Yeouch. I was just looking at 'smartconfig.' Man is it ugly for security, even using AES. In the situation where you are a company and you have pre-provisioned your devices with specific AES keys to deliver to the public customer, those keys live on the device. We all know how to dump the storage, find the programs, perform disassembly or whatever is needed to find the keys. Now after they are publicly shared some war driver can capture your packets (or your neighbor can do the same) and your network is passphrase is known. Even without capturing the AES key, an attacker can drop a device with battery to capture the info of the target. The device can then get on the network transmit its passphrase to "destination hosts somewhere belonging to 'chchchoo' (sorry had to sneeze) the attacker." The device erases itself to avoid detection or maybe reconfigures itself for some rapid or stealthy recon. It could just alter the key to send you on a fools errand when doing your response effort to figure out what someone did. Basically smartconfig will unwittingly put the networks of your customers at risk -- or your personal network if you use it yourself.

No matter what, good security practices indicate that you should pay attention to what hosts are on your network -- or use good provisioning techniques that meet your risk threshold for your Intellectual Property (which may or may not include smartconfig). I don't use it.