ePIRE (EnOcean Profile for Initial Resync Exchange) is the standardised protocol for secure pairing during Teach-In: it covers the generation and distribution of the shared AES key between a Secure-capable transmitter and receiver.

ePIRE defines how the AES-128 key used by EnOcean Secure is bootstrapped without exposing it in clear over the air. The Secure-capable receiver (the master) generates the key, the transmitter (slave) receives it during the Teach-In window, and both parties store it in non-volatile memory. All subsequent telegrams are then authenticated and / or encrypted with that key. Plain-text Teach-In remains available for non-critical applications, but ePIRE is the recommended path for any security-critical environment such as building alarms or access control.

Document the moment of secure Teach-In in your commissioning log; once the key is sealed in flash, you cannot recover it, and a lost-key device must be factory-reset and re-paired from scratch.