[New Sensor]: Linptech KS2 / KS2BB temperature, humidity and button sensor

[shisoratsu]

Sensor Description

Linptech KS2 / KS2BB Temperature Humidity Sensor Wireless Switch Mi Home model: linp.sensor_ht.ks2bb MiBeacon product id: 21003 / 0x520B This is a battery powered Linptech temperature/humidity sensor with one physical button. The button supports single press, double press, and long press.

Additional information

Device name / model:

• Linptech KS2
• KS2BB
• linp.sensor_ht.ks2bb

Expected entities:

• temperature
• humidity
• button action
• battery
• rssi

Encrypted Advertisements:
true

Protocol:

• Xiaomi MiBeacon / service UUID 0xFE95
• MiBeacon v4/v5 style AES-CCM encrypted advertisements
• Requires bindkey / beaconkey from Xiaomi Home account

Observed features:

• Temperature is broadcast as MiBeacon object id 0x4801 / decimal 18433
• Humidity appears to be broadcast as compact object id 0x4802 / decimal 18434
• Battery is reported by XiaomiGateway3 mapping as object id 0x5003 / decimal 20483, but I have not captured a battery frame yet
• Button action payloads observed:
  • 0c5600 = single press
  • 0d5600 = double press
  • 0e5600 = long press / hold

Known community mapping:
XiaomiGateway3 has this device listed as product id 21003:

21003: ["Linptech", "Temperature Humidity Sensor KS2", "KS2BB", "linp.sensor_ht.ks2bb"]

with:

• temperature: mi=18433
• humidity: mi=18440 in XiaomiGateway3 mapping, but live BLE advertisements from this device also show compact humidity-like payloads under 0x4802
• battery: mi=20483
• action events:
  • 5.e.1012 = single
  • 5.e.1013 = double
  • 5.e.1014 = hold

Notes from live testing:

• GATT connection does not appear to be useful; the device should be handled passively from BLE advertisements.
• Some encrypted frames include the MAC in the service data (frame_control=0x5958).
• Some encrypted frames omit the MAC from the service data (frame_control=0x5948). For these frames, the BLE address from the scanner must be used when building the AES-CCM nonce.
• Blowing on the sensor caused the decoded humidity payload to increase, confirming the humidity interpretation.
• Temperature frames were also captured after environmental change.

Reference implementation:
I created a small MicroPython/Python decoder with synthetic test vectors and without private bindkeys or device credentials:

https://github.com/Tinnci/linpk2

BLE advertisements

The following examples are redacted to avoid publishing a real device MAC address or bindkey. I can provide full raw advertisements privately if needed.

Observed encrypted action payloads after AES-CCM decrypt:

single press:
plaintext: 0c5600
decoded: action = single

double press:
plaintext: 0d5600
decoded: action = double

long press / hold:
plaintext: 0e5600
decoded: action = hold

Observed humidity-like compact payloads after AES-CCM decrypt:

plaintext: 02480135
decoded: object_id = 0x4802 / 18434, humidity = 30.9%

plaintext: 02480139
decoded: object_id = 0x4802 / 18434, humidity = 31.3%

plaintext: 02480144
decoded: object_id = 0x4802 / 18434, humidity = 32.4%

plaintext: 02480150
decoded: object_id = 0x4802 / 18434, humidity = 33.6%

plaintext: 02480159
decoded: object_id = 0x4802 / 18434, humidity = 34.5%

plaintext: 0248015c
decoded: object_id = 0x4802 / 18434, humidity = 34.8%

Observed temperature payloads after AES-CCM decrypt:

plaintext: 0148040000f441
decoded: object_id = 0x4801 / 18433, temperature = 30.5 °C

plaintext: 0148040000f041
decoded: object_id = 0x4801 / 18433, temperature = 30.0 °C

plaintext: 0148040000ec41
decoded: object_id = 0x4801 / 18433, temperature = 29.5 °C

Sanitized raw frame patterns:

Action / compact humidity frames, MAC included:
02010619 1695fe 5859 0b52 <counter> <mac_reversed> <encrypted_payload> 9a0000 <mic>

Temperature frames, MAC omitted from service data:
02010616 1695fe 4859 0b52 <counter> <encrypted_payload> 9a0000 <mic>

For the MAC-omitted frames, the BLE scanner address is required to build the MiBeacon nonce.