When is Z-Wave S2 Security Mandatory?

Question

When Z-Wave had security problems last year, I was pleased to see it announced that S2 Security would be mandatory for all new certifications as of April and that they didn't back off at that time.

So I figured now would the time to pick up some Z-Wave deadbolts, but as far as I can tell none of them support S2 security.

Even devices newly certified as recently as 11/10/2017 do not support S2.

What's the real scoop on S2 security? The attacks on older Z-Wave were devastating but I thought they were addressing the security concerns effectively. I haven't been able to find much talk about this online.

Answer 1

What's the real scoop on S2 security?

I studied a number of products and corresponding Z-Wave Protocol Implementation Conformance Statement issued to these products.

Products that feature S2 Security are all built on Z-Wave Development Kit Version: 6.71.01 or above. For Example, refer two very similar products from same brand:

• The Aeotec LED Bulb 6:Multi-Colour, which bears a Z-Wave Certification Date: 3/23/2018, does not support S2 as it is built on Z-Wave Development Kit Version: 6.51.09. The conformance statement mentions Z-Wave Development Kit Version.
• Whereas, the Aeotec LED Bulb 6: Multi-White, which bears a Z-Wave Certification Date: 3/16/2018; supports S2 security as it is built on Z-Wave Development Kit Version: 6.71.01, as per the conformance statement.

So, S2 Security availability is seemingly tied to Z-Wave Development Kit Version used and not the date device got certified. This pattern repeats itself across all product categories such as locks, lighting devices, thermostats etc.