By its knowledge of the device key the host is able to a new connection is allowed demonstrate to the device that it too has the user's trust. User instructs device to This may be for example by pushing a "Connect" button start new connection on the device. Authentication will include the manual entry or confirmation of a connection key (a PIN or passphrase) by the user, to ensure that hosts and devices are mutually able to demonstrate user trust when requesting or allowing a connection. Three different types of authentication "ceremony" are possible, depending on whether the connection key is distributed directly by the user to host and device, is hard wired into the device, or is based on an exchange of public keys between host and device. The authentication ceremony that most closely mirrors the process of making a wired USB connection is the second of these, based on sharing a Fixed Symmetric Key (FSK) that is typically hard wired into the device at manufacture. The steps in this authentication ceremony are shown in Table 11-7. The ceremony for public key authentication will be similar, except that both device and host will present their public keys to the user as part of a software driven installation process. After these authentication steps, association continues with a handshake process resulting in the generation of a 128-bit AES encryption key that is used to protect the connection. This pair-wise temporal key (PTK) is unique to the connection and is used by host and device to encrypt all transmitted and decrypt all received data packets. ZigBee Security The IEEE 802.15.4 MAC layer specifies four services that are available to implementers in the Zigl Bee security software toolbox to ensure security Implementing Wireless PANs Table 11-8: IEEE 802.15.4 MAC Security Services Security service Description Access control The network co-ordinator acts as a "trust centre", maintaining overall network knowledge, including a list of trusted devices within the network, as well as maintaining and distributing netw