I would like to understand if secure pairing can be implemented in all (or none?) IoT RF standards.

For example: BLE provides Out-of-band possibility, which seems like only really secure option to me. But I have hard time finding information on security of WiFi, Z-Wave, ZigBee, XBee, LoRa, Ingenu, TI15.4 and other protocols during pairing.

Could you suggest some standards which support secure pairing "out of the box"?

1 Answer 1


Most modern RF standards/protocols offer or require secure pairing. The appropriate Alliances or Consortia behind the standards have taken the necessary steps in their own way:

  • For WiFi (WPA, etc), the password is the out-of-band piece.

  • Z-Wave and Z-Wave Plus also have an "install key" (e.g. printed on a sticker) that you need to pass to the IoT hub before the device can join. Much of the new security systems run on Z-Wave and the "really secure option" thing has been thought about.

  • ZigBee Pro Home Automation has a secret join key (not so secret anymore) that is used only during the joining (if your device doesn't have an install key). This makes the network vulnerable only at the instance you join a new device to the network, and only if the attacker knows the [not-so] secret key. Note: ZigBee Alliance no longer certifies new devices of this type. See ZigBee 3.0.

  • ZigBee 3.0 requires an install key which again is an out-of-band code passed to the Hub (e.g. sticker, NFC).

  • LoRa Similar set up. Except, IIRC, with LoRa WAN you pass the key to the LoRa server, not the immediate gateway the device is attaching to.

You can read further detail on respective websites. Different protocols use different words/Language this process and it can be confusing. The loosely equivalent terms are usually: Paring, Joining, Commissioning, and Provisioning.

  • Thank you for an excellent summary. One question: How is the "install key" typically passed to the gateway? Is it through an user app or do gateways needs keyboard/ways of input? Apr 5, 2018 at 17:08
  • Any secure method of entry into the GW works. The common way is through another (secure) network such as TLS over TCP/IP via an app but if the GW is "air-gapped" keyboard, barcode reader, or USB are all options.
    – MandoMando
    Apr 21, 2018 at 14:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.