Smart locks advertise AES-128 encryption as a security feature. The cipher is real — communications between the lock and the phone app are encrypted with a standard, strong algorithm. The lock cannot be broken by breaking the cipher.
The lock can be broken by replaying the cipher. In multiple commercially available smart locks, the encrypted unlock command is identical every time. The phone sends the same encrypted packet to unlock the door. An attacker with a $30 Bluetooth sniffer captures the packet once, then replays it to unlock the door at will. The encryption is unbroken; the door is open.
The vulnerability is not in the cryptography but in the protocol. AES-128 is a block cipher — it encrypts data. It does not, by itself, ensure that each message is unique. That requires a nonce, a counter, or a challenge-response mechanism — standard practice in secure protocol design. Several smart lock manufacturers implemented the cipher without the protocol, producing communications that are perfectly encrypted and perfectly replayable.
The marketing is technically accurate. The lock uses AES-128. The communication is encrypted. But “encrypted” and “secure” are not synonyms. Encryption ensures confidentiality — an eavesdropper cannot read the content. It does not ensure freshness — an eavesdropper does not need to read the content to reuse it.
The lock's security model assumes the threat is decryption. The actual threat is recording. The most expensive component of the security system — the cipher — defends against an attack nobody is attempting, while the cheapest component — a counter — would defend against the attack that works. The lock is not unlocked by breaking the code. It is unlocked by copying the code, unbroken, and sending it again.