# Enterprise Security for the Internet of Things (IoT): Lightweight Bootstrapping with EAP-NOOB
## 2 Background
### Standards  
Zigbee [9] is an IEEE 802.15.4-based open standard specified by the Zigbee alliance for creating and maintaining short-range personal area networks (PANs). It is intended for low-cost appliances, such as those used in home automation and health care. Over the years, various application profiles for the Zigbee standard have been developed, each defining the message formats and processing requirements for complying devices [10]. For example, the Zigbee Light Link (ZLL) [11] profile is specified for controlling lights in consumer households, while the Zigbee Home Automation (ZHA) [12] profile is specified for smart home appliances, such as wireless window shades and intruder alarms. The bootstrapping method used by Zigbee devices varies between the different application profiles. For example, the ZLL profile uses a master key for deriving the active network key when a new device joins an existing network. This master key must be known by all devices implementing the protocol and it is provisioned at the time of the device manufacturing. Therefore, ZLL implicitly assumes that all devices (and manufacturers) implement sufficient security for storing and processing the master key. However, in 2015, the master key of the ZLL profile was leaked out on Twitter, compromising the security of all previously manufactured devices while using the protocol [13]. Similarly, in the Zigbee Home Automation profile, a default link key is used as a fallback method for unknown devices. An attacker can use this fallback mode to sniff traffic and decipher the active network key [10]. The Thread stack [2] is an open standard for IPv6-based low-power device-to-device communication. Similarly to Zigbee, it builds upon the IEEE 802.15.4 link layer. Thread defines protocols that are necessary for forming, joining, and maintaining networks of low-cost wireless devices that are used in home automation, lighting, and healthcare applications. The security of Thread networks is primarily based on a network-wide shared passphrase [14]. This passphrase can be a well-known weak default, such as '123456' used by Nordic Semiconductor Thread devices [15], or it can be configured by the user. A well-known weak default passphrase obviously makes the entire network vulnerable. User configured network-wide passphrases are naturally better than well-known defaults. Thread relies on the Password-Authenticated Key Exchange by Juggling (J-PAKE) protocol for preventing dictionary attacks against user-selected passphrases. However, relying on the same network-wide passphrase still makes the system fragile, as compromise of a single device can leak the shared passphrase of the entire network. Additionally, using the same passphrase across all devices renders revocation of individual devices extremely challenging: a user would have to configure the new passphrase on all of the remaining devices in the network. Z-Wave [3] is a proprietary standard that is intended for home automation applications. It operates in the unlicensed Industrial, Scientific, and Medical (ISM) band. Z-Wave relies on a primary node: a network controller for managing all other devices in the network. Earlier versions of Z-Wave used a factory provisioned key for delivering the network key protecting the link-layer traffic. [PERSON] and [PERSON] [16] claimed in 2015 that this factory provisioned key is 16 bytes of zeros. Nowadays, Z-Wave uses a new S2 security protocol [17] for bootstrapping devices. The S2 protocol requires each device to have a factory provisioned asymmetric key pair. The device also has the first 16 bytes of the 32 byte public key printed as a QR code and a 40 digit string. A new device joining an existing network advertises its public key. The key is garbled by setting the first 16 bits to zero. A user then manually adds the missing 16 digits to the network controller by scanning the QR code of the new device (or copying the first five digits of the 40 digit printed string).