Why change the Zigbee Encryption Key and does it really work?

[lattice0]

This article https://www.zigbee2mqtt.io/advanced/zigbee/03_secure_network.html describes how to change the Zigbee Transport Key. As far as I understand, this is the key used by the zigbee end devices to encrypt their secret key and send to the zigbee hub. So this key needs to be known in advance by the zigbee end devices, doesn't it? If I change this key, how would the ZEDs know with which key to encrypt their keys?

Also: does the ZEDs generate a new key on each new pair? Or do they have a fixed key?

[Koenkk]

If you change the key, you will need to re-pair all devices (as indicated in the FAQ)

[lattice0]

I understand that, but how will the devices know the key so they can encrypt their key with?

[Koenkk]

The network key is exchanged when pairing the device.

[lattice0]

@Koenkk yes but it is exchanged encrypted with a master key. Which key is the network key then?

[lattice0]

Ok, I got it. The network key is for broadcasting and it's the same for all, while the master key cannot be changed because it's embedded into each zigbee device.

[Koenkk]

Exactly!