Disclosed are techniques for establishing an encrypted connection between a first node and a second node in a wireless mesh network. In an aspect, the first node receives, from a provisioner node in the wireless mesh network, a first value encrypted with a device-specific encryption key known only to the first node and the provisioner node, wherein the second node receives, from the provisioner node, the first value encrypted with a second device-specific encryption key, generates a friendship-specific encryption key based on the first value, an identifier of the first node, and an identifier of the second node, wherein the second node generates the friendship-specific encryption key, sends, to the second node, a first message encrypted with the friendship-specific encryption key, and receives, from the second node, a second message encrypted with the friendship-specific encryption key.