Skip to main content
For the complete documentation index, see llms.txt.

Hubble Network developer documentation: integrate Bluetooth devices with terrestrial and satellite connectivity.

Encryption Concepts

The cryptographic techniques used by the Terrestrial Network for Bluetooth® Low Energy (BLE) transmission ensure confidentiality, integrity, and authenticity of the data being advertised by your anonymous devices.

Key Concepts​

AES-256 provides strong encryption, CMAC ensures data integrity and authenticity, and the KBKDF securely derives keys from a master key. The use of nonces and sequence numbers prevents replay attacks and ensures that each advertisement is unique.

AES Encryption​

The SDK supports AES-256 (Advanced Encryption Standard with a 256-bit key) or AES-128 (128-bit key) for encryption. AES is a symmetric encryption algorithm, meaning the same key is used for both encryption and decryption.

CMAC (Cipher-based Message Authentication Code)​

CMAC is used to generate a message authentication code (MAC) to ensure data integrity and authenticity. The CMAC is computed over the input data using the provided key, and the result is stored in the output buffer.

KBKDF (Key-Based Key Derivation Function)​

The code uses a KBKDF to derive keys from a master key. It derives keys based on a master key, a label, a context, and a counter. It uses CMAC as the pseudorandom function (PRF) to generate the derived keys. Learn more: NIST - Recommendation for Key Derivation Using Pseudorandom Functions

Nonce Generation​

A nonce (number used once) is generated for each encryption operation to ensure that the same plaintext encrypted multiple times will produce different ciphertexts. The nonce is derived using the KBKDF with a specific label (“Nonce”) and the current sequence number.

AES-128-EAX​

Supported specifically for InPlay IN100 devices, AES-128-EAX provides Authenticated Encryption with Associated Data (AEAD). This encryption mode uses device uptime and is optimized for the IN100's hardware constraints. It protects against both eavesdropping and bit-flipping attacks while maintaining the low power consumption profile required for nanobeacon applications.