Z-Wave
Sub-GHz smart-home mesh. The cipher is AES-128; the break is the key bootstrap. S0 hands the network key out under an all-zero key during inclusion and has no anti-replay.
Z-Wave is a sub-GHz mesh networking protocol for smart-home devices, the sub-GHz counterpart to Zigbee's 2.4GHz mesh. It runs locks, sensors, and switches on a proprietary stack (originally Zensys, now Silicon Labs). Like Zigbee, its security rests on AES-128, and like Zigbee, the practical break is not the cipher but the key bootstrap during device inclusion.
What it is
Z-Wave lives in the sub-GHz ISM bands, which is why a 2.4GHz radio (BLE or Zigbee) cannot even hear it:
| Region | Frequency |
|---|---|
| EU | 868.42 MHz |
| US | 908.42 MHz |
| Other | 916 / 921 MHz and regional variants |
A network is a source-routed mesh. One primary controller forms the network and assigns a 32-bit HomeID; every node gets an 8-bit NodeID (so a network tops out around 232 nodes). Mains-powered routing slaves relay for battery slaves. Device functions are exposed as command classes (Binary Switch, Door Lock, Sensor Binary, and so on), the Z-Wave equivalent of Zigbee clusters. Devices join through inclusion (adding a node to the network), which is when a security-capable node is given the network key.
Why it matters
Everything hinges on how the network key is handed over at inclusion, and Z-Wave has two generations:
- S0 (legacy security) uses AES-128, but it derives and distributes the network key during inclusion encrypted under an all-zero temporary key (
00 00 ... 00). Anyone who captures the inclusion can recover the network key. S0 also has no nonce-based anti-replay, so captured commands (an unlock, a switch-on) replay. - S2 (the modern scheme) fixes both: it establishes keys with ECDH (Curve25519), authenticated out-of-band by a device-specific DSK printed as a PIN/QR on the device, and every message carries a fresh nonce. S2 is not broken the way S0 is.
The lesson mirrors Zigbee: capture the join/inclusion, exploit the weak provisioning, and you own the network without ever attacking AES. Even on an S2 network, forcing a device to be re-included can regress it, and mixed networks fall back to S0 for legacy nodes.
How to work it
Z-Wave needs a sub-GHz radio; your 2.4GHz Zigbee or BLE hardware is useless here.
- Tune to the regional frequency and capture with an SDR flowgraph or a Z-Wave sniffer:
# SDR receive around 868.42 MHz (EU) with scapy-radio / gr-zwave,
# or use EZ-Wave, or a Silicon Labs Zniffer stick.
- Watch for an inclusion. On an S0 network the transported network key is recoverable from that capture, because it was protected only by the all-zero key.
- Load the recovered network key into your decoder and read the command-class traffic (Door Lock, Binary Switch).
- Replay a captured S0 command, or craft one from a spoofed source, to actuate a device (the reason S0's missing anti-replay matters).
Pitfalls
- Z-Wave is not Zigbee. Same "AES-128, weak bootstrap" story, but a different stack on a different band. A 2.4GHz radio will never capture it; you need sub-GHz hardware tuned to the right regional frequency.
- Get the region right. Capturing at 908.42 MHz (US) hears nothing from an 868.42 MHz (EU) network.
- The all-zero-key trick is an S0 property. Against S2 (ECDH + DSK + per-message nonce) it does not apply; confirm the security class before assuming an easy key.
- Recovering the key needs the inclusion event. If every device was included long ago, you must trigger a re-inclusion, not wait for one.