configured for your commercial installation?
We configure KNX IP Secure with AES-128 encryption, manage X.509 certificates in ETS6, and provide complete keyring backup and commissioning documentation — suitable for government and commercial projects requiring certified security.
Request a quote →