> For the complete documentation index, see [llms.txt](https://docs.morsemicro.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.morsemicro.com/application-notes/appnote-38-wi-fi-easyconnect-using-dpp-uris_qr-codes-on-halowlink-1.md). # APPNOTE-38 Wi-Fi EasyConnect using DPP URIs\_QR codes on HaLowLink 1 [Download as PDF](https://www.morsemicro.com/resources/appnotes/MM_APPNOTE-38_Wi-Fi_EasyConnect_using_DPP_URIs_or_QR_codes_on_HaLowLink_1.pdf) ## 1 Scope In this document, we briefly introduce the rationale for Wi-Fi EasyConnect and provide manual instructions that demonstrate Wi-Fi credential sharing between two HaLowLink1 devices via a Device Provisioning Protocol (DPP) Uniform Resource Identifier (URI). These are frequently printed as QR codes, but the QR code on the HaLowLink 1 label does not contain a DPP URI, but is rather a Wi-Fi credentials URI[\[1\]](#ftnt1) which is only useful for devices which can read QR codes directly. Therefore this App Note will involve using the terminal and manually copying the DPP URI from one device to the other. To make this suitable for end users, you would need to build additional software to automate the process. The prerequisites for this application note are: * 2 x [Morse Micro HalowLink 1](https://www.google.com/url?q=https://www.morsemicro.com/end-products/\&sa=D\&source=editors\&ust=1783415613184570\&usg=AOvVaw3fdNJgCywPc2uUG5n1fiWC) devices with the latest software installed (this guide was written based on v2.7.4) * 1 x Laptop with two USB-C ports (or USB-A to USB-C adapters) ## 2 Theory of Operation With traditional computers and mobile devices, it is typical to enter Wi-Fi credentials via their user interface to connect to a network; in most cases, the user types in a known SSID and key into their computer. Devices without an easily accessible user interface require some other method to securely acquire the Wi-Fi credentials. The Wi-Fi Easy Connect standard defines the Device Provisioning Protocol (DPP) as a way to share credentials. DPP supports a number of mechanisms, and by default the HaLowLink 1 supports using push buttons to initiate DPP[\[2\]](#ftnt2). Some devices lack buttons or a user interface, so must use an alternate credential sharing technique - such as by scanning a QR code[\[3\]](#ftnt3); using NFC or Bluetooth[\[4\]](#ftnt4); or by using a trusted third party[\[5\]](#ftnt5). Many of these techniques work by encoding the credential bootstrapping information into a DPP URI[\[6\]](#ftnt6) and then sharing this URI in a secure way. In this app note we will share the DPP URI as a trusted third party that has secure access to both devices via SSH. Designing a production-ready solution depends on the deployment and commissioning requirements of a product, but might involve encoding and scanning QR codes; implementing bluetooth based DPP via a smart phone; or distributing DPP URIs via a cloud-based service. The basic principle is that a configurator is provided with the public key of an enrollee, which allows the configurator and enrollee to establish a secure encrypted connection and for the configurator to provide the enrollee with credentials for the Wi-Fi network. Then it is only the configurator that needs some kind of UI, and the enrollee (i.e. the new device) does not. For the purposes of this document, the Access Point (running hostapd) will function as the configurator, and the Clients/Stations (running wpa\_supplicant) will be the enrollees. This will work as follows: 1. a HaLowLink 1 Extender which is configured with a public-private key pair (A-a) 2. a DPP URI is generated contains the HL1 Extender’s MAC address and public key (A) 3. a HaLowLink 1 Access Point where hostapd is a DPP Configurator 4. the DPP URI is provided to the DPP Configurator on the Access Point 5. the Extender emits DPP Presence Announcements until the Access Point detects it 6. the DPP Configurator on the Access Point recognises the Extender as its key (A) was registered in (4) 7. the DPP Configurator on the Access Point securely provides the Extender with credentials In this document, hostapd will act as the DPP Configurator, but depending on requirements other services can act as the configurator, and indeed may not even be running on the Access Point (which could be an enrollee). For technical details about hostapd’s DPP implementation, refer to [README-DPP](https://www.google.com/url?q=https://github.com/MorseMicro/hostap/blob/415d1757c25357e0d5423fe5f025e4384be7cb1b/wpa_supplicant/README-DPP\&sa=D\&source=editors\&ust=1783415613187701\&usg=AOvVaw3X1MsPnHUHXkSMiV5675LD). For further information about Wi-Fi Easy Connect, refer to: * [Wi-Fi Easy Connect™: Simple and secure onboarding for IoT](https://www.google.com/url?q=https://www.wi-fi.org/beacon/dan-harkins/wi-fi-easy-connect-simple-and-secure-onboarding-for-iot\&sa=D\&source=editors\&ust=1783415613187989\&usg=AOvVaw2aH7M5UVeTdoaJfSosJ0h7) * [Wi-Fi Easy Connect](https://www.google.com/url?q=https://www.wi-fi.org/discover-wi-fi/wi-fi-easy-connect\&sa=D\&source=editors\&ust=1783415613188098\&usg=AOvVaw0YxKJFgXLYzQ2jddER8OKb) * [Wi-Fi Easy Connect Specification v3.0](https://www.google.com/url?q=https://www.wi-fi.org/system/files/members/Wi-Fi_Easy_Connect_Specification_v3.0.pdf\&sa=D\&source=editors\&ust=1783415613188238\&usg=AOvVaw2AR-uQxPI5OQI3G0R4IWF1) ## 3 How to Configure ### 3.1 Configuring the Extender By default, the HaLowLink 1 is configured as a router with an access point. To reset the device into Extender mode: * Connect your laptop via USB-C to the device. * Wait until the Status LED is solid green or aqua. * Make sure the device is reset by holding down the mode button on the bottom of the device until the Status LED starts rapidly flashing aqua, then release the button. * It will first start slowly flashing green. You must continue holding the button down until it flashes aqua. If you accidentally release it earlier, wait until it’s solid green again. * Wait until it’s solid aqua. Because the device is now in Extender mode, it does not have a DHCP Server. However, you can use the static emergency recovery IP (10.22.121.111) to access it if you manually configure the ethernet connection on your laptop to have an IP of 10.22.121.110 (subnet mask 255.255.255.0). #### 3.1.1 Accessing the terminal Now, we can use the terminal to setup DPP: * Go to [http://10.22.121.111](https://www.google.com/url?q=http://10.22.121.111\&sa=D\&source=editors\&ust=1783415613189630\&usg=AOvVaw3lI_S_YuDz8tc_WwFqN8Fs) and use the username and password on your device to login:\ ![](/files/c4bcb8f8ad512e9a6fdccded6ee54e13b882b65c)) * On the left hand side menu, click Advanced, then go to Services -> Terminal, and use the same password as above to login #### 3.1.2 Generate a private key Generate the private key (/etc/dpp\_key.pem is the default path used for the dpp\_key variable in our wpa\_supplicant configuration file; it is also possible to get wpa\_supplicant to generate a key at runtime): root\@halowlink1-1947:\~# openssl ecparam -genkey -name prime256v1 \\\ -noout -outform PEM > /etc/dpp\_key.pem #### 3.1.3 Configure wpa\_supplicant Set the HaLow radio to emit DPP Presence Announcements (which will include the public key), confirming that radio1 is the correct radio (if it’s not, try radio0): root\@halowlink1-1947:\~# uci show wireless.radio1.type wireless.radio1.type='morse' root\@halowlink1-1947:\~# uci set wireless.default\_radio1.dpp=1 root\@halowlink1-1947:\~# uci commit root\@halowlink1-1947:\~# reload\_config #### 3.1.4 Record the DPP URI (which includes the public key) Determine the DPP URI beginning with “DPP:” and save this to use it later: root\@halowlink1-1947:\~# wpa\_cli\_s1g dpp\_bootstrap\_get\_uri 1; echo Selected interface 'wlan0' DPP:M:94bb43dcf993;V:3;K:MDkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDIgADpfVUMGW64skm+qzbmcn1nw3cgZw+fA2oJgEYSI06oAk=;; #### 3.1.5 Confirm that wpa\_supplicant is working Follow the logs to confirm that DPP-TX is happening. We suggest leaving this terminal open while you configure the Access Point: root\@halowlink1-1947:\~# logread -f wlan0: DPP-TX dst=ff:ff:ff:ff:ff:ff freq=5745 type=13 wlan0: DPP-TX dst=ff:ff:ff:ff:ff:ff freq=5805 type=13 wlan0: DPP-TX dst=ff:ff:ff:ff:ff:ff freq=5865 type=13 wlan0: DPP-TX dst=ff:ff:ff:ff:ff:ff freq=5745 type=13 wlan0: DPP-TX dst=ff:ff:ff:ff:ff:ff freq=5805 type=13 wlan0: DPP-TX dst=ff:ff:ff:ff:ff:ff freq=5865 type=13 *** ### ### 3.2 Configuring the Access Point By default, the HaLowLink 1 is configured as a router with an access point. If you have modified the configuration, we suggest performing a factory reset before following this guide: * Connect your laptop via USB-C to the device. * Do not remove the Extender. You should now have two HL1 devices connected to your laptop. * Wait until the Status LED is solid green or aqua. * Make sure the device is reset by holding down the mode button on the bottom of the device until the Status LED starts flashing green. * Wait until it’s solid green. Now, we can make sure it’s a configurator and register the Extender’s public key: * Go to [http://192.168.12.1](https://www.google.com/url?q=http://192.168.12.1\&sa=D\&source=editors\&ust=1783415613192872\&usg=AOvVaw0ECRItlfvrQ2lz8ux4vfhH) in a new tab/window, and access the terminal as you did for the Extender (but with the Access Point’s username and password) #### 3.2.1 Determine the current Wi-Fi credentials Get the SSID and key as hexadecimal values after confirming that radio1 is correct: root\@halowlink1-f4a1:\~# uci get wireless.default\_radio1.ssid |\ tr -d '\n' | hexdump -v -e '/1 "%02x"'; echo 68616c6f776c696e6b312d66346131 root\@halowlink1-f4a1:\~# uci get wireless.default\_radio1.key |\ tr -d '\n' | hexdump -v -e '/1 "%02x"'; echo 6c617a7930387465 These hexadecimal values must be used for the ssid and pass in the following section. #### 3.2.3 Configure hostapd and register the DPP URI Connect to hostapd\_cli\_s1g, set it up as a configurator, and register the DPP URI from above. You must use the values that were determined above for dpp\_uri/key/ssid: root\@halowlink1-f4a1:\~# hostapd\_cli\_s1g\ Selected interface 'wlan0' > dpp\_configurator\_add\ > 1> dpp\_configurator\_sign conf=ap-sae configurator=1 ssid= pass=\ > <3>DPP-CONF-RECEIVED\ > ...\ > OK\ > dpp\_qr\_code \\ > 1> quit #### 3.2.2 Verify that your Extender is correctly provisioned Check the logs: root\@halowlink1-f4a1:\~# logread -l 100 -f\ ...\ wlan0: DPP-TX dst=ff:ff:ff:ff:ff:ff freq=5805 type=13 wlan0: DPP-TX dst=ff:ff:ff:ff:ff:ff freq=5865 type=13 wlan0: DPP-TX dst=ff:ff:ff:ff:ff:ff freq=5745 type=13 wlan0: DPP-TX dst=ff:ff:ff:ff:ff:ff freq=5805 type=13 wlan0: DPP-RX src=0c:flag\_bf:74:00:07:a1 freq=5805 type=0 wlan0: DPP-CHIRP-STOPPED wlan0: DPP-TX dst=0c:flag\_bf:74:00:07:a1 freq=5805 type=1 wlan0: DPP-TX-STATUS dst=0c:flag\_bf:74:00:07:a1 freq=5805 result=SUCCESS wlan0: DPP-RX src=0c:flag\_bf:74:00:07:a1 freq=5805 type=2 wlan0: DPP-AUTH-SUCCESS init=0 pkhash=... own=1 peer=-1 wlan0: GAS-QUERY-START addr=0c:flag\_bf:74:00:07:a1 dialog\_token=214\ freq=5805 wlan0: GAS-QUERY-DONE addr=0c:flag\_bf:74:00:07:a1 dialog\_token=214\ freq=5805 status\_code=0 result=SUCCESS wlan0: DPP-CONF-RECEIVED wlan0: DPP-CONFOBJ-AKM sae wlan0: DPP-CONFOBJ-SSID halowlink1-f4a1 ... wlan0: DPP-PB-RESULT success ## 4 How to Verify After following the previous steps, the purple Wi-Fi HaLow LED light on the Extender should come on. You can verify that it’s connected to your Access Point by going to the Access Point interface at [http://192.168.12.1](https://www.google.com/url?q=http://192.168.12.1\&sa=D\&source=editors\&ust=1783415613195829\&usg=AOvVaw2cjR5OJpLQr0QeLYK2znWZ) and clicking on the Access Point card to see the associated Clients: ![](/files/fc70a6ce4438a50400f1faa422494b6cb1002310)) You can also go back to the user interface of the Extender and click on the ‘Uplink’ card to confirm that it now contains the correct credentials. Now that the credentials are stored, DPP has no further role, and you will be able to remove power from the devices, set them up elsewhere, and the Extender will re-authenticate with the Access Point. ## 5 FAQs **What happens if I change the SSID/password on an AP after provisioning devices?** With the mechanism described, because they are no longer using DPP and have stored the normal credentials they will lose access. The devices would have to move back into DPP Presence Announcement mode (i.e. set dpp=1), and because hostapd’s inbuilt configurator does not persist the DPP URIs you would need to resubmit the enrollee’s URI. You can and should use the same URI as before. **Can I use DPP URIs with HaLowLink 1s out of the box?** No, this mechanism is not supported by HaLowLink 1 devices. This document describes how to experiment with using DPP URIs for those who might like to use them in a product, but there are missing pieces: * HL1 devices are not provisioned with a DPP key on the device; * HL1 devices do not have a DPP QR code containing the DPP URI printed on the device (the QR code on the device is rather the Wi-Fi credentials QR code); * There is no user friendly mechanism to read the DPP URI from an Extender and provide it to an Access Point (i.e. hostapd); * When factory reset into Extender mode, they are not set to emit DPP Presence Announcements. **How would I use DPP URIs in a product?** One approach would be to use the interaction described in this document but fix the deficiencies discussed above. However, you may also consider: * Using a custom configurator (e.g. a mobile application) which configures both Access Points and Clients. Depending on the device, this could even use 2.4 Wi-Fi to do the credentials exchange; * Providing the DPP URI of devices via some other mechanism; for instance, a trusted service could be pre-populated with DPP URIs. See section 5.7 of the Wi-Fi EasyConnect Specification v3.0 for a discussion of approaches. **How can an Access Point ever read a QR code if it doesn’t have a camera?** This could be done via the web UI (if run on a phone with a camera) or via a mobile app which could securely communicate with the Access Point. ## 6 Revision History | Release Number | Release Date | Release Notes | | -------------- | ------------ | --------------- | | 01 | 06/05/2025 | Initial version |