S2 security & SmartStart
S2 is Z-Wave’s modern security framework: devices join with authenticated, encrypted inclusion, verified by entering a 5-digit PIN from the device’s DSK (Device Specific Key) or scanning its QR code. SmartStart builds on it — scan the QR code before installing, and the device joins the network automatically when powered up, with no inclusion-mode dance.
S2 replaced the older S0 scheme, which exchanged its key weakly and chattered enough to burden the mesh. S2 has three classes — Unauthenticated, Authenticated, and Access Control — with locks and garage door openers required to use the strongest. The DSK PIN step is what makes inclusion authenticated: it proves you are adding the physical device in your hand, not whatever a nearby attacker offers during the pairing window.
Both S2 and SmartStart are mandatory on 700- and 800-series certified devices, so current hardware has them by default. Practical advice regardless of platform: keep the QR/DSK stickers (some are on peel-off tabs), include security devices with S2 rather than unsecured, and avoid forcing legacy S0 on battery sensors — its overhead measurably shortens battery life.
| Mandatory since | 2017 for Z-Wave certification; also required for Z-Wave Long Range |
|---|---|
| Key exchange | Elliptic-curve Diffie-Hellman on Curve25519, with AES-128 CCM for payloads |
| DSK format | 40 digits in eight groups of five; you type the first group as the authentication PIN |
| Security classes | S2 Unauthenticated, S2 Authenticated, and S2 Access Control |
| Access Control class | Required for locks and garage door openers — the strongest tier |
| S0 overhead | About three frames per command against one for S2, with the battery cost that implies |
What S0 got wrong
The original S0 framework encrypted traffic properly once running, but handed over the network key during inclusion using a temporary key that was a published constant. Anyone with a radio listening at the moment a device joined could capture that exchange and derive the key. The window was narrow — seconds, during inclusion — but for a front door lock, “narrow” is not the standard you want.
S0 was also expensive on the wire. Every secure command required a nonce request, a nonce report, and then the encapsulated message: three frames where an unsecured command needed one. On a network of forty devices that is a lot of extra airtime, and on a battery sensor waking to report a temperature it is three transmissions instead of one, several times an hour, for years.
That combination is why the advice on legacy devices is what it is: use S0 only where a device supports nothing better, and never force it on a battery sensor that would otherwise run unsecured or on S2.
How S2 fixes both problems
S2 replaces the shared-constant handshake with an ephemeral elliptic-curve Diffie-Hellman exchange on Curve25519. The two sides derive a shared secret that never crosses the air, so passive sniffing yields nothing. What remains is the active attack — a device in the middle presenting its own public key — and that is exactly what the DSK PIN closes. The controller shows you part of the device’s public key and asks you to confirm it from the sticker in your hand, which an attacker cannot forge.
The three classes exist so that the blast radius of a compromise is bounded. Access Control, mandatory for locks and garage openers, gets its own key; Authenticated covers most sensors and switches where you entered the PIN; Unauthenticated covers devices joined without it. A compromised light switch key does not open the door.
On traffic, S2 synchronises nonces between controller and device rather than negotiating one per message, so a secure command is a single frame. Encryption on S2 therefore costs close to nothing in airtime or battery — which removes the last honest reason to include a device unsecured.
SmartStart, and what to do at inclusion time
SmartStart turns inclusion inside out. Instead of putting the controller into inclusion mode and then triggering the device, you scan the device’s QR code into the controller’s provisioning list first — from the box, before the device is even installed. When it powers up it announces itself, the controller recognises the DSK it was told to expect, and the device joins automatically with the right security class. For a device going onto a gatepost or into a ceiling, this is the difference between a one-person job and a two-person one.
The practical consequences are all about the sticker. QR codes and DSKs are printed on the device, on the box, and often on a peel-off tab meant to be stuck into the manual. Photograph all of them before installation. A device whose DSK you cannot read can still usually be included unauthenticated, but you have given up the tier that matters on a lock.
At inclusion, take the highest class the device offers and do not downgrade to make a stubborn pairing work — an unsecured lock is worse than no smart lock. Afterwards, verify: Z-Wave JS and zwave-js-ui show the security classes actually granted per node, and a lock that ended up on S2 Unauthenticated because someone skipped the PIN prompt looks fine in every other respect.
Frequently asked questions
Is Z-Wave secure?
Modern Z-Wave is, and by default. S2 has been mandatory for certification since 2017, uses elliptic-curve key exchange with AES-128 encryption, and authenticates inclusion with a PIN printed on the device. The weak point is legacy: devices old enough to only speak S0 have a genuine inclusion-time vulnerability, and devices included unsecured have none of this at all.
What is a DSK on a Z-Wave device?
The Device Specific Key — a 40-digit value in eight groups of five, derived from the device’s public key and printed on the device, box, or manual, usually alongside a QR code. During S2 inclusion the controller asks you to type the first five-digit group. That step proves the device you are adding is the physical one in your hand rather than something else answering during the pairing window.
Should I add a Z-Wave device with S2 or unsecured?
S2, at the highest class the device offers. The old objection — that encryption tripled the traffic and drained batteries — applied to S0 and does not apply to S2, which sends one frame per command. For locks and garage door openers this is not optional in any meaningful sense; for sensors and switches it costs nothing worth measuring.
What is SmartStart and do I need it?
SmartStart lets you scan a device’s QR code into your controller before installing it, so it joins automatically the first time it is powered up — no inclusion mode, no button sequence, no ladder trips. You do not need it, but it is markedly easier for devices going somewhere awkward, and Z-Wave Long Range requires it. The controller has to support it; most current ones do.
Does S2 encryption drain Z-Wave batteries?
No. S2 uses pre-agreed nonces, so a secure command is a single frame, the same as an unencrypted one. The framework that hurt battery life was S0, which needed a nonce request and response before every message — three transmissions per report on a device that wakes hundreds of times a month. Forcing S0 on a modern sensor is the mistake worth avoiding.