# LoRaWAN security: Can the Network Server generate the AppSKey?

**URL:** <https://www.thethingsnetwork.org/forum/t/lorawan-security-can-the-network-server-generate-the-appskey/8672>\
**Category:** TTN Network and Services\
**Created:** [July 26, 2017, 12:16pm UTC](https://www.thethingsnetwork.org/forum/t/lorawan-security-can-the-network-server-generate-the-appskey/8672 "2017-07-26T12:16:14Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![sabrina](https://www.thethingsnetwork.org/forum/letter_avatar_proxy/v4/letter/s/51bf81/32.png) [@sabrina](https://www.thethingsnetwork.org/forum/u/sabrina)\
**Post date:** [July 27, 2017, 12:43pm UTC](https://www.thethingsnetwork.org/forum/t/lorawan-security-can-the-network-server-generate-the-appskey/8672/4 "2017-07-27T12:43:01Z")

</div>

> [@htdvisser](#):
>
> In the architecture of The Things Network, this is not necessarily true. The JoinAccept message is encrypted by the Handler component (which you can run on your own servers), keeping the AppSKey safe, while giving the network server only the NwkSKey.

But this violates the fact that NwkSKey is only between the network server and the end device cause in this case the handler has both keys. Right?

---

_[View the full topic](https://www.thethingsnetwork.org/forum/t/lorawan-security-can-the-network-server-generate-the-appskey/8672)._