DLMS Security Suite 1 vs Suite 2: ECDSA, ECDH, AES-GCM-256 and Key Agreement
-
Evolution of DLMS Cryptographic Security Suites
As smart grid cybersecurity requirements increase (e.g. BSI TR-03109 in Germany and IEC 62056-5-3 Ed. 3), systems are migrating from Security Suite 0 to Suite 1 and Suite 2.
Comparison Matrix
Feature Suite 0 Suite 1 Suite 2 Symmetric Cipher AES-GCM-128 AES-GCM-128 AES-GCM-256 Key Wrap AES-Key-Wrap-128 AES-Key-Wrap-128 AES-Key-Wrap-256 Digital Signature None / GMAC ECDSA P-256 / SHA-256 ECDSA P-384 / SHA-384 Key Agreement Pre-shared Master Key ECDH (Ephemeral-Unified) ECDH (P-384) Hash Algorithm GMAC SHA-256 SHA-384 Suite 1 introduces public-key certificates (X.509 v3) directly into the meter, enabling digital signatures on meter billing records for legal non-repudiation.
-
In Suite 1/2, certificate management requires COSEM Class 115 (
Certificate Management). The HES can remotely query the meter's TLS/ECDSA root and leaf certificates, check revocation status via CRL, and renew credentials before expiration.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login