<![CDATA[DLMS Security Suite 1 vs Suite 2: ECDSA, ECDH, AES-GCM-256 and Key Agreement]]>Evolution of DLMS Cryptographic Security Suites

As smart grid cybersecurity requirements increase (e.g. BSI TR-03109 in Germany and IEC 62056-5-3 Ed. 3), systems are migrating from Security Suite 0 to Suite 1 and Suite 2.

Comparison Matrix

Feature Suite 0 Suite 1 Suite 2
Symmetric Cipher AES-GCM-128 AES-GCM-128 AES-GCM-256
Key Wrap AES-Key-Wrap-128 AES-Key-Wrap-128 AES-Key-Wrap-256
Digital Signature None / GMAC ECDSA P-256 / SHA-256 ECDSA P-384 / SHA-384
Key Agreement Pre-shared Master Key ECDH (Ephemeral-Unified) ECDH (P-384)
Hash Algorithm GMAC SHA-256 SHA-384

Suite 1 introduces public-key certificates (X.509 v3) directly into the meter, enabling digital signatures on meter billing records for legal non-repudiation.

]]>https://dlms.sharur.org/topic/17/dlms-security-suite-1-vs-suite-2-ecdsa-ecdh-aes-gcm-256-and-key-agreementRSS for NodeFri, 16 Oct 2026 19:50:09 GMTSat, 22 Aug 2026 12:33:13 GMT60<![CDATA[Reply to DLMS Security Suite 1 vs Suite 2: ECDSA, ECDH, AES-GCM-256 and Key Agreement on Sat, 22 Aug 2026 12:33:14 GMT]]>In Suite 1/2, certificate management requires COSEM Class 115 (Certificate Management). The HES can remotely query the meter's TLS/ECDSA root and leaf certificates, check revocation status via CRL, and renew credentials before expiration.

]]>https://dlms.sharur.org/post/35https://dlms.sharur.org/post/35Sat, 22 Aug 2026 12:33:14 GMT