The establishment of a KNX IP Secure session uses the MIKEY protocol (Multimedia Internet KEYing) to negotiate the symmetric session key, building on the long-term keys stored in the ETS keyring.

MIKEY, adapted to the KNX IP Secure context (based on RFC 3830), provides authenticated key establishment with mutual authentication. The Pre-Master Keys (PMK) are derived from the project keyring, and the current session is then protected with AES-128 CCM. Compromising one session does not compromise the others (partial forward secrecy).

Treat the ETS keyring file as a high-value secret — anyone with the keyring can transparently re-open sessions on every Secure device of the project.