Aliro UWB Digital Keys: How Hands-Free Access Control Works

Correction, 21 October 2026

An earlier version of this article described Aliro as a vehicle-access standard and as part of the CCC Digital Key specification. Both statements were wrong. Aliro is the Connectivity Standards Alliance’s standard for access control; digital car keys are specified separately by the Car Connectivity Consortium. We have rewritten the article from the published Aliro 1.0 material.

Facts checked on 19 October 2026

Short answer

Aliro is the Connectivity Standards Alliance’s (CSA) standard for opening doors and other access points with phones and wearables. Version 1.0, released on 26 February 2026, defines three transports: NFC for tap, Bluetooth LE for user-initiated access, and Bluetooth LE with UWB for hands-free access.

In hands-free mode, Bluetooth LE carries the access protocol and sets up a UWB ranging session. UWB then measures distance with a scrambled timestamp sequence (STS) keyed by a 32-byte secret that never crosses either radio. Aliro is not a vehicle-access standard, although its UWB sessions reuse structures from CCC Digital Key.

What Aliro covers

The CSA describes Aliro 1.0 as a credential and communication standard between access readers, such as door locks and wall readers, and user devices such as phones and wearables. It calls Aliro a unified standard for the access control ecosystem, with a certification programme run through Authorized Test Labs.

Transport	Typical use	Status in Aliro 1.0
NFC	Tap the phone or watch on the reader	Mandatory in every deployment
Bluetooth LE	User-initiated access	Optional addition
Bluetooth LE with UWB	Hands-free access as the user approaches	Optional; the only secured hands-free mode

The table follows the CSA’s UWB position paper, which states that NFC is mandatory in every Aliro 1.0 deployment, that Bluetooth LE is an optional addition and that only Bluetooth LE combined with UWB gives secured hands-free access.

Aliro and CCC Digital Key are different standards

Aliro comes from the CSA, the alliance behind Matter and Zigbee, and targets doors and buildings. Digital car keys are specified by the Car Connectivity Consortium (CCC) in its Digital Key specification. Aliro is not part of CCC Digital Key.

The two standards do share technology at the UWB layer. Android’s Aliro encoder notes that it “started out as a copy of CccEncoder”, and Qorvo’s Cherry API creates Aliro sessions as CCC sessions with an Aliro initiator or responder. For certification, the FiRa Consortium covers “only the UWB portion of the CSA Aliro product”, and FiRa Core 4.0 added “the full scope for Aliro UWB features”.

How hands-free access works

Nordic’s documentation sums up the split between the radios: “Bluetooth LE carries the Access Protocol and the UWB ranging session setup”, and “UWB then performs secure ranging”. A reader runs this sequence:

Connection. The reader advertises, the user device connects over Bluetooth LE and the two open an L2CAP channel.
Access protocol. The devices authenticate each other (AUTH0, AUTH1) and exchange the credential (EXCHANGE).
Ranging set-up. Four messages, M1 to M4, agree the UWB parameters: configuration, channel 5 or 9, preamble code, slot and round sizes, hopping, MAC mode and the session start time.
Ranging. UWB rounds run with a dynamic STS, and the reader acquires a ranging result.
Decision. The reader reports its status to the user device (Reader Status Changed).

Suspend and resume messages let the two devices pause ranging and restart it within the same session.

Where the security comes from

The keys come out of the access protocol. In the open-source Aliro Actuator, the key derivation (HKDF-SHA256) yields 160 bytes, split into five 32-byte keys that include a Bluetooth LE session key and the URSK, the UWB ranging secret key. The Bluetooth LE keys encrypt the ranging set-up messages with AES-GCM, and the URSK seeds the STS of the UWB session. Neither key is sent over the air.

The STS is what makes the distance hard to fake. A relay can only add delay, which shows up as a longer distance, and a device without the key cannot produce ranging frames that pass the receiver’s STS check.

Certification

The CSA’s announcement states that “Aliro includes a comprehensive certification program and supporting test suites managed through Authorized Test Labs.” DEKRA is recognised by the CSA as an Authorised Test Lab for Aliro, and Allion is authorised as an Aliro test lab in Asia. The CSA’s open-source Aliro Certification Tool (Apache-2.0, release tag aliro-v1.0) runs NFC and Bluetooth LE test suites, including cases that start UWB ranging.

The UWB part has a second path: FiRa’s certification programme lists Aliro UWB as a feature for conformance certification, and FiRa’s FAQ confirms that this does not replace CSA certification. Certified Aliro products have started to appear; the CSA’s database lists an electronic lock certified on 21 September 2026 with Aliro NFC support.

Chips and SDKs

Silicon vendors publish Aliro building blocks. Qorvo’s QM35 Aliro SDK (v1.1.0) includes a UWB adapter that takes the 32-byte URSK through aliro_uwb_session_set_ursk(). Nordic’s nRF Door Lock and Access Control Add-on implements the Bluetooth LE transport and states that a third-party UWB SDK “must accept an externally supplied URSK”. Silicon Labs has published release notes for Aliro version 2.0.0 of its SDK (3 August 2026).

What to plan for an Aliro product

Start from NFC, which every Aliro 1.0 deployment needs, and add Bluetooth LE with UWB if you want hands-free access.
Choose a UWB part and SDK that support Aliro sessions and accept an externally supplied URSK.
Test walk-up behaviour at a real door with real phones, not only on a bench.
Test both radios together: a hands-free failure often starts on one radio and shows up on the other.
Book an Authorized Test Lab early and ask whether the UWB part of your reader also needs FiRa certification.

How needCode helps

needCode builds UWB firmware on Qorvo silicon and tests hands-free flows with its Modular UWB Sniffer, which decodes Aliro and records the Bluetooth LE set-up and the UWB ranging on one timeline.