KNX Secure has arrived !!!!!

[kristian]

Hello @Supergiovane, I am looking forward to KNX Ultimate supporting KNX Secure (as I am currently adapting KNX Secure in my whole KNX set-up). Can you summarize the current state of the KNX Secure implementation & if there is some possibility to contribute / help you to realize this feature maybe? Thanks & best regards, @kristian

[Supergiovane]

Hi Kristian
We're working on it.
Some parts are already been developed. We work (2 peoples) on the core KNX engine full day until we have finished.
I keep posting the updates on this thread.

[kristian]

@Supergiovane That's great news! If there is any help needed, development or concept-wise, please share the work packages that would allow contribution! I think there are a lot of developers out there keen to help! KNX Secure is getting a main push in adoption at the moment, as far as I can tell 👍

[kristian]

@Supergiovane I just found the draft / work-in-progress PR you mentioned Supergiovane/KNXUltimate#37. Good work! 👍 Thanks a lot for all the effort!

Just maybe generally, is there an estimate if you plan to release secure tunneling support maybe even this year still? Question goes towards, if it is worth it to wait for the implementation, or find other workarounds (e.g. my router supports translation of KNX to KNX secure protocols). Question is whether it is worth the effort to set this up as an intermediary, but if you say, like in January it is very likely a first version is released, I am happy to wait! 🥇

[Supergiovane]

I think that until end of 2024, the first beta should be out.
KNX-Ultimate node will be released as beta as well.
Thank you to you for your kindness!

[kristian]

Awesome news! 👍 Keep up the good work! 💯

[kristian]

Hey @Supergiovane, any progress on the first beta release? 👍

[Supergiovane]

Hi!
I’ve seen your post about Tunneling. Thank you for your feedback! 🙏
The crypto team is testing the matter with a secure knx gateway i sent them last week, friendly given for free by an Italian online store.
Currently, we’ve no plans to release the updated knx engine, but i’m assuring you, that as soon as feasible, i’ll release a beta version of knx ultimate node. Please stay tuned. 😉

[kristian]

Great update @Supergiovane, thanks a lot! Hope the tests from the crypto team turn out successful! Best regards, Kristian

[kristian]

Hey @Supergiovane, happy new year! Just wanted to check if there has been some exciting news on the KNX secure front recently? :)

[Supergiovane]

Hi Kristian!
We're testing the matter and fixing some issues locally.
There are some more things to do, but we're committed to secure full time.
;-)
As soon as i have confidence in the code, i'll publish the first beta, but as per today, i cannot give you a release date.

[kristian]

Sounds good! Happy to hear that you are making good progress. Keep up the good work! :) Thanks!

[kristian]

Hey @Supergiovane, I noticed you started working on KNX-Ultimate again! Happy to see you back! In case you need any help developing / reviewing for KNX Secure support, just let me know!

Btw.: Imporatant question, will the KNX Secure branch both cover IP Secure (so connecting to the IP Router securely) as well as Data Point Secure (so that communication on the bus is encrypted)? Thanks!

[Supergiovane]

Hi
We are committed for both. The first one will be ip secure.
There are 2 peoples committed on knx secure, but if we’ll need extra power, i’ll poke you, thanks!

[kristian]

Sounds good, happy to help!

[woifes]

Hello and thank you for this package! May I ask about the status of the secure tunneling feature?

[Supergiovane]

Hi!
I’m out for holidays. Can you please ask here https://github.com/Supergiovane/KNXUltimate/issues so my collegues can tell you kore about that?
Thanks!!!

[Supergiovane]

Starting from v. 4.0.0, KNX Secure has beeen implemented.

[chrisbu74]

I have just updated to version 4 and tested it with a secure device. It worked immediately. Many thanks for your work

[kristian]

This is such great news, as I have to switch my whole installation to KNX Secure to test, I am still a little hesitant. @Supergiovane I guess you first implemented the secure connect stuff, right? Or is the data secure part (where the group address packages get encrypred) also implemented already?

[Supergiovane]

Hi
The last beta has Knx/ip secure and data secure.
;-)

[kristian]

Wow!! That is awesome indeed!! Is the last beta already out, or do you mean 4.0.2? :)

[Supergiovane]

Yes sorry. It’s not a beta. 4.0.2, sorry.

[kristian]

Great, I am already at it giving it a try 👍 First I have to reconfigure my KNX ETS project! I will let you know as soon as I have the first success 💯

[kristian]

Hey @Supergiovane, good news first! KNX IP/secure has worked flawlessly, after I enabled secure routing (multicast) + updated the keys, the connection still works. Afterwards I enabled data secure for all my groups and re-imported the keyring XML + address CSV. My node shows now also a new cute little "secure" icon, how awesome! 👍

Unfortunately, bad news: I could NOT get the telegrams to work yet! In the diagnosis I see that the "encryption status" was a success, so the data and telegram seem to be transmitted successfully. However, the devices do not seem to respond so if I toggle the light on & off, it refuses to work. I tried playing with the KNX Physical Address, first setting it to my router Physical Address, then to a "Dummy Device" that I have in all of my group addresses (I need this dummy device for routing, as I am using multiple lines, so I need this dummy to tell my line couplers, that the telegram should be forwarded), last I even set it to an address of the device controlling the light (the switch in the room), but nothing did work. I always did see that the encryption status in the telegram monitor was successful, but the light did not turn off / on in the room. Turning it off / on with the switch that has been reconfigured for secure works flawlessly.

Any idea? Other than that, awesome work @Supergiovane thanks so much for the personal involvement again!! 💯

[Supergiovane]

Hi
First, try restarting node red.
Then, i’ve encountered this issue, when the actuator had discarted the secure telegrams, because of a not recognized sender’s address.
Are you using tunneling or routing?

[Supergiovane]

PS: i’m going to sleep now!

[kristian]

Good night 👍 Sleep is well deserved! You did awesome work today!

I am using routing. I will try playing around a little until tomorrow with the sender's address and report if I find anything useful.

[kristian]

Okay, I got it to work for the first devices!! As you said, some devices seem to be VERY picky who is the sender! Some other devices do not seem to care at all, e.g. I have Gira KNX RF secure switches, those only work, if there is a device specifcially set as the "sender" in the group. I also have another L&J secure 5x switch, e.g. for my hallway lights. They work regardless if a device is set as a sender in the group or not.

Unfortuantely this requires me to do a little more reconfiguration to my project. So far I have only configured one "dummy" device (the best one I found was the Eelectron Advanced Dummy & KNX Secure), so that I do not need to manually set my routing tables. So I have added this dummy device to the groups that needed communication via my IP router (as my IP router is in Line 1, while my devices are in lines 1.1 nad 1.2, so I needed to set the routing table). I made it "easy" for me and simply added all groups to the same communication object, e.g. all switches to communication object "dummy 1", so it was essentially one object, with ALL groups attached:

This worked flawlessly for the routing tables, but for the secure now, I unfortunately can only mark one group association as "sending", if I choose another group address from the list, the "sending" flag will move to the other object and indeed NOT work for KNX secure data. So I guess I really have to reconfigure it to a 1:1 association with my dummy device + put every group into a own dummy communication object that I can mark as a sender!

I will also go to bed now and reconfigure my project tomorrow & let you know if everything worked out. Thanks again for the awesome progress!! 👍

[Supergiovane]

Try giving the node red's knx gateway config window's "physical address" option, the same physical address of your knx gateway (in your case 1.0.0 i think)

[kristian]

Good morning @Supergiovane. 👍 No unfortuantely this also does not work, that is what I tried first... I tried a lot by now, the only option I found working, is via my dummy (1.0.3) device, that I set every group into a dedicated communication object as a sender, then setting 1.0.3 as the "physical address" in the NodeRED gateway config. I am currently reconfiguring my associations in ETS... it is a little bit cumbersome as there are a LOT 🗡️

[kristian]

Try giving the node red's knx gateway config window's "physical address" option, the same physical address of your knx gateway (in your case 1.0.0 i think)

As far as I can tell what the problem is, is that: e.g. for the light switches from Gira, they really ONLY accept the telegrams, if they are coming from a device flagged as "sender" in ETS. However as said, seems like devices have own "rules" what they accept... my other switch actor, accepts everything, regardless. I guess there are also devices that accept messages from router. For my GIRA switches as said, they seem to be VERY picky and only accept messages from the "senders". :(

[Supergiovane]

Yes, i know. There is already a workaround (permitted by KNX specs) in place in the secure multicast implementation of KNX Ultimate, to mitigate that, but as far as the filters are on the actuator itself, there is not much that i can do.
You could try tunneling instead of routing...

[kristian]

I see, thanks for sharing this insight! :) Always good to understand what is going on "behind the scenes". Yes, I am fully with you. I guess (as often times in KNX spec.) devices can decide "how far" they want to be compliant to the secure spec. so implementing filters on the actuators themselfs likely is the "most secure" implementation option and there is nothing you could do.

I did a lot of trial and error / reverse engineering yesterday and essentially tried to make "the minimal change" so that it works or breaks. I can see all the telegrams in the ETS telegram monitor decrypting successfully and I was then able to reproduce it just by setting / removing the "sending" flag. So I guess it is really true and the only option is to reconfigure my ETS with the dummy devices.

I am nearly done with moving all the association around. I will let you know as soon as it works for my whole project! 👍

[kristian]

I now finished reconfiguring my ETS project, so that every device / group is using an individual communication object in my dummy 1.0.3 device. That is also the device I now configured as a "physical address" in your NodeRED configuration:

This seems to be doing the trick and I have a successfully running KNX project fully utilizing KNX Secure! I have been waiting for this forever now, and it was a BIG item on my TODO bucket list!! Thanks so much for taking on this challenge personally @Supergiovane! 💯 Highly appreciated! I will let you know if I spot any further problems, but with my initial spot checks, everything seems to work out great!!

PS: I think what also helped is that my "dummy" device did not have any sequence number assigned to it, so there is no problem there either 👍

[kristian]

After about 3 weeks of using KNX Ultimate on my fully encrypted network (IP secure & data secure), I cannot overstate how happy I am, that @Supergiovane you took it on yourself to finally integrate KNX Secure into your project! So far I have not encountered a single issue during regular / daily operation and I am verry happy that I can finally cross the task of switching off my bucket list! 👍 Thanks again for the awesome work & best regards, Kristian

[Supergiovane]

Thank you for the kind words!
I appreciate that! If you ever need help, don’t hesitate to ask!