AN1089: Using Installation Codes with

Zigbee Devices

This application note provides an overview of using installation

codes with Zigbee devices. It also explains (with the help of ex-

amples) how to use the EM3xx utilities or Simplicity Commander

to check, write, verify, and erase installation codes on Silicon

Labs EM3x and Wireless Gecko (EFR32™) devices.Finally, it

provides a complete example of how to join a Z3 network with an

installation code-derived link key.

Silicon Labs recommends that you be familiar with creating example applications and

using the Network Analyzer, as described in QSG106: Getting Started with EmberZNet

PRO.

KEY POINTS

• Concepts of the Zigbee installation code

• Programming examples for installation

codes on EM3x and EFR32 devices

• Checking, writing, verifying, and erasing

installation codes on target devices

• Joining a Z3 network with an installation

code-derived link key

silabs.com | Building a more connected world. Rev. 0.3

1. Installation Code Overview

1.1 What Is an Installation Code?

Zigbee installation codes, sometimes also referred to as “install codes,” are provided as a means for a device to join a Zigbee network

in a reasonably secure fashion. The installation code itself is a random value installed on the joining device at manufacturing time, and

is used to encrypt the initial network key transport from the Zigbee network’s centralized Trust Center device (the coordinator) to the

joining device. With the creation of the Zigbee 3.0 standard in late 2016, all Zigbee devices capable of joining networks (as opposed to

forming them) must support the use of installation codes during joining, as this is a requirement for Zigbee 3.0 compliance.

The installation code can be thought of as similar to the PIN code on Bluetooth devices when two devices are paired. The PIN code is

provided as an authorization code for the parent device so that the joining device knows it is receiving information securely, such as

when a hands-free headset is paired to a smartphone.

The installation code is typically printed on the case or packaging of the device, either as a hexadecimal string or in an encoded fashion

such as a barcode or QR code, and provided through an out-of-band mechanism to the Trust Center device or its associated web/cloud

interface, along with the 64-bit IEEE MAC address (“EUI64”) of the device. If this device-specific data is stored on a remote web server

or cloud-based system, that remote system then securely transports that information to the Trust Center to establish security creden-

tials for the joining device in advance of the in-band joining process.

1.2 Caveats for Zigbee Smart Energy (ZSE) Devices

The Trust Center and the joining device use the installation code as a shared key to establish an initial bond of trust allowing the new

device to join the Zigbee network. Once the device has successfully joined the network for which it is authorized, Zigbee requires that

the node negotiate a new Trust Center link key for future secure exchanges with the Trust Center. In standard Zigbee 3.0 networks, this

occurs through a key request directly to the Trust Center. However, in Zigbee Smart Energy networks, which behave differently from

standard Zigbee 3.0 networks, the new Trust Center link key is derived through a special process known as Certificate-Based Key Es-

tablishment (CBKE). For more information about the CBKE process, refer to UG103.5: Fundamentals of Zigbee Security. Note that the

CBKE process requires installing CBKE data certificates signed by Certicom during the manufacturing process. Refer to AN708: Setting

Smart Energy Certificates for Zigbee Devices for details about how to set these certificate data. Also consult AN714: Smart Energy

ECC-Enabled Device Setup Process for more information about the requirements for preparing Zigbee smart energy (ZSE) devices to

be able to join a network and for troubleshooting this process.

This document outlines common practices relating to installation codes for either a standard Zigbee 3.0 device or a ZSE device.

AN1089: Using Installation Codes with Zigbee Devices

Installation Code Overview

silabs.com | Building a more connected world. Rev. 0.3 | 2