AES-128 Encryption in Smart Locks: How Your Lock Keeps Data Secure

Smart locks protect two categories of sensitive data: biometric templates (fingerprint minutiae, facial geometry, palm vein maps) stored at rest on flash memory, and access credentials transmitted over wireless interfaces. AES-128 (Advanced Encryption Standard with a 128-bit key) is the workhorse cipher for both categories across the Philips DDL range and the Auslock product line. This article breaks down exactly how and where it is applied.

Why AES-128 — Not AES-256?

AES-128 provides 2¹²⁸ possible key combinations — a number so large that all computing power on Earth could not brute-force it before the sun expands into a red giant. NIST formally approved AES-128 for TOP SECRET data classification. Smart lock manufacturers choose 128-bit over 256-bit keys because: (1) the nRF52840 hardware AES co-processor is optimised for 128-bit, completing operations in 15 clock cycles vs 21 for AES-256; (2) battery impact is measurable when decrypting biometric templates hundreds of times per day.

AES Modes Used in Smart Locks

AES-128-CBC (Cipher Block Chaining) — Biometric Template Storage

Templates stored in SPI Flash (typically Winbond W25Q64 or equivalent) are encrypted with AES-128-CBC. Each 128-bit (16-byte) plaintext block is XORed with the previous ciphertext block before encryption. An Initialisation Vector (IV) — 16 random bytes generated by the nRF52840 TRNG — seeds the chain. Without knowledge of the IV and the 128-bit master key (burned into the nRF52840’s UICR key storage during manufacture), the stored templates are unreadable even if an attacker physically extracts the SPI Flash chip.

AES-128-CCM (Counter with CBC-MAC) — BLE Link Layer

Bluetooth Low Energy 4.2+ uses AES-128-CCM for link-layer encryption. CCM combines counter mode (CTR) for confidentiality with CBC-MAC for integrity authentication. The 13-byte nonce (7-byte IV + 4-byte packet counter + 2-byte direction flag) ensures that even if the same plaintext is sent twice, the ciphertext differs — preventing replay attacks. The nRF52840 performs BLE CCM encryption entirely in hardware at the radio interface, adding zero CPU overhead.

AES-128-GCM (Galois/Counter Mode) — WiFi / TLS Transport

Philips DDL locks with WiFi (DDL603E-5HWS, 7300-5HWS etc.) connect to the Philips cloud API over TLS 1.2 or TLS 1.3. The negotiated cipher suite is typically TLS_AES_128_GCM_SHA256 (TLS 1.3) or TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (TLS 1.2). GCM provides both authenticated encryption and message authentication (AEAD), making it resistant to padding oracle attacks that plagued AES-CBC in earlier HTTPS implementations.

Key Exchange: ECDH P-256

The 128-bit AES session key itself must be established securely without being transmitted in plaintext. Smart locks use Elliptic Curve Diffie-Hellman (ECDH) with the NIST P-256 curve for initial BLE pairing:

1. Lock generates ephemeral key pair (private key stored in RAM, public key advertised)
2. App generates its own ephemeral key pair
3. Both exchange public keys over unencrypted BLE advertising
4. Each side computes the shared secret: shared = ECDH(own_private, peer_public)
5. Shared secret is hashed (HKDF-SHA256) to derive the 128-bit AES session key

Because both sides use ephemeral keys (generated fresh each session), even if a long-term private key is compromised in the future, past sessions cannot be decrypted — a property called Perfect Forward Secrecy (PFS).

ZigBee AES-128: Two Layers

Auslock’s ZigBee 3.0 architecture (used with G2/G3 gateways) implements AES-128 at two independent layers:

• MAC layer (IEEE 802.15.4): AES-128-CCM* protects each 128-byte MAC frame. The network key (16 bytes, distributed during ZigBee commissioning) encrypts all frames on the mesh.
• Application layer (ZCL): A separate application link key (unique per device pair) encrypts command payloads (e.g., “UNLOCK” command). An attacker who captures and decrypts the MAC layer still sees only encrypted application data.

Biometric Template Encryption at Rest

The SPI Flash chip (e.g., 8 MB W25Q64) stores biometric templates outside the nRF52840’s internal flash. Each template (2–4 KB for fingerprint, 30–60 KB for face) is encrypted before being written:

1. Generate 16-byte random IV via nRF52840 TRNG
2. Pad template to 16-byte boundary (PKCS#7)
3. Encrypt with AES-128-CBC using device master key
4. Store IV + ciphertext + SHA-256 HMAC to flash sector

On unlock attempt, the process reverses: read IV + ciphertext, decrypt, verify HMAC, then run matching algorithm. If HMAC fails (indicating flash corruption or tampering), the template is rejected and an error logged.

Replay Attack Vulnerability in Early BLE Locks

Pre-2022 BLE smart locks sometimes implemented custom (non-standard) BLE application protocols without proper nonce management. An attacker with a BLE sniffer (e.g., Ubertooth One or nRF Sniffer dongle) could capture the encrypted UNLOCK command and replay it later. The lock, lacking a nonce counter, would accept the replayed command.

Modern locks including Philips DDL and Auslock H/S/T series prevent this with per-session command counters (a rolling counter embedded in the command payload, encrypted within the CCM frame). After 2³² commands the counter rolls over — effectively impossible in practice.

Session Token Architecture (Philips and Auslock)

Both Philips and Auslock issue time-limited session tokens for remote access:

• Token = HMAC-SHA256(device_secret, user_id + timestamp + permission_scope)
• Tokens expire after 24 hours (adjustable to 1 hour for high-security deployments)
• Revocation: device checks token against server revocation list on each WiFi/ZigBee command

Conclusion for Installers

When a customer asks “how secure is this lock?”, the answer for Philips and Auslock products is: AES-128 at rest, AES-128-CCM on BLE, TLS 1.3 AES-128-GCM to the cloud, and ECDH P-256 key exchange with Perfect Forward Secrecy. This is the same cryptographic stack used in online banking and government systems — appropriate for any Australian residential or light commercial security application.