Changing TC Link Key with XBee Coordinator and nRF52840 Router in Centralized Zigbee Network

[jemalkorra]

Hi Nordic Team,

I am working on a project where I am using an XBee module as the Zigbee coordinator in a centralized network and an nRF52840 (running the ZBOSS stack from the nRF5 SDK for Thread and Zigbee) as a Zigbee router.

We have encryption enabled in the network and would like to use a custom TC link key instead of the default ZigBeeAlliance09 key. The XBee coordinator is responsible for managing the network keys and securely authenticating devices.

I came across an older post that mentioned the following:

1. The default TC link key (ZB_STANDARD_TC_KEY) cannot be changed without recompiling the ZBOSS library.
2. A custom TC link key can only be implemented if using install codes (a Zigbee 3.0 feature).

Given that the post is from over three years ago, I’d like to know if there have been any updates or new APIs introduced in ZBOSS to support the configuration of a custom TC link key in a centralized network scenario. Specifically:

1. Is it now possible to configure a custom TC link key via the ZBOSS stack without recompiling?
2. If the XBee coordinator uses a preconfigured custom TC link key, is there an approach to configure the nRF52840 router to work with it?
3. Are there any additional steps or examples that might help with this configuration?

Thanks in advance for your help! I’d greatly appreciate any insights or guidance on this topic.

Best regards,

Julen

[jemalkorra]

Hi everyone,

I’ve solved the issue! Now, I’ve configured the Zigbee network to use a Distributed Trust Center (TC), which allows me to use different link keys.

As a thought, in a Centralized TC setup, it might be beneficial if Nordic could modify link keys dynamically instead of relying on the hardcoded Zigbee Alliance Key.

Just an idea—curious to hear your thoughts!

Thanks,
Julen

[Edvin]

Hello Julen,

Sorry for the late reply!

I'm glad to hear that you found a solution. 

I will forward your thoughts to our Zigbee team, but I would like to hear your thoughts on the topic first. 

What do you imagine being the application flow? Do you want the key to be decided runtime? Or compile time? Do you know any other devices supporting this, and how do they do it?

Best regards,

Edvin

[jemalkorra]

Hi Edvin,

No problem, and thanks for getting back to me.

What I want is to have a centralized Trust Center, which in our case will be the XBee coordinator. The idea is to generate the link key dynamically based on some internal information combined with random data. This link key would then be configured through UART, ensuring that all devices share the same PAN ID and link key, with the coordinator acting as the centralized Trust Center.

However, since the link key cannot be changed without distributing the Trust Center, we had to modify the process. I'm not sure if this approach fully aligns with the Zigbee standard, or if there are best practices we might be overlooking. Let me know your thoughts.

Best regards,

Julen