"Reset used DevNonces" button not working

[StevenCellist]

Summary

The Reset DevNonces button under a device's Join Settings does not work.

Steps to Reproduce

1. Create a LoRaWAN v1.0.4 / v1.1 device
2. Have a device join such that DevNonce > 1
3. Reset the device's DevNonce (which is something that may occur with a broken firmware update or unfortunately timed power loss)
4. Hit the Reset button
5. Have the device try to join

Current Result

DevNonces are not reset. The workaround is to enable the checkbox that the device resets its DevNonces, then have the device join, then disable the checkbox.

Expected Result

Hitting the Reset button should allow the device to rejoin with DevNonce lower than last known value.

Relevant Logs

URL

No response

Deployment

The Things Stack Community Edition

The Things Stack Version

3.34.3

Client Name and Version

Other Information

Just taking this bit of space to thank you for the amazing work on TTS (especially Sandbox) and the great conference! I'm a big fan :)

(And the dropdown menu for TTS version on this issue format does not use the Sandbox naming scheme but still uses Community edition.)

Proposed Fix

No response

Contributing

• I can help by doing more research.
• I can help by implementing a fix after the proposal above is approved.
• I can help by testing the fix before it's released.

Validation

• The fix is tested in a staging environment.
• The fix is documented in The Things Stack Documentation

Code of Conduct

• I agree to follow TTN's Community Code of Conduct.

[johanstokking]

I cannot reproduce. Any used_dev_nonces are gone when clicking this button.

What events (in the verbose event stream) do you see in the end-device live data view?

---

Just taking this bit of space to thank you for the amazing work on TTS (especially Sandbox) and the great conference! I'm a big fan :)

Thanks for your kind words.

(And the dropdown menu for TTS version on this issue format does not use the Sandbox naming scheme but still uses Community edition.)

Fixed in 007761b.

[StevenCellist]

@johanstokking thanks for checking this out!

Bottom right corner says DevNonces reset at 14:12.

Console shows DevNonces "updated" at 14:12, yet still fails to join.

The json of this DevNonce event:

{
  "name": "js.end_device.update",
  "time": "2025-10-06T12:12:58.689010120Z",
  "identifiers": [
    {
      "device_ids": {
        "device_id": "mjlo-012",
        "application_ids": {
          "application_id": "meet-je-leefomgeving"
        },
        "dev_eui": "70B3D57ED006F2F0",
        "join_eui": "CE77157000000000"
      }
    }
  ],
  "data": {
    "@type": "type.googleapis.com/google.protobuf.Value",
    "value": [
      "used_dev_nonces"
    ]
  },
  "correlation_ids": [
    "rpc:/ttn.lorawan.v3.JsEndDeviceRegistry/Set:5e005b4b-f68e-4cb4-97cd-aad0f3db2e72"
  ],
  "origin": "ip-10-100-7-21.eu-west-1.compute.internal",
  "context": {
    "tenant-id": "CgN0dG4="
  },
  "visibility": {
    "rights": [
      "RIGHT_APPLICATION_DEVICES_READ"
    ]
  },
  "authentication": {
    "type": "Bearer",
    "token_type": "AccessToken",
    "token_id": "x"
  },
  "remote_ip": "x.x.x.x",
  "user_agent": "x",
  "unique_id": "01K6WQ0WY1S7QK71DJC8PBA8AF"
}

And just to show that the checkbox works:

[StevenCellist]

And I now see a small discrepancy for completeness' sake: the checkbox "Resets DevNonces" generates an event that is named "resets_join_nonces", but the JoinNonce (for which there is no point resetting) is technically different from the DevNonce (which is what is actually meant).

[johanstokking]

Thanks for the additional details and apologies for the delay.

the checkbox "Resets DevNonces" generates an event that is named "resets_join_nonces"

You mean the button, right? Where do you see this event name?

but the JoinNonce (for which there is no point resetting) is technically different from the DevNonce (which is what is actually meant).

The checkbox is about "join nonces", plural, in this case both nonces. See info:

So the checkbox about checking DevNonce in general. That is insecure. Not sure if we reset JoinNonce or not (and it might be LoRaWAN version dependent). The button is to reset DevNonces once.

I checked again, and the button works. It does reset the used DevNonces in the Join Server. If I understand you correctly, the cluster-local Join Server still considers the DevNonce too small, even after clicking the button. So that should mean that the network has another source of DevNonces. It sounds indeed that it's not the correct behavior.

[StevenCellist]

You mean the button, right? Where do you see this event name?

Sorry, I see that the checkbox is labelled "join nonces" indeed - somehow I thought it said DevNonces because that is what it is effectively used for. (The JoinNonce verification is up to the device.)

The button is the thing that does not fully flush the DevNonces - my device cannot join after pressing the button.

[johanstokking]

Thanks, the fix is in #7736.

[StevenCellist]

Thank you very much!