# What is the difference between OTAA and ABP Devices **URL:** \ **Category:** End Devices (Nodes)\ **Created:** [July 7, 2016, 7:51am UTC](https://www.thethingsnetwork.org/forum/t/what-is-the-difference-between-otaa-and-abp-devices/2723 "2016-07-07T07:51:25Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![HHMikena](https://www.thethingsnetwork.org/forum/letter_avatar_proxy/v4/letter/h/b77776/32.png) [@HHMikena](https://www.thethingsnetwork.org/forum/u/HHMikena)\ **Post date:** [July 7, 2016, 7:51am UTC](https://www.thethingsnetwork.org/forum/t/what-is-the-difference-between-otaa-and-abp-devices/2723/1 "2016-07-07T07:51:25Z")
Could someone point me in the right direction on where i can find the difference between OTAA and ABP Devices and where they are used for? I cant seem to find any info on the wiki unless iam looking at the wrong pages. ---
**Author:** ![htdvisser](https://www.thethingsnetwork.org/forum/user_avatar/www.thethingsnetwork.org/htdvisser/32/45312_2.png) [@htdvisser](https://www.thethingsnetwork.org/forum/u/htdvisser)\ **Post date:** [July 7, 2016, 7:56am UTC](https://www.thethingsnetwork.org/forum/t/what-is-the-difference-between-otaa-and-abp-devices/2723/2 "2016-07-07T07:56:44Z")
## Over-the-Air Activation (OTAA) Over-the-Air Activation (OTAA) is the preferred and most secure way to connect with The Things Network. Devices perform a join-procedure with the network, during which a dynamic `DevAddr` is assigned and security keys are negotiated with the device. ## Activation by Personalization (ABP) In some cases you might need to hardcode the DevAddr as well as the security keys in the device. This means activating a device by personalization (ABP). This strategy might seem simpler, because you skip the join procedure, but it has some downsides related to security. See the [wiki](https://www.thethingsnetwork.org/docs/lorawan/) for more information. ---
**Author:** ![torntrousers](https://www.thethingsnetwork.org/forum/letter_avatar_proxy/v4/letter/t/a88e4f/32.png) [@torntrousers](https://www.thethingsnetwork.org/forum/u/torntrousers)\ **Post date:** [July 8, 2016, 6:31am UTC](https://www.thethingsnetwork.org/forum/t/what-is-the-difference-between-otaa-and-abp-devices/2723/3 "2016-07-08T06:31:03Z")
> [@htdvisser](#): > > …it (ABP) has some downsides related to security I’ve read that wiki doc but couldn’t see much about this - could anyone expand on what these security downsides with ABP are? ---
**Author:** ![thaskippy](https://www.thethingsnetwork.org/forum/user_avatar/www.thethingsnetwork.org/thaskippy/32/1527_2.png) [@thaskippy](https://www.thethingsnetwork.org/forum/u/thaskippy)\ **Post date:** [July 8, 2016, 8:49am UTC](https://www.thethingsnetwork.org/forum/t/what-is-the-difference-between-otaa-and-abp-devices/2723/4 "2016-07-08T08:49:02Z")
> Key extraction from Node devices is probable given that they will likely be physically outside of controlled environments. It is important therefore that the theft of keys from one Node does not compromise other Nodes in the system. One potential vulnerability is where Nodes use Activation-By-Personalisation (ABP) for joining, but use keys derived by the Node based on features such as the device address. If this could be worked out through reverse engineering of one Node, then all other communications to any Node would then be compromised. (From page 12 of [https://labs.mwrinfosecurity.com/assets/BlogFiles/mwri-LoRa-security-guide-1.2-2016-03-22.pdf](https://labs.mwrinfosecurity.com/assets/BlogFiles/mwri-LoRa-security-guide-1.2-2016-03-22.pdf)) So as far as I can tell otaa isn’t necesarily more secure than abp as long as the way of procuring keys for abp is random enough. Otaa is imo more favorable though because the activatation process makes it directly visible whether you actually connected to the network or not. ---
**Author:** ![htdvisser](https://www.thethingsnetwork.org/forum/user_avatar/www.thethingsnetwork.org/htdvisser/32/45312_2.png) [@htdvisser](https://www.thethingsnetwork.org/forum/u/htdvisser)\ **Post date:** [July 8, 2016, 8:52am UTC](https://www.thethingsnetwork.org/forum/t/what-is-the-difference-between-otaa-and-abp-devices/2723/5 "2016-07-08T08:52:26Z")
Mostly the fact that you hard-code session keys into your device (then they’re not session keys anymore). I’m sure a quick forum search for “Security” will give you some reading material 😉 ---
**Author:** ![arjanvanb](https://www.thethingsnetwork.org/forum/user_avatar/www.thethingsnetwork.org/arjanvanb/32/46626_2.png) [@arjanvanb](https://www.thethingsnetwork.org/forum/u/arjanvanb)\ **Post date:** [July 24, 2016, 1:09pm UTC](https://www.thethingsnetwork.org/forum/t/what-is-the-difference-between-otaa-and-abp-devices/2723/6 "2016-07-24T13:09:49Z")
For me the main reason to want OTAA is the option [to switch networks](https://www.thethingsnetwork.org/forum/t/how-can-an-operational-node-be-triggered-to-join-a-different-network/1106). Network-specific settings (such as [TTN using SF9 in RX2](https://www.thethingsnetwork.org/forum/t/why-is-rx-slot-1-not-used/2656)) are nicely communicated in the OTAA Join Accept message, but need to be hardcoded in ABP devices. ---
**Author:** ![zoghlami](https://www.thethingsnetwork.org/forum/letter_avatar_proxy/v4/letter/z/ecb155/32.png) [@zoghlami](https://www.thethingsnetwork.org/forum/u/zoghlami)\ **Post date:** [July 31, 2018, 2:26am UTC](https://www.thethingsnetwork.org/forum/t/what-is-the-difference-between-otaa-and-abp-devices/2723/9 "2018-07-31T02:26:49Z")
Can you tell me please if in the OTTA , every time the end-device reset or overflow , Network Session keys change or no ? ---
**Author:** ![kersing](https://www.thethingsnetwork.org/forum/user_avatar/www.thethingsnetwork.org/kersing/32/44777_2.png) [@kersing](https://www.thethingsnetwork.org/forum/u/kersing)\ **Post date:** [July 31, 2018, 7:11am UTC](https://www.thethingsnetwork.org/forum/t/what-is-the-difference-between-otaa-and-abp-devices/2723/10 "2018-07-31T07:11:17Z")
Yes, every OTAA operation resets the _sessions_ key **s**. Both Network Session Key and Application Session Key are generated newly for at OTAA join. ---
**Author:** ![zoghlami](https://www.thethingsnetwork.org/forum/letter_avatar_proxy/v4/letter/z/ecb155/32.png) [@zoghlami](https://www.thethingsnetwork.org/forum/u/zoghlami)\ **Post date:** [July 31, 2018, 8:20am UTC](https://www.thethingsnetwork.org/forum/t/what-is-the-difference-between-otaa-and-abp-devices/2723/11 "2018-07-31T08:20:21Z")
Thanks but I’am asking if every reset or overflow the OTAA (join request - accept ) are repeated again ? ---
**Author:** ![BoRRoZ](https://www.thethingsnetwork.org/forum/user_avatar/www.thethingsnetwork.org/borroz/32/44234_2.png) [@BoRRoZ](https://www.thethingsnetwork.org/forum/u/BoRRoZ)\ **Post date:** [July 31, 2018, 8:43am UTC](https://www.thethingsnetwork.org/forum/t/what-is-the-difference-between-otaa-and-abp-devices/2723/12 "2018-07-31T08:43:07Z")
yes, if you power cycle (on/off) an OTAA programmed node it will try to join …, **again** , like Kersing said, the counters are also reset to zero. see > [@How often should a node do an OTAA Join, and is OTAA better than ABP?](https://www.thethingsnetwork.org/forum/t/how-often-should-a-node-do-an-otaa-join-and-is-otaa-better-than-abp/11192): > > Hello there everyone. I am building a node in which long battery life is the primary factor. I Am using th RN2483 in combination with one of the PIC controllers with ‘XLP’. All is going well, I have been able to get all the LoRa communication running fine. I have a couple of questions about joining the network: If I have joined the network using OTAA, when does this ‘join’ expire ? after a certain amount of time? after the RN2483 has been switched off and on again ? where can I find a descri… > [@LoRaWAN Session Termination/Expiration?](https://www.thethingsnetwork.org/forum/t/lorawan-session-termination-expiration/3556): > > In both OTAA and ABP the node and the server will have a Network Session Key (NwkSKey) and a Application Session Key (AppSKey). Does anyone know when a session ends? When do the keys in OTAA expire? And if so what is the timeout period. I coudn’t find any helpful details about this in the LoRa specs. Is there any message overheads like HeartBeat messages to keep the session active in OTAA? I’m talking about class A devices here. Thanks! [https://www.thethingsnetwork.org/docs/lorawan/security.html](https://www.thethingsnetwork.org/docs/lorawan/security.html) ---
**Author:** ![kersing](https://www.thethingsnetwork.org/forum/user_avatar/www.thethingsnetwork.org/kersing/32/44777_2.png) [@kersing](https://www.thethingsnetwork.org/forum/u/kersing)\ **Post date:** [July 31, 2018, 9:01am UTC](https://www.thethingsnetwork.org/forum/t/what-is-the-difference-between-otaa-and-abp-devices/2723/13 "2018-07-31T09:01:56Z")
That depends on the software on the node. Some nodes save the information and restore and reuse it after a reset (LoPy has this feature) most will rejoin after a reset. However too many rejoins will result in issues because of nonce reuse. I suggest you check the lorawan spec for expected behavior on overflow. ---
**Author:** ![zoghlami](https://www.thethingsnetwork.org/forum/letter_avatar_proxy/v4/letter/z/ecb155/32.png) [@zoghlami](https://www.thethingsnetwork.org/forum/u/zoghlami)\ **Post date:** [July 31, 2018, 9:53am UTC](https://www.thethingsnetwork.org/forum/t/what-is-the-difference-between-otaa-and-abp-devices/2723/14 "2018-07-31T09:53:33Z")
thnx , i have an other question , i want to know if every time the frame counters reches its maximum value the end device change its session keys (does mean repeat OTAA procedure) ? ---
**Author:** ![BoRRoZ](https://www.thethingsnetwork.org/forum/user_avatar/www.thethingsnetwork.org/borroz/32/44234_2.png) [@BoRRoZ](https://www.thethingsnetwork.org/forum/u/BoRRoZ)\ **Post date:** [July 31, 2018, 10:05am UTC](https://www.thethingsnetwork.org/forum/t/what-is-the-difference-between-otaa-and-abp-devices/2723/15 "2018-07-31T10:05:30Z")
I suggest too you check the lorawan spec for expected behavior on overflow and start using search and read some more background info. ---
**Author:** ![kersing](https://www.thethingsnetwork.org/forum/user_avatar/www.thethingsnetwork.org/kersing/32/44777_2.png) [@kersing](https://www.thethingsnetwork.org/forum/u/kersing)\ **Post date:** [December 1, 2020, 7:10pm UTC](https://www.thethingsnetwork.org/forum/t/what-is-the-difference-between-otaa-and-abp-devices/2723/16 "2020-12-01T19:10:07Z")
2 posts were split to a new topic: [Node on two lorawan networks](https://www.thethingsnetwork.org/forum/t/node-on-two-lorawan-networks/41814) ---
**Author:** ![kersing](https://www.thethingsnetwork.org/forum/user_avatar/www.thethingsnetwork.org/kersing/32/44777_2.png) [@kersing](https://www.thethingsnetwork.org/forum/u/kersing)\ **Post date:** [December 1, 2020, 7:11pm UTC](https://www.thethingsnetwork.org/forum/t/what-is-the-difference-between-otaa-and-abp-devices/2723/17 "2020-12-01T19:11:13Z")