Z-Wave security model

The original version of Z-Wave used a security algorithm called triple Data Encryption Algorithm (DES) with 56-bit key, which is a cipher developed by IBM and then selected as an official standard for the United States in 1976. However, Later on Z-Wave gave up this security layer. According to John Walters, Z-Wave Alliance vice president, "The Z-Wave 100 series single chips had triple DES, but not a single customer used it", said Walters. "When we were developing the 200 series we asked our customers about security and everyone said it was not need it."

People get worried about the security issues of Z-Wave without the security layer. John Adams, voice chair of the ZigBee Alliance "is okay for hobby-type tools. But once home automation becomes the way we expert thing to be, then Z-Wave's lack of security becomes a horrible impediment." He then mentioned that since there is no encryption for the Z-Wave messages, someone could set up a sniffer and watch any message and see the addresses of source and destination;he can then becomes that device and spoof a message.

Having realized this issue, Zensys announced the launch of its fourth generation Z-Wave single chip on January 7, 2008. The new generation chip supports 128-bit security encryption called Advanced Encryption Standard (AES), which is a cipher selected by the United States as an official standard. AES is much more reliable than DES. Recently DES has been superseded by the AES.