The Key Moves Into the Phone: What Aliro Certified Locks Change About Your Doors

There is a small ritual at the end of almost every construction project. The builder hands over a ring of keys, someone counts them aloud, and everyone agrees not to wonder how many copies were cut during the months the site stood open to trades. We have watched that scene in houses with fiber to every room and in offices with a network closet worth more than the furniture. The building is modern in every respect except the one thing standing between it and the parking lot.

That is finally changing, and this month it stopped being theoretical. Locks certified under the access control standard called Aliro have begun reaching store shelves, which means the credential that opens a door can live in a phone or a watch without committing the owner to one manufacturer's private ecosystem.

What the standard actually settles

Aliro comes from the Connectivity Standards Alliance, the same organization behind Matter, and version 1.0 was published on February 26, 2026. The Alliance describes it as a communication protocol and credential standard governing how a user device speaks to an access point. In practice it defines two kinds of participants: phones and wearables on one side, electronic locks and readers on the other. The Alliance is explicit that the target is not only the front door of a house, naming corporate buildings, hospitality, universities, single family homes and multi family properties as intended settings.

The problem being solved is not technical novelty. Digital keys have existed for years. They simply did not travel. A credential issued for one brand of lock meant nothing to another, and a reader from one manufacturer pushed every phone in the building into that manufacturer's app. Tobin Richardson, the Alliance's president and chief executive, framed the release as work that "is solving the fragmentation that has held back digital key adoption, replacing it with a single interoperability standard." The Alliance counts more than 220 member companies overall, spanning lock makers, chip vendors and mobile platforms.

Three radios, three different moments

What makes the specification interesting to anyone who installs hardware is that it refuses to pick a single radio. Near field communication, running at 13.56 MHz, handles the deliberate tap. Bluetooth Low Energy, on 2.4 GHz, handles the longer range exchange a person starts on purpose, and Samsung Research describes it as the layer performing discovery and the opening signaling. Ultra wideband, operating by default on Channel 9 between 7.75 GHz and 8.25 GHz, is what lets a door open without anyone reaching for anything. Samsung's team calls it the intent layer, the part distinguishing a walk toward the door from a pause beside it. Samsung Research also notes a power reserve mode on the tap path, which keeps a credential working on a phone whose battery has run down.

Why ultra wideband matters more than it sounds

Ultra wideband separates this generation of locks from the last. The FiRa Consortium, which shepherds interoperability for the technology, explains the mechanism plainly. The radio uses a very wide channel of 500 MHz and emits pulses roughly two nanoseconds long. Distance is measured by timing the round trip of challenge and response packets, a technique known as time of flight, and the result lands within centimeters.

That precision is a security property, not a convenience. The classic attack against passive entry is the relay, in which an attacker captures the signal from a credential sitting on a kitchen counter, amplifies it, and presents it at the door. FiRa's explanation of why ultra wideband resists this is elegant. Relaying costs time, added time reads as added distance, and the lock concludes the phone is farther away rather than closer. The underlying amendment, IEEE 802.15.4z, adds physical layer protection against the attacks known to work against earlier ultra wideband radios.

The security model underneath

The credential rests on asymmetric cryptography, which the Alliance names directly in its announcement and which Samsung Research describes as the reason an Aliro credential cannot be cloned or spoofed. Two properties matter for buildings. The exchange at the door is point to point, so a lock needs no live internet connection to decide whether to open, and the design keeps personal information out of the conversation, passing only the authorization a transaction requires.

The Alliance also operates a certification program with supporting test suites administered through authorized test labs. For integrators this is the most consequential sentence in the whole announcement, because a logo on a box is worth something only when an independent laboratory had to agree with it before the box shipped.

What is actually shipping

The first consumer evidence arrived on September 25, 2026, when ULTRALOQ introduced three locks. The Bolt Pro at $269.99 and the Latch 5 Pro at $249.99 are certified for both Aliro and Matter, and both accept credentials held in Apple Wallet and Samsung Wallet alongside fingerprint and keypad entry. A third model, the Bolt Mission at $299.99, pairs ultra wideband with radar based presence sensing and is listed as Matter certified. The manufacturer lists availability through its own channels and Amazon now, with distribution through The Home Depot beginning in October.

Three locks from one company is not an industry transition, but it is the first time a homeowner can buy a lock off a retail shelf and expect the credential inside it to behave like a standard.

What Aliro does not replace

Enthusiasm for wallet based entry tends to outrun what the specification actually covers. Aliro governs the conversation between a user device and the hardware on the door. It does not govern the controller behind that door, the audit trail an insurer may ask to see, the link between an access list and payroll records, or the fire code deciding how an opening behaves when an alarm sounds. Those remain the work of a properly designed access control system, and in a commercial building they are most of the work.

The Alliance is equally clear that Aliro and Matter are complementary and independent. A device may support either or both, and neither requires the other, a distinction that matters the moment a client reads a product page and assumes one certification implies the other.

Credential strength is also only one variable in a risk decision. NIST Special Publication 800 116 Revision 1, issued in June 2018 as guidance for using federal identity credentials in facility access, rests on exactly that premise, describing a risk based strategy for choosing authentication mechanisms rather than applying one uniformly. A phone at a suite door and a phone at a server room are not the same problem, and treating them identically is how good hardware produces a bad outcome.

What to do about it now

For a house under construction, the useful move is unglamorous. Prepare the openings and the pathways before the finishes go on. Confirm the backset and handing of every door against the hardware intended for it, run low voltage cable to any opening that might one day carry a reader instead of a standalone lock, and make sure wireless coverage reaches the entries rather than stopping politely at the foyer. Cutting a reader into a finished stone surround is expensive in a way that planning for it at framing never is.

For a business, the question is sequencing. If your readers are approaching the end of their service life, a standard carrying this much mobile platform support is a reasonable thing to plan a replacement cycle around. If the system went in last year, the sensible next step is an inventory. Know which credentials are in circulation, who holds the authority to revoke them, and how long revocation actually takes when somebody resigns on a Friday afternoon. That discipline is what fails in most buildings, and no radio protocol repairs it.

If you are building, renovating, or simply tired of not knowing how many keys to your building exist, we are glad to walk the openings with you and put a plan on paper. Start on our contact page or call (781) 506-6008.

Sources

Connectivity Standards Alliance: Introducing Aliro 1.0
Connectivity Standards Alliance: Aliro frequently asked questions
FiRa Consortium: How ultra wideband works
Samsung Research: Standardized access control between mobile device and door lock
ULTRALOQ: Next generation smart lock collection
NIST: Guidelines for the Use of PIV Credentials in Facility Access