Security Assessment Report - Security 2 Command Class Protocol Review - Executive Summary

Sep 13, 2026

Security Assessment Report documents an independent security evaluation of Sigma Designs’ Security 2 Command Class protocol framework conducted in June 2017. The assessment verifies whether previously identified replay-attack risks were effectively mitigated, whether introduced security controls perform effectively in physical implementations, and whether protocol-level risks remain at an acceptable level. Results are designed to feed a broader risk management process and are explicitly treated as a point-in-time review for the tested system and environment.

LanguageEnglish

CategoryGeneral

FormatPDF

Pages22

Reading Time8 min

AccessFree to download

Assessment Overview

Motivation for conducting security review

About SensePost

Risk Summary

Conclusion & Recommendations

Z-Wave Network Security

Results Summary

Z-Wave Device Assessment

Security Assessment Report | Client | Sigma Designs | | --- | --- | | Project Name | Security 2 Command Class Protocol Review | | Project Code | SP02508 | | Date | 2017-08-18 | TABLE OF CONTENTS 1.1 Assessment Overview .............................................................................................................................. 3 1.2 Motivation for conducting security review......................................................................................3 1.3 About Sense Post ........................................................................................................................................ 3 1.4 Risk Summary..............................................................................................................................................4 1.5 Conclusion & Recommendations........................................................................................................4 2.1 Z-Wave Network Security ...................................................................................................................... 5 3.1 Summary ....................................................................................................................................................... 6 3.2 Z-Wave Controller Components .........................................................................................................6 3.3 Decryption and Replay Attacks ............................................................................................................6 4.1 Results Summary .......................................................................................................................................7 4.2 Z-Wave Device Assessment...................................................................................................................7 5.1 Z Wave Device Assessment ...................................................................................................................9 5.1.1 Data Encryption.................................................................................................................................9 1 EXECUTIVE SUMMARY 1.1 Assessment Overview The assessment of Sigma Designs' Security 2 Command Class commenced on the 19th of June 2017 and concluded on the 21st of June 2017. This assessment was the culmination of several previous projects – both on a documentation review level as well as a technical assessment of the protocol implemented on hardware provided by Sigma Designs. This final project was requested by Sigma Systems in order to identify any final concerns prior to the standard being finalised and published. Sigma Designs engaged the services of SensePost in order to: 􀁸 Evaluate whether the risk of replay attacks identified during previous projects had been effectively mitigated. 􀁸 Evaluate whether the security controls introduced in the Security 2 Command Class were effective when physically implemented. 􀁸 Gauge whether the risk identified within the protocol was at a level acceptable and that such risk would not have a significant impact on the delivery of the service, expose clients to harm or loss or other such consequences. The results provided are the output of the security assessment performed and should be used as input into a larger risk management process. These results are a point in time assessment of the system and environment as they werepresented for testing. Any changes could yield a different set of results. 1.2 Motivation for conducting security review Sigma Designs wanted to verify the security of their newly developed S2 security framework. Third party independent verification from a qualified security analyst chosen in addition to inhouse testing. From experience, this greatly improves the analysis coverage and number offlaws found. Analysts from SensePost had previously demonstrated knowledge and skills needed to uncover flaws in older Z-Wave dev

FAQs

When was the Security 2 Command Class security assessment conducted?

The assessment started on 19 June 2017 and concluded on 21 June 2017.

What was the purpose of conducting the security review for Sigma Designs?

Sigma Designs aimed to verify the security of its newly developed S2 security framework through third-party independent verification in addition to internal testing.

How is the overall risk rating described in the report?

The overall information security risk rating is stated as “Informational,” based on the highest criticality finding and supporting risk statistics shown in the risk summary table.

Sep 13, 2026

Upload by Emma Wilson