Hello SKay,
if you want to build HA compatible devices with Z-stack, you must set SECURE=1 and TC_LINKKEY_JOIN compil flag.
The security level of HA will be selected with the appropriate key to encrypt the NWK key, which is then used to secure packet using NWK layer encryption.
Thanks,
TheDarkSide