S2 security & SmartStart
S2 is Z-Wave’s modern security framework: devices join with authenticated, encrypted inclusion, verified by entering a 5-digit PIN from the device’s DSK (Device Specific Key) or scanning its QR code. SmartStart builds on it — scan the QR code before installing, and the device joins the network automatically when powered up, with no inclusion-mode dance.
S2 replaced the older S0 scheme, which exchanged its key weakly and chattered enough to burden the mesh. S2 has three classes — Unauthenticated, Authenticated, and Access Control — with locks and garage door openers required to use the strongest. The DSK PIN step is what makes inclusion authenticated: it proves you are adding the physical device in your hand, not whatever a nearby attacker offers during the pairing window.
Both S2 and SmartStart are mandatory on 700- and 800-series certified devices, so current hardware has them by default. Practical advice regardless of platform: keep the QR/DSK stickers (some are on peel-off tabs), include security devices with S2 rather than unsecured, and avoid forcing legacy S0 on battery sensors — its overhead measurably shortens battery life.