Changing TC Link Key with XBee Coordinator and nRF52840 Router in Centralized Zigbee Network

[jemalkorra]

Hi Nordic Team,

I am working on a project where I am using an XBee module as the Zigbee coordinator in a centralized network and an nRF52840 (running the ZBOSS stack from the nRF5 SDK for Thread and Zigbee) as a Zigbee router.

We have encryption enabled in the network and would like to use a custom TC link key instead of the default ZigBeeAlliance09 key. The XBee coordinator is responsible for managing the network keys and securely authenticating devices.

I came across an older post that mentioned the following:

1. The default TC link key (ZB_STANDARD_TC_KEY) cannot be changed without recompiling the ZBOSS library.
2. A custom TC link key can only be implemented if using install codes (a Zigbee 3.0 feature).

Given that the post is from over three years ago, I’d like to know if there have been any updates or new APIs introduced in ZBOSS to support the configuration of a custom TC link key in a centralized network scenario. Specifically:

1. Is it now possible to configure a custom TC link key via the ZBOSS stack without recompiling?
2. If the XBee coordinator uses a preconfigured custom TC link key, is there an approach to configure the nRF52840 router to work with it?
3. Are there any additional steps or examples that might help with this configuration?

Thanks in advance for your help! I’d greatly appreciate any insights or guidance on this topic.

Best regards,

Julen

[Edvin]

Hello Julen,

I understand. It would require the device to be connected via serial to something that will send it the link key though, right? It is a bit unusual, and not the way I would think that standard zigbee devices would work.

I don't know if you are in control of the FW on all the devices in the network, but I would think Install Codes are made for this purpose. When all devices are using the same link key, it means that most zigbee devices will work in all zigbee networks out there, but you can use install codes to decide what devices that are allowed to join, and to make sure that another network doesn't hijack your device. 

Most likely, this feature request will not be added in the current R22 Zboss library, but I can add it so that it can be considered for the R23 Zboss library. This will probably only be supported by the nRF54L series, though.

Best regards,

Edvin