EnOcean Secure uses a rolling code (an incremental counter) together with a CMAC (Cipher-based MAC built on AES-128) to authenticate every telegram and block replay attacks, which is critical for security-grade applications such as alarms and wireless locks.

EnOcean Secure layers cryptographic protection on top of the standard telegram. A 24 or 32-bit rolling counter is incremented on every transmission, and a CMAC over (data plus counter) is appended using a shared AES-128 key. The receiver only accepts a telegram whose counter is greater than or equal to the next expected value, blocking captured-and-replayed frames. The 16-byte key is exchanged once during the Secure Teach-In. Without Secure mode, the classic EnOcean format is vulnerable to replay attacks, although the 32-bit Device ID still makes random spoofing impractical.

For door locks and alarm sensors, always enable Secure mode end-to-end; mixing one Secure sensor with a non-Secure gateway gives you no protection at all and is the single most common audit failure.