Aqara U100 Smart Lock

Aqara U100 Smart Lock
Security Grade A- Calculator v1	Aqara U100 Smart Lock Brand: Aqara (Parent: Lumi United) Category: Lock • Model / Gen: u U100 Release Date: 2023-05-23 • Status: In sale Classification Date: 2025-09-24 • Official Website

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	[Link to Physical Security Test 🔗 Proof]	It is equipped with tamper detection and brute-force attack alarms. Physical attacks will trigger an alarm.
Known vulnerabilities	None	[Link to Security Research Platform 🔗 Proof]	As a relatively new product, there are no widely disclosed critical vulnerabilities yet. However, its complex multi-authentication system expands the potential attack surface.
Prior attacks	None	—	No reports of large-scale real-world attacks have been found so far.
Updatability	Very common	[Aqara Home App OTA Update 🔗 Proof]	Key Advantage: Supports wireless firmware updates via a gateway, which is crucial for maintaining long-term security.
Category Score	Score: 2 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[August Cloud Service 🔗 Proof]	Authentication with cloud servers must be extremely strict to control lock access permissions.
Communications	Encrypted with up-to-date encryption	[TLS 1.2/1.3 🔗 Proof]	Baseline Requirement: All communications between the mobile phone, lock, and cloud must use strong encryption. BLE pairing should also use strong encryption.
Storage	Encrypted with up-to-date encryption	—	Baseline Requirement: Electronically stored keys and user credentials (stored locally) must be encrypted.
Category Score	Score: 2 / 3

Criterion	Value	Proof	Comment
Account management	Full	[Aqara App 🔗 Proof]	Supports creating up to 50 users, and manages temporary passwords, fingerprints, and NFC cards by time period and permission level.
Authentication	Secure	[Multi-factor Authentication Fingerprint (biometrics) + Password (knowledge) + NFC card (possession). 🔗 Proof]	Provides multiple strong authentication methods. Whether biometric data is processed locally is crucial.
Brute-force protection	Exist	—	Locks and sends an alert after multiple incorrect password entries.
Event logging	Access event logged	[Detailed Logs in App 🔗 Proof]	Records the unlocking method, user, and time for each unlock in detail, and allows setting alerts for abnormal behaviors.
Passwords	Require change after setup with complexity requirements	—	Administrator passwords should be forced to meet complexity requirements. Temporary passwords can be set with an expiration period.
Category Score	Score: 1 / 3

Property	Details
Operating System & App	Embedded RTOS (Companion App: Aqara Home App)
Hardware (CPU / GPU)	CPU: High-performance ARM Cortex-M series MCU • GPU:
Memory & Storage	Memory: • Storage: Store fingerprints, passwords, and unlock logs locally
Power, Battery & Charging	Battery: Rechargeable lithium battery • Power: Battery-powered, supports Type-C emergency power supply • Charging: May support (e.g. for lithium batteries)
Display & Camera	Display: Touch the numeric keypad, LED status light • Camera:
Sound & Connectivity	Sound: Voice prompt, warning buzzer • Connectivity: Zigbee 3.0 (core connection, requires Aqara gateway), Bluetooth (direct connection to mobile phone), NFC
Physical (Dimensions & Mass)	Dimensions: • Mass: