KNX IP Secure Setup: AES-128-Verschlüsselung, Zertifikate und ETS6-Sicherheitskonfiguration

ETS6 IP Secure Aktivierungsschritte

Step 1: Open ETS6 project
  Project > Properties > Security tab
  Enable: "KNX IP Secure" checkbox → ON
  ETS6 generates backbone key (256-bit random)
  Backbone key is stored in ETS6 project file

Step 2: Add IP Secure devices to project
  Scan topology → ETS6 finds IP routers and interfaces
  ETS6 reads X.509 certificate from each device
  Verify: manufacturer name and device serial on certificate
  matches label on physical device (anti-substitution check)

Step 3: Generate toolkeys for tunnelling connections
  Each ETS6 tunnelling connection requires a toolkey
  ETS6 > Settings > Security > Toolkeys > Generate
  One toolkey per IP router tunnelling slot used by ETS6
  Toolkey enables ETS6 to establish encrypted programming session

Step 4: Download security configuration
  Full Device Configuration download sends:
  - KNX application (as usual)
  - Encrypted backbone key (encrypted with device public key)
  - Toolkey assignment
  Keys are never transmitted in plaintext — encrypted with
  the device's public key extracted from X.509 certificate

Schlüsselverteilungsmechanismus

Key hierarchy:
  Backbone key:  Generated by ETS6, one per project
                 Used for KNXnet/IP routing between all IP routers
  Toolkey:       Generated by ETS6, one per tunnelling connection
                 Used for ETS6 programming sessions (tunnelling)
  Session key:   Temporary, generated fresh per communication session
                 Derived from backbone/toolkey using key derivation

Key distribution (during Full Device Config download):
  ETS6 reads device X.509 certificate → gets device public key
  ETS6 encrypts backbone key with device public key (RSA/ECDH)
  Encrypted backbone key sent to device over KNXnet/IP
  Device decrypts using its private key (stored in hardware)
  Device stores backbone key in secure storage (hardware protected)

  Private key NEVER leaves the device
  Backbone key NEVER transmitted in plaintext

Verification that download succeeded:
  ETS6 shows "Security: Configured" on each IP router icon
  Green padlock indicator in ETS6 topology view
  Device responds to ETS6 scan with secured acknowledgment

Keyring-Export und Sicherheitsverfahren

Export procedure in ETS6:
  Project > Security > Export Keyring → .knxkeys file
  Set strong password (minimum 20 characters, mixed case + symbols)
  Record password in password manager (1Password, Bitwarden)
  Never store password in same location as .knxkeys file

.knxkeys file contents:
  Backbone key for each IP router in the project
  Toolkeys for each tunnelling connection
  Device individual addresses and individual keys (if Data Secure)

Delivery to third-party systems:
  Gira X1 HomeServer: upload .knxkeys in X1 web interface
  OpenHAB KNX binding: import .knxkeys via OH3 console
  KNX IoT gateway: import via gateway admin interface
  Transfer: encrypted channel only (HTTPS admin interface, not email)

Backup and loss recovery:
  Store .knxkeys in encrypted network share (not USB only)
  Offsite backup: encrypted cloud storage or remote NAS
  Test restore: verify backup .knxkeys opens in ETS6 before handover

  If .knxkeys lost AND ETS6 project backup lost:
  → Must factory reset every IP Secure device and reprogram
  → All KNX application and security config cleared
  → Full ETS6 download required on all devices
  → Estimate 1–2 days per large installation to recover

Überprüfungstests für KNX IP Secure

Test 1 — Wireshark capture verification:
  Connect laptop to KNX VLAN switch (mirror port or TAP)
  Capture on KNXnet/IP port 3671
  Filter: udp.port == 3671
  Expected: KNXnet/IP packets contain Security wrapper
  cEMI payload should be opaque (encrypted)
  If plaintext cEMI visible: IP Secure not active → investigate

Test 2 — ETS6 Group Monitor verification:
  Open ETS6 Group Monitor while Wireshark captures
  Actuate a KNX scene → observe Group Monitor telegrams
  ETS6 should display decoded telegram (decrypts locally)
  Wireshark should show same packet as encrypted cEMI
  → Confirms end-to-end encryption with ETS6 decryption

Test 3 — Unauthorised access rejection:
  Attempt to connect with ETS6 using WRONG toolkey
  (use different ETS6 install without toolkey imported)
  Expected: ETS6 reports "Authentication failed" or timeout
  Device must refuse connection without correct toolkey

Test 4 — Replay attack rejection:
  Replay a captured packet using Wireshark + packet injector
  Expected: router rejects packet (sequence number already used)
  ETS6 Group Monitor: no spurious telegram visible

Fallback-Szenarien und Wiederherstellung

Scenario 1: Power loss during key programming download
  Device may have partial key configuration
  Symptom: ETS6 cannot connect, device shows as unsecured
  Recovery: re-initiate Full Device Configuration download
  from ETS6 with correct toolkey — overwrites partial config

Scenario 2: Toolkey lost, ETS6 project available
  Recovery: factory reset IP router (physical button, hold 10s)
  Factory reset: clears keys AND KNX application
  Re-download from ETS6 with regenerated toolkey
  Duration: 15–30 minutes per device including reprogram

Scenario 3: ETS6 project lost, keyring backup available
  .knxkeys file allows third-party systems to continue
  operating (HomeServer, ARISTO) during ETS6 project recovery
  Restore ETS6 project from backup → verify toolkeys match
  If toolkeys differ: factory reset devices and reprogram

Scenario 4: Both ETS6 project and keyring lost (worst case)
  Full factory reset of every IP Secure device required
  Rebuild ETS6 project from documentation and group address tables
  Duration: 2–5 days for large commercial installation
  Mitigation: daily ETS6 project backup to two independent locations